Appending to the XFF header does not work as expected

Yes indeed hdr appears to be the wrong tool for the job. It is parsing comma as delimiter, so it returns 3 times in this case.

Replace it with fhdr, that should do the job.

http-request replace-value x-forwarded-for ^ "%[fhdr(x-forwarded-for)], %[src]"