over limit of 1048576, total not specified

That a strangely vague message in the context of HTTP. I'm assuming that pseudo security module is talking about a missing "Content-Length" header? (Also, 1 MB is quite tiny in modern web usage. Most minimized JavaScript libraries are larger these days...)

In your case, i'd look into the error handling module and check if it fails to generate the appropriate headers. Also, i'd look into coercing it to set the content type to something like 'application/octet-stream' if it detects binary data (e.g. if any byte > 127).

And, since its Perl we are talking here, bytes with a value greater than 255 also exist, which might or might not mess up other things as well. You might want to check if your $file variable gets real BINARY data or if there's an UTF8 decoder between you and the file on disk.