Ok, I figured it out myself, with help from Igor's PassThruAPP. MSHTML
gets the status code from IWinInetHttpInfo::QueryInfo. Took me a while
to figure out why it's not query for the interface. Per another of
Igor's post, APP doesn't work correctly without aggregation support.
UrlMon apparently aggregate your protocol object and makes it part of
the moniker that MSHTML gets.