I don’t think it’s a measurement bug. The “bytes in” (overall) measures at the socket level and is guaranteed to be the number of bytes that came in over the wire (even if there was a problem with reporting individual requests). I also tried a few other HTTPS sites and they appear to be reporting correctly (was a bit worried because I just updated the HTTPS reporting flow for Chrome this morning).
I think you’re tripping over a Chrome bug (or edge case) because Firefox appears to be correctly serving things from cache. I haven’t had time to dig in and see which headers may be triggering it though.