It appears that %b logging of bytes sent can be wrong if something happens to the connection during the request processing.
The number logged by mod_log_config is r->bytes_sent, which is computed in ap_content_length_filter(). If something goes wrong (maybe I pull Apache's network cable) while sending the response, the connection gets aborted, but r->bytes_sent isn't changed, and so the access log shows that the full length of the response was sent. You can add %X to the logging to see whether the connection was aborted, but the number of bytes sent logged is still wrong. I'm wondering if there's some good reason for this that I'm missing? Or maybe it's just an oversight I've noticed since I happen to be looking at that part of the code right now. Thanks, Dan