I spent 4 hours trying to figure out why my pdf files were not being downloaded correctly when clicking on the file links in the Secure Files page.
The md5 checksum was different between the file on the server and the downloaded file. The problem came in the fopen/fread section of the ajax/download.php file. I'd checked that fopen was definitely opening the correct files and tried all different types of header settings.
The eventual cause was that I had WP_DEBUG set to true. Hopefully this will help someone else if they hit the same problem.