The problem is that open2 creates new filehandles for you to read from and write to and assigns them to the handles you pass it, instead of just using the ones you pass it. What you really want to do is more like this (which works for me):

#!/usr/bin/perl

use warnings;
use strict;

use IO::Socket::INET;
use POSIX;

my $sock = IO::Socket::INET->new(PeerHost => 'example.com', 
          PeerPort => 9999)
  or die "Couldn't open socket: $!\n";
my $pid = fork;
if (!defined($pid)) { die "Couldn't fork: $!\n"; }
if (!$pid) {
  # child
  POSIX::close(0);
  POSIX::close(1);
  POSIX::dup2(fileno($sock),0);
  POSIX::dup2(fileno($sock),1);
  print "Running lsz $0...\n";
  exec('lsz','-v',$0)
    or die "Couldn't run zmodem: $!\n";
}

# Parent
wait
  or die "lsz failed: $?\n";
print "lsz exited $?\n";
[download]

Note that example.com isn't a real system, on my system, sz is called lsz, and this script sends a copy of its own source code.

Also, you'll want to make sure you use the appropriate options to sz and rz to make them telnet-safe; otherwise some of the characters they send could be interpreted as telnet escape sequences, which will cause you no end of grief. I use the -e and -b options for zmodem over ssh, and it usually works.