After checking Charles .keystore manually, I did find a reference to the intermediate CA. It was added as a root CA some time ago but then manually removed from the GUI for another root CA; however, it was not actually deleted from the keystore, and Charles was sending it behind the scenes. I had to reset the keystore, and now the behavior is as expected.