Re sscd - I wonder if we know how sscd answer regulatory domain? For devices without working modem, a dummy fake sscd that reply whatever it's told to reply could be created...

I still think that current implementation is not only dumb, but idiotic - No reason to have device falling back to some obscure* regulatory domain (US) in absence of info from SIM, if all other regional settings on the device points otherwise.

*no offense to US'ians - by "obscure" I mean "appropriate in minority of the world, and no real reason to use it as default". AFAIK, neither Europe, Asia, Australia, South America or Antarctica demand locking of upper 2,4GHZ channels. We could, as well, apply North Korean rules and lock all radios by default - you know, just to be on the safe side and avoid accidentally breaking radio laws...