Apache range request denial of service

If the HTTP specification says that the server needs to either return the requested ranges or the entire document, why would you consider clients "arguably" broken if they don't handle the server violating the spec?

If the clients are expected to handle the server returning an equivalent set of ranges, you're asking that if the client asks for the first 100 bytes of a file that the server could return 100 single byte range responses in a random order, for example. Now you've got another problem: the client might now have to buffer the entire response before it can interpret it.

The proposed patch by Apache seems like the least bad option here.