I am working on a solution for this.
I have experience doing sim unlocking (I found the sim unlock method for the LG Optimus 3D).
I bought one of this phones to try to unlock it.
What I have found so far:
-The uicc unlock is preformed by Sprint OTA (over the air) by sending a network message to the phone to init the unlocking function.
-This message can be sent by generating a fake message and using a software DFS CDMA to comunicate to the device modem and generate the secuence.
-This was done to the Sprint Galaxy S4 but now Samsung implemented a signed encrypted package for the S5.
-By default, domestic networks (Tmobile and ATT) are locked even though sprint unlocks the uicc
-This can be overriden easily once we unlock the uicc
What I need to continue my search:
-a EFS and NVRAM Backup of a phone that had the uicc unlocked
-a App Log for the uicc unlocking state (a phone that is eligible for unlocking by sprint and activate the application log to monitor the unlocking process)
Any help would benefit the entire comunity.