To poke around in these firmware, there is https://github.com/0xB…/main/netgear-fw-tools . And my Kaitai grammar https://gist.github.co…1e901e57879055c602b286 , with which you can poke around in decrypted Netgear firmware or in firmware of Sierra Wireless devices.

The available bands for a specific model are rigidly fixed in the modem firmware. It is impossible to change the modem firmware, because they are signed by the manufacturer with a certificate chain.
It is unknown whether it is possible to force the modem to consider itself a different model.
A bootloader that will allow editing memory without a hardware programmer is not yet publicly available for the M6 and M6 Pro. There is fastboot, but it is not a fact that it can access the desired memory area (most likely not).
Climbing with a soldering hair dryer into your modem for ~$ 1000 for the sake of an experiment that is not sure that it will give a result is a very strange step. Because it will definitely not add stability to the device.
If you want such experiments without any obligations regarding the results, then you can give me 2 working modems of different models. Then I will climb with a hair dryer and play with the resoldered memory chips. But it is not a fact that it will work, and even if it does work, it is not a fact that it can be repeated without the work of a programmer.

The available bands for a specific model are rigidly fixed in the modem firmware. It is impossible to change the modem firmware, because they are signed by the manufacturer with a certificate chain.
It is unknown whether it is possible to force the modem to consider itself a different model.
A bootloader that will allow editing memory without a hardware programmer is not yet publicly available for the M6 and M6 Pro. There is fastboot, but it is not a fact that it can access the desired memory area (most likely not).
Climbing with a soldering hair dryer into your modem for ~$ 1000 for the sake of an experiment that is not sure that it will give a result is a very strange step. Because it will definitely not add stability to the device.
If you want such experiments without any obligations regarding the results, then you can give me 2 working modems of different models. Then I will climb with a hair dryer and play with the resoldered memory chips. But it is not a fact that it will work, and even if it does work, it is not a fact that it can be repeated without the work of a programmer.

Использование команды AT!NVIMEIUNLOCK (сначала требуется AT!OPENLOCK) откроет папку rfnv на diagnostic port over the network, она также может открыть папку nvm.