We've tracked this down and have a fix coming.
The SHA256 algorithm (only exposed to scripts) produced incorrect results for files >= 512MB. (The same bug is in lots of implementations of SHA256, it turns out. It's almost like a separate hash function due to how common it is, but we'll change ours to match the correct version.)