The data at 0x180004 to 0x180033 in nv_data.bin seems to be related to the AT+MSLSECUR command:
AT+MSLSECUR=1,0 on a phone with undamaged /efs responds the serial number:
AT+MSLSECUR=1,0
+MSLSECUR:1,RFXXXXXX
if you copy these offsets from undamaged /efs to another phone the data gets...