Are you kidding me? That was absolutely the solution. For the internet's future reference (and in case anyone besides me is still using CGI), POST_MAX has to be set in the script receiving the POST, not the script sending the POST. I don't know why that wasn't clear, but it absolutely wasn't. The CGI documentation left me with the impression that POST_MAX would prevent a script from submitting a too-large post, not that it would prevent a script from receiving a too-large post.

Thank you!

Don't feel bad. Easy and common mistake for early attempts in this area. Note however that the first form/CGI does not send the POST at all; it sends nothing to the second. It presents a form to the browser which gives the browser the parameters that it should POST and where to do it.