Interesting. I had more luck sending
IAC WILL ECHO IAC WILL SUPPRESS_GO_AHEAD IAC WONT LINEMODE
255 251 1 255 251 3 255 252 34
The IAC WONT LINEMODE seems to be redundant: my telnet client seems to get to the right state without it, but I left it in for completeness.