Looks to me like the latest verson of K2 (2.6.2) and sh404sef have issues with attachments.
Tested without sh404sef and all works fine

When sh404sef enabled attachments downloads come out as garbled on screen content
The download link created is
index.php?option=com_k2&Itemid=212&id=128_c1caaa5144c046434c4dcf731f28ba38&lang=en&task=download&view=item

This seems to have some token in it. MD5 hash or Joomla token?

Either way its a pain in arse as downloads don't seem to work. Can get around with $attachment->filename link but then you have to open up your htaccess/Admin Tools rules etc

No one else with this issue?