Thanks,
Your example works fine for me too, so I've updated my original post to show the full subroutine.
$cmd calls radclient to do a test auth against a remote radius server. If I deliberately cause an error, say for example using an incorrect port (causing "radclient: no response from server"), it still comes to _my_ STDERR when I run it.
Any clues?
Comment on Re^2: Capturing STDERR from a piped open
AFAICT, you're trying to feed the external program's stdin through a here-doc, which looks quite hopeless to me. Read what the Good Cookbook has to say about accessing stdin, stdout, and stderr of another process (recipe 16.9, pp. 639-641).