As usual, I ask a question after a couple of days of research, then immediately realise the answer: I'm doing it wrong.
My definitions included the following "suites":
TLS has a cipher suite specifier length of 16 bits. My code, when given these 24-bit identifiers, ignores the high 8 bits. This means I'm really scanning for 0x0080 a few times, 0x0040, 0x00C0, 0x0001, 0x0003, 0x0004 (*), 0x2840, 0x8040, and 0x8001.
Since 0x0004 is
RSA_WITH_RC4_128_MD5, and the target server supports that suite, my code was incorrectly reporting that
PCT_SSL_CIPHER_TYPE_1ST_HALF was enabled. It just happened to coincide. Other values did not align with enabled cipher suites, so that's the only one that cropped up.
I've now removed these definitions since they're erroneous for SSL/TLS.