I've found a couple of things:
When the reply to the fetch is given, it seems to be missing a ")" on the end:
23 UID FETCH 48 BODY.PEEK[]<8192.1915>
- 48 FETCH (UID 48 BODY[]<8192> {1915}
How does an IMAP client learn the size of a message? Because the size of this particular message is 10107 bytes (header + message, in a maildir file). The IMAP client (Mac OS X Mail.app) asks for two chunks of the body: 8192 and 1915. Together these two make 10107, but that's 1448 bytes too big. In fact, 1448 is the size of the header it requests:
21 UID FETCH 48 BODY.PEEK[HEADER]
- 48 FETCH (UID 48 BODY[HEADER] {1448}
Together, that is 11555, too much.
Further investigation gives me this:
For another message that is 11821 bytes (header+body,maildir), this is the request:
37 UID FETCH 20:* (INTERNALDATE UID RFC822.SIZE FLAGS BODY.PEEK[HEADER.FIELDS (date subject from to list-id)])
- 17 FETCH (UID 20 FLAGS (\Recent) INTERNALDATE "26-Mar-2003 09:47:03 -0800" RFC822.SIZE 12116 BODY[HEADER.FIELDS (DATE SUBJECT FROM TO LIST-ID)] {148}
If you multiply the simple header returned by this (148) by two, then add that to the filesize of the message, you get 12117 (minus a CR probably). Is this how RFC822.SIZE is defined?
Anyway, in conclusion, it now DOES work, it's just that apparently Mail.app cached the old file sizes on the broken messages, so those didn't work (i think).
Thanks again Timo.