All ARM images under https://kali.download/arm-images/kali-2026.3/ are served from a
stale Cloudflare cache entry, so the downloaded file does not match SHA256SUMS.

Reference (fresh, from SHA256SUMS, Last-Modified: Sun, 25 Oct 2026 22:53:31 GMT):
raspberry-pi-arm64.img.xz -> 85906ae2758c9cc969553579161ff80bbac1130701b24bc375e6100b73ee4843

Actual download (canonical URL):
raspberry-pi-arm64.img.xz -> 933db34cf838cc0f2efc5f8240ba3ffdf80d275bb98b55dccc52508e047c1e32

HTTP headers of the canonical URL:
server: cloudflare
cf-cache-status: HIT
age: 664335
cache-control: max-age=20736000
last-modified: Sat, 24 Oct 2026 11:59:10 GMT
etag: "6adc9d8e-c736c588"
content-length: 3342255496

Same object fetched with a cache-bypassing path (double slash, cf-cache-status: MISS):
last-modified: Sun, 25 Oct 2026 22:55:27 GMT
etag: "6ade88df-ca0d4d18"
content-length: 3389869336

The .torrent files are stale in the same way:
canonical -> 4d76c5b3... (1594 x 2 MiB pieces)
SHA256SUMS -> 74007534... (809 x 4 MiB pieces)

Consequences: BitTorrent clients report "download verified" because the stale
.torrent matches the stale image, while SHA256 verification always fails.

Affected (canonical content-length != origin content-length):
raspberry-pi-arm64, raspberry-pi-armhf, raspberry-pi-zero-2-w-armhf,
raspberry-pi-zero-2-w-pitail-armhf, gateworks-newport-arm64,
pinebook-arm64, pinebook-pro-arm64

Suggested fix: purge these objects from the CDN cache and/or shorten
cache-control max-age for image/torrent objects.

Steps to reproduce:

1. curl -sIL https://kali.download/arm-images/kali-2026.3/kali-linux-2026.3-raspberry-pi-arm64.img.xz
   (note: cf-cache-status: HIT, large age, content-length 3342255496)
2. curl -sIL --path-as-is https://kali.download/arm-images/kali-2026.3//kali-linux-2026.3-raspberry-pi-arm64.img.xz
   (cf-cache-status: MISS, content-length 3389869336)