I'm investigating a bug in Evan Miller's excellent mod_zip add-on.

The mod_zip code, running as a filter, issues one or more subrequests.
To support byte ranges, Evan sends a different Range header with each
subrequest (thus relying on nginx's built-in Range filter to do the
actual truncation). To accomplish this, the code modifies the
r->headers_in.range structure of the main request before each call to
ngx_http_subrequest (the code calls this "a dirty hack"). In
psuedocode it looks like this:

while (rc == NGX_OK && more_subrequests_to_make) {
modify r->headers_in.range
rc = ngx_http_subrequest(r, uri, args, &sr, NULL, 0)
}
return rc

Assume that each call to ngx_http_subrequest returns NGX_OK (in other
words, the subrequests require no network access). In that case, this
code works in nginx 0.7.24 and below. A subrequest's headers are
committed and sent immediately after the call to ngx_http_subrequest.
In 0.7.25 and above, however, this code fails to set a unique header
per subrequest. Instead, all subrequests inherit the Range header set
in the final loop iteration. In other words, no subrequest is
committed and sent until after the loop completes.

Is there a "proper" way to set different header values per subrequest?