IIUC the proposed filter is expected to read the multi-part content-body and run an antivirus on the content read. Is that right? If so, I'd be curious to know how will the content-body be 'forwarded' to downstream servlets (CreateAssetServlet in this case) so that they can continue processing it......

Can you consider enabling audit.log entries to see what's the exact conflict? (note the change of log-level for audit.log to TRACE)