Reports success or failure on the game key and version check.

Result:

0x000: Passed challenge
0x0NN: (where NN is the version code supplied in SID_AUTH_INFO): Invalid version code (note that 0x100 is not set in this case).
0x100: Old game version (Additional info field supplies patch MPQ filename)
0x101: Invalid version
0x102: Game version must be downgraded (Additional info field supplies patch MPQ filename)
0x200: Invalid CD key *
0x201: CD key in use (Additional info field supplies name of user)
0x202: Banned key
0x203: Wrong product

Unknown result codes are treated as a success by client (i.e. equivalent to 0x000).

The last 4 codes also apply to the second CDKey, as indicated by a bitwise combination with 0x010.

If a patch file cannot be found, additional info may be set to 'non-existent' or a filename of a nonexistent file (eg W2BN_IX86_.mpq).

If the spawn flag was set to true in the client's request, and there is already a spawned key online, the result will be 0x201 with additional info set to TOO MANY SPAWNS.

* If you receive this status, official Battle.net servers will IP ban you for 1 to 14 days. Before June 15, 2011, this used to exclusively be 14 days.

More:

While doing a little research on how Battle.net autoupdates its clients, I found that it (STAR, anyway) does not use the provisions of the SID_AUTH login system to tell clients which update file to download. Instead, it sends a SID_REPORTVERSION (from the previous logon system) containing the equivalent error code and the name of the patch file to download. This seems strange, and makes me think that the part of Battle.net responsible for updating clients is isolated from the part responsible for processing logon requests. If this is the case, it makes sense that that system was never updated, since it must still support legacy clients. In addition, this would explain why most Blizzard clients retain obsolete packet processing code.