The difference is a lookahead versus a lookbehind. If you ignore the lookahead/lookbehind because they are zero width (don't consume characters), you would expect /^($start(\w+(,\s)?)+)$/ to grab an entire string between start and finish. When you get to the part of the regular expression where you have your assertion, the cursor is here:

log4j.rootLogger=INFO, FILE, SYSLOG
                                   ^
[download]

If you look ahead of this position, there is nothing, which clearly passes the negative lookahead check. The offending string is behind your position, thus you need a negative lookbehind.