Basically, it seems that clearing the flags needs an extra step since they seem to be encrypted in some unique per savegame way.
I've just thought a tedious way of locating where the secret value migth be, albeit time consuming:
1) Create two blank savefiles (A and B) (blank so less data is in them, the 3DS link feature is accessible anyways).
2) Put the value at 0x25E00 from B in A, then check if any of the lengendaries can't be transfered anymore (we want at least one to be flagged as already transfered)
3) Start inserting blocks from savegame B into savegame A. After each insertion, check if the game allows to transfer the legendary again.
4) Repeat 3 until we can transfer the lengedary.
Those steps would allow us to locate the block where the value used with 0x25E00 is stored, from there locating the actual value should be easier...at least in theory.
Another option would be to reverse engineer how the value at 0x25E00 is generated on a new game, but that's something I can't do. This reminds me of the mirage island in ORAS, I hope this uses a simple operation with a value somewhere in the save, and not a complicated algorythm like that one (which someone actually went and kindly reversed).
EDIT: I've been using desmune and I've noticed that each time you receive 3DS link data, the value at 0x25E00 is different, so as I feared this seems to have some RNG involved...