The service is hosted in /_vti_bin, and uses SharePoint's own BasicHttpBinding service host factory (MultipleBaseAddressBasicHttpBindingServiceHostFactory). According to Microsoft's guidance, three endpoints should be generated, such as one for NTLM authentication.
My service client is hosted on another webpage. It instantiates a new BasicHttpBinding with all the proper values set for NTLM to be used (I've even tried username/password with NetworkCredentials to rule out any kerberos / double hop issues, to no avail). No matter how I go about it, the service never poses a 401 challenge, and the client is therefore never authenticated.
This is driving me completely bonkers, as there are few notes on this out on the web. It doesn't seem to me like BasicHttpBinding services are even supposed to work with SharePoint Claims, as the WIF implementation goes to great lengths to surpress 401 challenges internally.