Thanks,
Your example works fine for me too, so I've updated my original post to show the full subroutine.
$cmd calls radclient to do a test auth against a remote radius server. If I deliberately cause an error, say for example using an incorrect port (causing "radclient: no response from server"), it still comes to _my_ STDERR when I run it.