Why does vanitygen ban certain letters on testnet?
The rules are the same, but the available range is different. In the testnet the address prefix is 111 (https://en.bitcoin.it/wiki/List_of_address_prefixes).

To deduce the address you write in base58 the prefix concatenated with a 160 bit (20 bytes) hash of the public address and a checksum of 4 bytes (https://en.bitcoin.it/wiki/Technical_background_of_Bitcoin_addresses). This makes a total of 25 bytes. 

With a 111 prefix you have all the numbers between 111*2^(24*8) and 112*2^(24*8)-1. In binary form you have values from

1101111000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
to

1101111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111

which is 111 (in binary 1101111) and all the possible combinations of the hash and checksum values. 

If you write the numbers from 111*2^(24*8) to 112*2^(24*8)-1 in base58 encoding (https://en.bitcoin.it/wiki/Base58Check_encoding) you have the range from:

mfWxJ45yp2SFn7UciZyNpvDKrzbhuzkU7H 
to
n4rZHAPGXCu8bYchjzJhK3V7VVredELJRc

All your proposed addresses are below the first possible one.