I suspect you're getting an implicit conversion issue.   Somewhere in your processing, that data type of VARBINARY(40) is getting implicitly converted, and that succeeds because the resulting data type is likely some kind of character string, where an additional 0x00 worth of binary data is irrelevant, because most string data types using a binary 0x00 to terminate the string, down at the lowest level.   Thus the comparison only processes up to the string terminator.   Figure out why you need varbinary() or figure out where the implicit conversion occurs.   The only question that remains is understanding how varbinary values are terminated.  I don't know that answer...