My test showed that WordPress itself does not limit access of user with list_users and promote_users capabilities in the role to any other role (‘Administrator’ role is hidden from such user by User Role Editor).
Look at this short video.

So I still suppose that some code (external for WordPress) is involved (plugin or theme).

Did you try to deactivate all plugins temporally. Will be access of user promoter to other roles limited in the same manner?