I heard back from MS support to the effect of the following: it
isn’t possible to hold the connection open using
SF_STATUS_REQ_FINISHED_KEEP_CONN before the page actually starts
processing. This means that responding to SF_NOTIFY_PREPROC_HEADERS
or SF_NOTIFY_AUTH_COMPLETE will always close the connection
regardless. What they also told me, which was the original reason
for playing with this, is that “it will not [therefore] be possible
to [implement custom NTLM] with IIS 5.x [and] that you will need to
use IIS 5’s NTLM implementation if you want to use NTLM.”

This was all a little bit disappointing.