actually, i take some of that back, didn't do enough homework. SSL_write will break the calls to mem_write() into reasonable chunks (~16k).
so we don't need this part of the patch: + while (len > 0) { + int wlen = len > AP_IOBUFSIZE ? AP_IOBUFSIZE : len; + if ((nrd = SSL_write(ssl, buf, wlen)) < 0) { ... i'll keep digging in and post another patch, but the BIO_bucket concept still applies.