Okay, issue resolved, here is the lowdown on what happened...
The "Download Validation Script Location" must ***ALWAYS*** be at or below the WordPress root directory. Normally, this maps to the same PHYSICAL directory as your WordPress installation. But under WordPress Multi-Site, there is only one physical WordPress installation directory, and rewrite rules are used to map network blogs into LOGICAL directory or domain paths.
In this case, the networked blog had a logical URL path of domain.ca/sub_blog and thus /sub_blog became the LOGICAL WordPress root directory.
Therefore, the Download Validation Script Location must be set as: domain.ca/sub_blog/downloads/
However, back in the PHYSICAL world, the actual location of the downloads directory is in the location you'd specify if you were to use a custom script location of domain.ca/downloads/ on the main blog.
I know, it's complicated... Normally, a warning message appears in the settings menu that explains all of this, but because of the logical remapping that takes place on subdirectory installations, the warning logic gets confused.
