Wow. It seems as if this has been discovered by rigorous manual inspection of the code (as opposed to just fuzzing the binary to death).
Hats off!
Hats off!
I discovered this via a coverage based fuzzing engine with a dictionary (containing those magic numbers). Said fuzzing engine is similar to libFuzzer, but I have designed it with a focus on fuzzing closed source Windows binaries (PE).