Good call on the .* There is a node around here called Death to Dot Star! which explores this further. But your regex still needs work. The bracket elements are not a group, they are individual. meaning that it would catch any html item, not just -- >, because it matches the > alone. Ok?
How about:

$html =~ s/<!--%(?!%-->)DOS(?!%-->)%-->/GONE/s;
[download]

I'm not sure about that regex, I've never used a zero-width negative look-ahead assertion, but I think that's the right direction.