This happened to me when I was working with S3 over a corporate proxy which stripped the "range" header, causing the sigv4 not to match because the headers changed. Do you possibly have something similar in place?