Checking your code in the other post
Since it’s passing the CLI test, but not “real” EventSub
The only thing I can think of, at this point, is that you have hard coded the Content Length header and “real eventsub” used a different length/format of challenge to what the CLI uses.
As the cli here is just generating what amounts to a GUID, but real eventsub will use whatever it wants and expects you to return the challenge as it sent the challenge to you, regardless of the length/format of that challenge.
The specific format/length of a challenge is not documented it could change at any point, and even be a function of your declared shared secret when creating the subscription.
So you could update your C script to log the inbound challenge and check what you are sending back to “real eventsub”, in case real eventsub is not sending a challenge of length 36.