Right. Just when you think you've figured it all out, along comes:
-> card.freenode.net MODE #thisisatest +b ~R:xyz
<- :user!nick@host MODE #thisisatest +b *!*@~R:xyz
Whereas on UnreadlIRCd:
-> irc1.unrealircd.org MODE #thisisatest +b ~R:xyz
<- :user!nick@host MODE #thisisatest +b ~R:xyz
Not too sure what freenode is doing there.
Update: A little more testing on UnrealIRCd shows that it allows:
-> irc1.unrealircd.org MODE #thisisatest +b *!abc@~r:def.org
<- :user!nick@host MODE #thisisatest +b *!abc@~r:def.org
-> irc1.unrealircd.org MODE #thisisatest +b ~r:*!~r:abc@~r:def.org
<- :user!nick@host MODE #thisisatest +b ~r:*!~r:abc@~r:def.org
So the $[~]<type>[:<data>] format can appear anywhere inside an address and more than once.
Update: I've implemented the case-sensitive/case-insenstive dual-comparison split based on the first : in the address. This will only be enabled for networks that contain two different cases of the same character in EXTBAN. This will be in the next beta.