Right. Just when you think you've figured it all out, along comes:

-> card.freenode.net MODE #thisisatest +b ~R:xyz
<- :user!nick@host MODE #thisisatest +b *!*@~R:xyz

Whereas on UnreadlIRCd:

-> irc1.unrealircd.org MODE #thisisatest +b ~R:xyz
<- :user!nick@host MODE #thisisatest +b ~R:xyz

Not too sure what freenode is doing there.

Update: A little more testing on UnrealIRCd shows that it allows:

-> irc1.unrealircd.org MODE #thisisatest +b *!abc@~r:def.org
<- :user!nick@host MODE #thisisatest +b *!abc@~r:def.org

-> irc1.unrealircd.org MODE #thisisatest +b ~r:*!~r:abc@~r:def.org
<- :user!nick@host MODE #thisisatest +b ~r:*!~r:abc@~r:def.org

So the $[~]<type>[:<data>] format can appear anywhere inside an address and more than once.

Update: I've implemented the case-sensitive/case-insenstive dual-comparison split based on the first : in the address. This will only be enabled for networks that contain two different cases of the same character in EXTBAN. This will be in the next beta.