Are you able to flash magisk?
I tried V19 to v20.1 magisk, and also magisk-phh.zip custom magisk and the phone would just power off after the zte screen.
---------- Post added at 03:08 PM ---------- Previous post was at 02:59 PM ----------
I noticed that in phone info (*#*#4636#*#*), we can only select network type starting with "L" in the preferred network type option. The option won't stick if we choose other modes not starting with "L".
So I guess ZTE is limiting the network mode to LTE only with a simple regex expression in the kernel.
Since you know how to modify and compile the kernel, I am wondering if you can look for a line of code with regular expression to limit the modes starting with "L".
If we can set the preferred network mode to other modes like GSM after modifying the kernel, we may be able to use call and messages on other carriers.
You can try it if you have time. Thanks.
As for the network types... that's a bit of a goose chase, with a few too many assumptions for my liking. I'm not entirely certain it's just a regex thing, and even if it were I doubt it'd be in the kernel so much as one of the software packages. The size of the kernel presents another headache - even with a script to identify every declaration of a regular expression, combing through each of them, where they are, what they do, etc. would be a massive time sink, and to be honest I don't really have the time or energy to do anything else related to this phone at the moment.
It's worth noting that any of the stuff in that menu that starts with L starts with LTE, which is the default setting (ro.preferred.network.mode, or something) in one of the .prop files in the vendor partition; I briefly changed it from the default value (11, I think?) on my device without any luck; I think the changed values stuck to some extent without actually changing anything, but I've since reset my vendor partition to stock (other than editing the fstabs to disable force encryption).