Identifying ASM signatures affecting responses?

Update. I actually went through the signatures list for the policy, and attack type by attack type, disabled them all. That didn't fix the problem. Then, I updated the "*" parameter by unchecking "Check attack signatures on this parameter", and it's still broken.

There's no denial of service policy in effect, btw. But when I remove the security policy from the virtual server, the issue goes away.

Kind of at my wit's end (admittedly, didn't take long to get there). No idea what it could be. Any thoughts, even wild guesses, appreciated. I'm kind of out of theories.