I had forgotten how much the bands would be sliced up commercially, so yeah it makes sense that equipment can narrowly segregate. The two separate Verizon ranges are probably UL/DL, no? If you're messing with your own base station, then it seems like the phone would be the violator on the uplink frequencies, heh heh.

For opening up, fundamentally any device should be open to inspection and modification by its owner. But my specific desire would be to eliminate the fixed identifiers from the protocol, to restore some privacy of these tracking devices we expect to carry everywhere.

Homebrew hardware and a Free stack would be a massive undertaking and capital-intensive to distribute. So a better starting point would be some already-distributed piece of consumer hardware. I'd think there would be at least one device that got reverse engineered enough to create some community flash-it-yourself distribution. Perhaps I'm just not doing the right searches, but I just run across vague allusions from either people who are in the know and NDA, independents who dug in a bit but only published summaries of results, or commercial-oriented unlockers only interested in achieving their narrow result.

I guess I'm left wondering whether Qualcomm's hardware security really is that good to destroy the enthusiasm for such tinkering, or whether it's just their legal goons have so far successfully contained the knowledge to the secretive unlocking market.