I assume these are the "request string parameter" values (two-byte addresses) with the function code $43 - correct?
Yes. I've only looked into what is used in rig files. A rig file is just a single track standard midi file with modified header and track tags.
I haven't had a deep look at performance files (IIRC they are multi track SMF), perhaps there's messages there that could be useful.
Outside of that you would have to either brute force the extended messages or reverse engineer parts of the usb protocol used by rig manager (It uses a message encoding that is similar to the SysEx format. Someone else was trying to write a linux driver some time ago but I can't find the thread)
You might be able to tease out the extended addresses, by capturing a well chosen edit (something unique that can easily be searched for), with WireShark.