By the looks of it, the problem is not something that’s new. This thread from the Virtualbox forums addresses the same issue and it goes back all the way to 2009. And the last post in the thread provides the right solution, which is to turn off sendfile in httpd config.
Curiously, EnableSendFile defaults to ‘off’ in the stock installation, but disabling it specifically gets rid of the problem. This should be fun to dig into and unravel, but I will leave that for another day.