This may have been how he did it...
1. Dump the ROM image
2. open it in a hex viewer...
3. search for "FF FF FF FF FF FF FF FF 9B 4F FF FF 64 B0 00 00"
4. search for the same hex values again...
This is what I get at offset 003B9090:
FF FF FF FF FF FF FF FF 9B 4F FF FF 64 B0 00 00 64 00 00 00 50 BF 04 80 00 00 60 00
Looking at stuff around XDA Developers I came up with the same conclusion that we have a 6mb page pool.
Now because this was done with information from other devices, this may not be the correct one as CDMA devices can sometimes be different. There are two occurrences of this string and all instructions say take the second one...
This is what I used as a guide to find the page pool size: