I heard back from MS support to the effect of the following: it isn't possible to hold the connection open using SF_STATUS_REQ_FINISHED_KEEP_CONN before the page actually starts processing. This means that responding to SF_NOTIFY_PREPROC_HEADERS or SF_NOTIFY_AUTH_COMPLETE will always close the connection regardless. What they also told me, which was the original reason for playing with this, is that "it will not [therefore] be possible to [implement custom NTLM] with IIS 5.x [and] that you will need to use IIS 5's NTLM implementation if you want to use NTLM."

This was all a little bit disappointing.