There are two bugs in the userpic stuff, the second of which came to light when I was looking into the first. The first I'm yet to track down properly and is affecting users (so we need to fix it ASAP) while the second I know exactly the cause of but isn't affecting anyone at this time. (Always the way, isn't it? ;))
The symptoms of the first problem are pictures which claim to have uploaded but display as broken images. ladydiana and jillw helped me to investigate the problem and by matching up the error message with one of the four almost-identical messages in userpic (heh) I narrowed it down to the fact that the data exists in the global userpic table, but the actual image data in userpicblob is either missing or empty.
All of the reported cases seem to be on users with global data (that is, they're not cluster-converted yet), so I think this only affects unclustered journals. This opinion is strengthened by the fact that pictures reportedly tend to start to work after a while, which could be the cluster-conversion happening and moving them from global data.
A userpic currently exhibiting the problem is picid # 1258843, owned by a user who is still on global data at the time of writing. Since I don't have access to the database, I can't go in and see what exactly is wrong with it, so I'm just guessing here. Either the data isn't getting inserted at all, or perhaps it's getting inserted into userpicblob2 on cluster 0 when it should be going into userpicblob. I don't know if the global data master has a userpicblob2 on it, of course.
I'm thinking the problem is in the determination of whether a user is clustered or not, either in uploadpic_do or userpic. Determining if the data is present in the correct place would go some way to suggest which it is. However, this is pure speculation.
The CVS commit log for uploadpic_do.bml claims to have fixed a problem like this by checking the readonly flag. However, since this problem seems to occur on unclustered journals I don't think it's the same issue mentioned as these accounts wouldn't have gone read-only yet.
The other bug is in uploadpic_do.bml. Since it's not a major issue, I've not made a patch since it can be dealt with while the other problem is being fixed. The uploading thing needs to check before inserting data into the global userpic table whether the user cluster is available assuming the user is clustered. At present, if a cluster master goes away for a moment, a row will get inserted into the global userpic table but it'll have no matching data in the userpicblob2 table on the cluster master. This will result in the same symptoms caused by the other bug above. These are not the same bug because this problem would result in an error message while the above problem results in a success page. Also, none of the cluster masters have gone down yet to my knowledge! ;)