mORMot Open Source

In my brief research, I believe how your code works is you pass the flag HTTP_SEND_RESPONSE_FLAG_PROCESS_RANGES to winhttp, as well as the file handle to the complete file; and http.sys will then extract the appropriate range of bytes out of the file and return it?  If my understanding is correct, I believe HTTP.sys is deciding it wants to send less data than the CustomHeader you add, so it adds a content-range with a smaller range and sets the content-length to the amount of data it decides to send.. or something like that..

I could try to make a small sample to allow you to replicate the issue; would you like that?

Ok, I gathered a bit more info..

So the HTTP request specified a range of in the request header.
"Range: bytes=65536-"

With the AddCustomHeader() call present in the Execute() function, the response includes two ContentRange headers in the response.

Here is the response:
HTTP/1.1 206 Partial Content
Content-Type: video/webm
Content-Range: bytes 65536-9812906/9812907
Accept-Ranges: bytes
Server: Microsoft-HTTPAPI/2.0
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET, POST, PATCH, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers: Origin, Content-Type, X-Auth-Token, X-Requested-With, Accept
Access-Control-Expose-Headers: origin, content-length,location,server-internalstate
Accept-Encoding: synlz,gzip
Date: Tue, 19 Jan 2021 16:46:53 GMT
Content-Length: 9681835
Content-Range: bytes 65536-9747370/9747371

Both Content-Range headers specify the content starts at 65536 (correct) and they both have different lengths.
The top Content-Range one is the one generated by the AddCustomHeader call.  It goes up until 9812906 which is the end of the file. 
The second Content-Range header is one I'm presuming is added by http.sys.  It only goes up to 9747370 (not quite the end of the file).
The Content-Length header is valid only for the second Content-Range header. 
So it looks like http.sys is adding a content-range with a different range than addcustomheader(), and the content-length field matches the one http.sys added.

I'm trying to sniff the connection to see how many bytes of actual payload get sent (I'm assuming content-length is correct).

When I remove the AddCustomHeader() call, the response looks like this.  Only one content-range line, and the content-length matches it correctly.

HTTP/1.1 206 Partial Content
Content-Type: video/webm
Accept-Ranges: bytes
Server: Microsoft-HTTPAPI/2.0
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET, POST, PATCH, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers: Origin, Content-Type, X-Auth-Token, X-Requested-With, Accept
Access-Control-Expose-Headers: origin, content-length,location,server-internalstate
Accept-Encoding: synlz,gzip
Date: Tue, 19 Jan 2021 16:49:16 GMT
Content-Length: 9681835
Content-Range: bytes 65536-9747370/9747371

Edit:  The length of the payload returned was correct for the Content-Length header that was specified.