It’s a 4 digit PIN, do you really think hashing would do anything other than amuse hackers?
Were this not the case, I would have claimed that the number of combinations was 10^3 + k^3 rather than 10^3 x k^3.
If the challenge is indeed made in tandem then the PIN is essentially just a mandatory 4-digit prefix to the password. Still, the fact that only three characters of each part is requested is essentially fatal to the security any hashing scheme, as you say.
Even though this is not as ridiculous as hashing the four PIN challenges independently, which would be crackable with a lookup of amusingly-small size 1000, it still only needs a lookup of size about 700^3 =~ 350 million.
This might be roughly the threshold to annoy rather than to amuse?
Getting even more exotic, if the salt were also ENORMOUS, then it could make computing the required ~350 million hashes rather a costly endeavour (even in the event that the salt was obtained together with the hashed challenges).
Anyway.