IIS rewriting location header before ARR

We have a rewrite configuration that treats ARR as a reverse proxy in a configuration like this:

Browser client (OriginA) <-> IIS/ARR (OriginB) <-> Server

The client is any number of web browsers. We cannot change this configuration.

1. The client requests http://originb/return with a URL such as http://origina/done.html in the request.
2. ARR then forwards the request to http://server/return.
3. The server responds with the Location header set to http://origina/done.html and HTTP 302. I've verified this with Wireshark.
4. IIS somewhere in the pipeline is changing the Location header to http://originb/done.html. This is where the problems begin.
5. ARR sees the originb URL in a PATTERN_MATCH step for the Location header.
6. ARR reports the originb URL as the Location header in the GENERAL_RESPONSE_HEADERS step.
7. The client blindly accepts the URL and redirects to the non-existent http://originb/done.html instead of http://origina/done.html

I've cranked up Failed Request Tracing and thats how I saw steps 5 and 6.

What could be causing IIS to rewrite the Location header before ARR? Are there any other IIS tools I can use to figure this out?