It appears that if I use this module ( https://gist.github.com/mandreko/8323258 ) which has pretty much stolen almost all the linksys http/wget server code, but set a manual payload (setting DOWNFILE and DOWNHOST to point to an msfpayload-generated file) it works. If I let metasploit generate a payload it fails. In looking at the files, the module produces a 252 byte payload, where msfpayload produces a 268 byte payload.

Is it possible there's a difference between how msfpayload is being called and either in my module, or in MSF to explain the byte size difference?