[Verizon Samsung Galaxy S III] autoprime:
Unfortunately I am not sure where these passwords originate. They seem to get passed around through cdma flashing/unlock forums. I have never found the password inside the device itself(not to say its not in there).

Couldn't you just backup the individual NV items within QPST EFS Explorer itself? I've manually copied all NV items this way. I would just have to manually write each NV item back to fix.

I would like to mention some interesting info we've found when messing with the vzw/spr cdma galaxy nexus. yes diff device, but still...

The Verizon Galaxy Nexus was very locked down... and stuck in RUIM Preferred mode(ignoring the NV). This is ok for Verizon users but NOT anyone that wants to use the device on any other carrier(unable to program NV). SO what someone figured out was that we could cross-flash modems through recovery.. only editing the update script.. to trick the phone thinking it was flashing something else. In our exact Galaxy Nexus example.. we changed the sprint modem script to NOT say "toroplus" but instead "toro" which then worked. No more flashing errors! And it got around any "checks" the phone was attempting(the checks were found to only be present in Odin). Again.. this may not apply to the GS3.. but just putting it out there. Knowing the above info is what lead me to flash the ATT Gs3 modem file without fear.

I may be missing something here but... why exactly are we looking for the partitions these NV items are hiding in, rather than just editing them 1 by 1 in QPST EFS Explorer? If we need to have the latest QPST and send SPC/16-digit password etc just to see these NV items... isn't it possible that these values are "protected" ? These same values in a GSM device are NOT protected in the same way. Example... to my knowledge, GSM users are able to repair their IMEI from the device itself. The NV item for them is found in the /EFS directory, unhidden. Compare that to our CDMA device.. where we need a windows machine, internal Qualcomm software and secure passwords to see the same file. CDMA has more to hide since we haven't always used sim cards. All the valuable info for GSM devices is contained in the SIM... for CDMA users, its all contained in the EFS. See the difference? Which makes me think that backing up partitions will never work.

If we can get someone from ATT to dump their entire NV(minus nv item 550) that would be great. Then we can read each WCDMA-related NV item and compare to each NV item the VZW GS3 has. If the NV item on VZW GS3 is different, we manually edit that NV item. If the NV item from ATT is non-existant on VZW model then we create the NV item and add it to the VZW phone manually. Etc etc. This would ensure all WCDMA related nv items are set 100% correctly for domestic HSPA+. If HSPA+ is still blocked after all of this, then I would imagine it is the modem doing the blocking(regardless of what the NV item in EFS says) and a new modem would be needed. Either a modem from another carrier.. or a manually edited modem(tho im not sure if the manually edited modem would ever work).

Just my idea tho.. dont be discouraged or give up what you were trying before. I'm just trying to look at it differently.

I saw you mention 111111111111111 previously, does this mean you rewrote you IMEI as all 1's to find easier? If not, i was going to mention.. make sure you look for your imei/meid in the correct order. if meid is 12345678901122 then you would search for it in hex as 22 11 90 78 56 34 12 etc etc. I'm sure that's a big "duhhh" but I wanted to make sure nothing was overlooked.