[T-Mobile LG G3] motoridersd:
I noticed the upsell.apk. It's probably being run when you get the message "Verifying your account" or whatever it says.

I would love to find where the APN is stored. I know there's /system/etc/apns-conf.xml and it contains a bunch of APNs for the different TMo MCC/MNC combinations:

<?xml version="1.0" encoding="utf-8"?>
<!--
/*
** Copyright 2006, The Android Open Source Project
**
** Licensed under the Apache License, Version 2.0 (the "License");
** you may not use this file except in compliance with the License.
** You may obtain a copy of the License at
**
** http://www.apache.org/licenses/LICENSE-2.0
**
** Unless required by applicable law or agreed to in writing, software
** distributed under the License is distributed on an "AS IS" BASIS,
** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
** See the License for the specific language governing permissions and
** limitations under the License.
*/
-->

<!-- use empty string to specify no proxy or port -->

<!-- If you edit this version, also edit the version in the partner-supplied
apns-conf.xml configuration file -->
<apns version="8">

<apn carrier="LTE Attach APN (00101)"
mcc="001"
mnc="01"
apn=""
type="ia"
protocol="IPV6"
defaultflag="0"
/>

<apn carrier="LTE Attach APN (00102)"
mcc="001"
mnc="02"
apn=""
type="ia"
protocol="IPV6"
defaultflag="0"
/>

<apn carrier="T-Mobile LTE"
mcc="310"
mnc="160"
apn="fast.t-mobile.com"
mmsc="http://mms.msg.eng.t-mobile.com/mms/wapenc"
type="default,supl,mms"
protocol="IPV6"
/>

<apn carrier="T-Mobile LTE Attach APN"
mcc="310"
mnc="160"
apn=""
type="ia"
protocol="IPV6"
defaultflag="2"
/>

<apn carrier="MetroPCS"
mcc="310"
mnc="160"
apn="fast.metropcs.com"
mmsc="http://metropcs.mmsmvno.com/mms/wapenc"
type="default,supl,mms,hipri"
mvno_match_data="6D"
mvno_type="gid"
/>

<apn carrier="T-Mobile LTE"
mcc="310"
mnc="200"
apn="fast.t-mobile.com"
mmsc="http://mms.msg.eng.t-mobile.com/mms/wapenc"
type="default,supl,mms"
protocol="IPV6"
/>

<apn carrier="T-Mobile LTE Attach APN"
mcc="310"
mnc="200"
apn=""
type="ia"
protocol="IPV6"
defaultflag="2"
/>

<apn carrier="MetroPCS"
mcc="310"
mnc="200"
apn="fast.metropcs.com"
mmsc="http://metropcs.mmsmvno.com/mms/wapenc"
type="default,supl,mms,hipri"
mvno_match_data="6D"
mvno_type="gid"
/>

<apn carrier="T-Mobile LTE"
mcc="310"
mnc="210"
apn="fast.t-mobile.com"
mmsc="http://mms.msg.eng.t-mobile.com/mms/wapenc"
type="default,supl,mms"
protocol="IPV6"
/>

<apn carrier="T-Mobile LTE Attach APN"
mcc="310"
mnc="210"
apn=""
type="ia"
protocol="IPV6"
defaultflag="2"
/>

<apn carrier="MetroPCS"
mcc="310"
mnc="210"
apn="fast.metropcs.com"
mmsc="http://metropcs.mmsmvno.com/mms/wapenc"
type="default,supl,mms,hipri"
mvno_match_data="6D"
mvno_type="gid"
/>

<apn carrier="T-Mobile LTE"
mcc="310"
mnc="220"
apn="fast.t-mobile.com"
mmsc="http://mms.msg.eng.t-mobile.com/mms/wapenc"
type="default,supl,mms"
protocol="IPV6"
/>

<apn carrier="T-Mobile LTE Attach APN"
mcc="310"
mnc="220"
apn=""
type="ia"
protocol="IPV6"
defaultflag="2"
/>

<apn carrier="MetroPCS"
mcc="310"
mnc="220"
apn="fast.metropcs.com"
mmsc="http://metropcs.mmsmvno.com/mms/wapenc"
type="default,supl,mms,hipri"
mvno_match_data="6D"
mvno_type="gid"
/>

<apn carrier="T-Mobile LTE"
mcc="310"
mnc="230"
apn="fast.t-mobile.com"
mmsc="http://mms.msg.eng.t-mobile.com/mms/wapenc"
type="default,supl,mms"
protocol="IPV6"
/>

<apn carrier="T-Mobile LTE Attach APN"
mcc="310"
mnc="230"
apn=""
type="ia"
protocol="IPV6"
defaultflag="2"
/>

<apn carrier="MetroPCS"
mcc="310"
mnc="230"
apn="fast.metropcs.com"
mmsc="http://metropcs.mmsmvno.com/mms/wapenc"
type="default,supl,mms,hipri"
mvno_match_data="6D"
mvno_type="gid"
/>

<apn carrier="T-Mobile LTE"
mcc="310"
mnc="240"
apn="fast.t-mobile.com"
mmsc="http://mms.msg.eng.t-mobile.com/mms/wapenc"
type="default,supl,mms"
protocol="IPV6"
/>

<apn carrier="T-Mobile LTE Attach APN"
mcc="310"
mnc="240"
apn=""
type="ia"
protocol="IPV6"
defaultflag="2"
/>

<apn carrier="MetroPCS"
mcc="310"
mnc="240"
apn="fast.metropcs.com"
mmsc="http://metropcs.mmsmvno.com/mms/wapenc"
type="default,supl,mms,hipri"
mvno_match_data="6D"
mvno_type="gid"
/>

<apn carrier="T-Mobile LTE"
mcc="310"
mnc="250"
apn="fast.t-mobile.com"
mmsc="http://mms.msg.eng.t-mobile.com/mms/wapenc"
type="default,supl,mms"
protocol="IPV6"
/>

<apn carrier="T-Mobile LTE Attach APN"
mcc="310"
mnc="250"
apn=""
type="ia"
protocol="IPV6"
defaultflag="2"
/>

<apn carrier="MetroPCS"
mcc="310"
mnc="250"
apn="fast.metropcs.com"
mmsc="http://metropcs.mmsmvno.com/mms/wapenc"
type="default,supl,mms,hipri"
mvno_match_data="6D"
mvno_type="gid"
/>

<apn carrier="T-Mobile LTE"
mcc="310"
mnc="260"
apn="fast.t-mobile.com"
mmsc="http://mms.msg.eng.t-mobile.com/mms/wapenc"
type="default,supl,mms"
protocol="IPV4"
/>

<apn carrier="T-Mobile LTE Attach APN"
mcc="310"
mnc="260"
apn=""
type="ia"
protocol="IPV6"
defaultflag="2"
/>

<apn carrier="MetroPCS"
mcc="310"
mnc="260"
apn="fast.metropcs.com"
mmsc="http://metropcs.mmsmvno.com/mms/wapenc"
type="default,supl,mms,hipri"
mvno_match_data="6D"
mvno_type="gid"
/>

<apn carrier="T-Mobile LTE"
mcc="310"
mnc="270"
apn="fast.t-mobile.com"
mmsc="http://mms.msg.eng.t-mobile.com/mms/wapenc"
type="default,supl,mms"
protocol="IPV6"
/>

<apn carrier="T-Mobile LTE Attach APN"
mcc="310"
mnc="270"
apn=""
type="ia"
protocol="IPV6"
defaultflag="2"
/>

<apn carrier="MetroPCS"
mcc="310"
mnc="270"
apn="fast.metropcs.com"
mmsc="http://metropcs.mmsmvno.com/mms/wapenc"
type="default,supl,mms,hipri"
mvno_match_data="6D"
mvno_type="gid"
/>

<apn carrier="T-Mobile LTE"
mcc="310"
mnc="300"
apn="fast.t-mobile.com"
mmsc="http://mms.msg.eng.t-mobile.com/mms/wapenc"
type="default,supl,mms"
protocol="IPV6"
/>

<apn carrier="T-Mobile LTE Attach APN"
mcc="310"
mnc="300"
apn=""
type="ia"
protocol="IPV6"
defaultflag="2"
/>

<apn carrier="MetroPCS"
mcc="310"
mnc="300"
apn="fast.metropcs.com"
mmsc="http://metropcs.mmsmvno.com/mms/wapenc"
type="default,supl,mms,hipri"
mvno_match_data="6D"
mvno_type="gid"
/>

<apn carrier="T-Mobile LTE"
mcc="310"
mnc="310"
apn="fast.t-mobile.com"
mmsc="http://mms.msg.eng.t-mobile.com/mms/wapenc"
type="default,supl,mms"
protocol="IPV6"
/>

<apn carrier="T-Mobile LTE Attach APN"
mcc="310"
mnc="310"
apn=""
type="ia"
protocol="IPV6"
defaultflag="2"
/>

<apn carrier="MetroPCS"
mcc="310"
mnc="310"
apn="fast.metropcs.com"
mmsc="http://metropcs.mmsmvno.com/mms/wapenc"
type="default,supl,mms,hipri"
mvno_match_data="6D"
mvno_type="gid"
/>

<apn carrier="T-Mobile LTE"
mcc="310"
mnc="490"
apn="fast.t-mobile.com"
mmsc="http://mms.msg.eng.t-mobile.com/mms/wapenc"
type="default,supl,mms"
protocol="IPV6"
/>

<apn carrier="T-Mobile LTE Attach APN"
mcc="310"
mnc="490"
apn=""
type="ia"
protocol="IPV6"
defaultflag="2"
/>

<apn carrier="MetroPCS"
mcc="310"
mnc="490"
apn="fast.metropcs.com"
mmsc="http://metropcs.mmsmvno.com/mms/wapenc"
type="default,supl,mms,hipri"
mvno_match_data="6D"
mvno_type="gid"
/>

<apn carrier="T-Mobile LTE"
mcc="310"
mnc="530"
apn="fast.t-mobile.com"
mmsc="http://mms.msg.eng.t-mobile.com/mms/wapenc"
type="default,supl,mms"
protocol="IPV6"
/>

<apn carrier="T-Mobile LTE Attach APN"
mcc="310"
mnc="530"
apn=""
type="ia"
protocol="IPV6"
defaultflag="2"
/>

<apn carrier="MetroPCS"
mcc="310"
mnc="530"
apn="fast.metropcs.com"
mmsc="http://metropcs.mmsmvno.com/mms/wapenc"
type="default,supl,mms,hipri"
mvno_match_data="6D"
mvno_type="gid"
/>

<apn carrier="T-Mobile LTE"
mcc="310"
mnc="580"
apn="fast.t-mobile.com"
mmsc="http://mms.msg.eng.t-mobile.com/mms/wapenc"
type="default,supl,mms"
protocol="IPV6"
/>

<apn carrier="T-Mobile LTE Attach APN"
mcc="310"
mnc="580"
apn=""
type="ia"
protocol="IPV6"
defaultflag="2"
/>

<apn carrier="MetroPCS"
mcc="310"
mnc="580"
apn="fast.metropcs.com"
mmsc="http://metropcs.mmsmvno.com/mms/wapenc"
type="default,supl,mms,hipri"
mvno_match_data="6D"
mvno_type="gid"
/>

<apn carrier="T-Mobile LTE"
mcc="310"
mnc="590"
apn="fast.t-mobile.com"
mmsc="http://mms.msg.eng.t-mobile.com/mms/wapenc"
type="default,supl,mms"
protocol="IPV6"
/>

<apn carrier="T-Mobile LTE Attach APN"
mcc="310"
mnc="590"
apn=""
type="ia"
protocol="IPV6"
defaultflag="2"
/>

<apn carrier="MetroPCS"
mcc="310"
mnc="590"
apn="fast.metropcs.com"
mmsc="http://metropcs.mmsmvno.com/mms/wapenc"
type="default,supl,mms,hipri"
mvno_match_data="6D"
mvno_type="gid"
/>

<apn carrier="T-Mobile LTE"
mcc="310"
mnc="640"
apn="fast.t-mobile.com"
mmsc="http://mms.msg.eng.t-mobile.com/mms/wapenc"
type="default,supl,mms"
protocol="IPV6"
/>

<apn carrier="T-Mobile LTE Attach APN"
mcc="310"
mnc="640"
apn=""
type="ia"
protocol="IPV6"
defaultflag="2"
/>

<apn carrier="MetroPCS"
mcc="310"
mnc="640"
apn="fast.metropcs.com"
mmsc="http://metropcs.mmsmvno.com/mms/wapenc"
type="default,supl,mms,hipri"
mvno_match_data="6D"
mvno_type="gid"
/>

<apn carrier="T-Mobile LTE"
mcc="310"
mnc="660"
apn="fast.t-mobile.com"
mmsc="http://mms.msg.eng.t-mobile.com/mms/wapenc"
type="default,supl,mms"
protocol="IPV6"
/>

<apn carrier="T-Mobile LTE Attach APN"
mcc="310"
mnc="660"
apn=""
type="ia"
protocol="IPV6"
defaultflag="2"
/>

<apn carrier="MetroPCS"
mcc="310"
mnc="660"
apn="fast.metropcs.com"
mmsc="http://metropcs.mmsmvno.com/mms/wapenc"
type="default,supl,mms,hipri"
mvno_match_data="6D"
mvno_type="gid"
/>

<apn carrier="T-Mobile LTE"
mcc="310"
mnc="800"
apn="fast.t-mobile.com"
mmsc="http://mms.msg.eng.t-mobile.com/mms/wapenc"
type="default,supl,mms"
protocol="IPV6"
/>

<apn carrier="T-Mobile LTE Attach APN"
mcc="310"
mnc="800"
apn=""
type="ia"
protocol="IPV6"
defaultflag="2"
/>

<apn carrier="MetroPCS"
mcc="310"
mnc="800"
apn="fast.metropcs.com"
mmsc="http://metropcs.mmsmvno.com/mms/wapenc"
type="default,supl,mms,hipri"
mvno_match_data="6D"
mvno_type="gid"
/>
<apn carrier="T-Mobile Emergency"
mcc="310"
mnc="260"
apn="sos"
authtype="0"
type="emergency"
protocol="IPV6"
defaultflag="2"
/>

<apn carrier="LGE LTE Attach APN"
mcc="450"
mnc="00"
apn=""
type="ia"
defaultflag="2"
/>

<apn carrier="LGE DEFAULT"
mcc="450"
mnc="00"
apn="lte"
user="lge"
password="lge"
authtype="1"
mmsc="http://203.229.247.19/mm1"
mmsproxy="203.229.247.28"
mmsport="8000"
type="default,supl,mms,dun"
defaultflag="0"
/>

<apn carrier="LGE IPv6"
mcc="450"
mnc="00"
apn="lte6"
type="default"
protocol="IPV6"
defaultflag="0"
/>

<apn carrier="LGE IPv6 2G/3G Only"
mcc="450"
mnc="00"
apn="iv6"
type="default"
protocol="IPV6"
defaultflag="0"
/>

</apns>

When the phone boots up, it verifies the checksum of this file but it seems to leave it alone. I edited it for my MNC (260) so you'll see that mine above is set to IPV4, but when you pull up the settings on the phone, it still shows IPV6. I don't know what "T-Mobile LTE Attach APN" is, and it has an APN type of ia but no APN.

After typing all that, I decided to do a deeper search and finally found the pcweb APN. It's in the framework-res.apk

<string-array name="config_tether_apnlst">
<item>310260:T-Mobile Tethering,pcweb.tmobile.com,,,,,,,,,310,260,,dun</item>
<item>310160:T-Mobile Tethering,pcweb.tmobile.com,,,,,,,,,310,160,,dun</item>
<item>310200:T-Mobile Tethering,pcweb.tmobile.com,,,,,,,,,310,200,,dun</item>
<item>310210:T-Mobile Tethering,pcweb.tmobile.com,,,,,,,,,310,210,,dun</item>
<item>310220:T-Mobile Tethering,pcweb.tmobile.com,,,,,,,,,310,220,,dun</item>
<item>310230:T-Mobile Tethering,pcweb.tmobile.com,,,,,,,,,310,230,,dun</item>
<item>310240:T-Mobile Tethering,pcweb.tmobile.com,,,,,,,,,310,240,,dun</item>
<item>310250:T-Mobile Tethering,pcweb.tmobile.com,,,,,,,,,310,250,,dun</item>
<item>310270:T-Mobile Tethering,pcweb.tmobile.com,,,,,,,,,310,270,,dun</item>
<item>310300:T-Mobile Tethering,pcweb.tmobile.com,,,,,,,,,310,300,,dun</item>
<item>310310:T-Mobile Tethering,pcweb.tmobile.com,,,,,,,,,310,310,,dun</item>
<item>310490:T-Mobile Tethering,pcweb.tmobile.com,,,,,,,,,310,490,,dun</item>
<item>310530:T-Mobile Tethering,pcweb.tmobile.com,,,,,,,,,310,530,,dun</item>
<item>310580:T-Mobile Tethering,pcweb.tmobile.com,,,,,,,,,310,580,,dun</item>
<item>310590:T-Mobile Tethering,pcweb.tmobile.com,,,,,,,,,310,590,,dun</item>
<item>310640:T-Mobile Tethering,pcweb.tmobile.com,,,,,,,,,310,640,,dun</item>
<item>310660:T-Mobile Tethering,pcweb.tmobile.com,,,,,,,,,310,660,,dun</item>
<item>310800:T-Mobile Tethering,pcweb.tmobile.com,,,,,,,,,310,800,,dun</item>
<item>310260gid6D:MetroPCS Tethering,pcweb.metropcs.com,,,,,,,,,310,260,,dun</item>
<item>310160gid6D:MetroPCS Tethering,pcweb.metropcs.com,,,,,,,,,310,160,,dun</item>
<item>310200gid6D:MetroPCS Tethering,pcweb.metropcs.com,,,,,,,,,310,200,,dun</item>
<item>310210gid6D:MetroPCS Tethering,pcweb.metropcs.com,,,,,,,,,310,210,,dun</item>
<item>310220gid6D:MetroPCS Tethering,pcweb.metropcs.com,,,,,,,,,310,220,,dun</item>
<item>310230gid6D:MetroPCS Tethering,pcweb.metropcs.com,,,,,,,,,310,230,,dun</item>
<item>310240gid6D:MetroPCS Tethering,pcweb.metropcs.com,,,,,,,,,310,240,,dun</item>
<item>310250gid6D:MetroPCS Tethering,pcweb.metropcs.com,,,,,,,,,310,250,,dun</item>
<item>310270gid6D:MetroPCS Tethering,pcweb.metropcs.com,,,,,,,,,310,270,,dun</item>
<item>310300gid6D:MetroPCS Tethering,pcweb.metropcs.com,,,,,,,,,310,300,,dun</item>
<item>310310gid6D:MetroPCS Tethering,pcweb.metropcs.com,,,,,,,,,310,310,,dun</item>
<item>310490gid6D:MetroPCS Tethering,pcweb.metropcs.com,,,,,,,,,310,490,,dun</item>
<item>310530gid6D:MetroPCS Tethering,pcweb.metropcs.com,,,,,,,,,310,530,,dun</item>
<item>310580gid6D:MetroPCS Tethering,pcweb.metropcs.com,,,,,,,,,310,580,,dun</item>
<item>310590gid6D:MetroPCS Tethering,pcweb.metropcs.com,,,,,,,,,310,590,,dun</item>
<item>310640gid6D:MetroPCS Tethering,pcweb.metropcs.com,,,,,,,,,310,640,,dun</item>
<item>310660gid6D:MetroPCS Tethering,pcweb.metropcs.com,,,,,,,,,310,660,,dun</item>
<item>310800gid6D:MetroPCS Tethering,pcweb.metropcs.com,,,,,,,,,310,800,,dun</item>
</string-array>

I would think a fix is as easy as replacing the pcweb with fast. I did that and I'm working on getting the modified framework-res.apk to boot properly. I'll report back.

Update: Was able to edit the framework-res.apk file and changed all pcweb to fast. Unfortunately, tethering doesn't work. There are no errors on the phone, but there is no IP forwarding being done.

When tethering with the original framework-res (using pcweb), these come up:

D/Tethering( 1000): chooseUpstreamType(true), preferredApn =4, got type=4

I/Tethering( 1000): Skip IPv6 Connectivity Check because IPv6 Tetheirng is supported.

D/CommandListener( 315): TetherCmd::runCommand. argc: 5. argv[0]: tether

D/TetherController( 315): setDnsForwarders(0 = '10.177.0.34')

D/TetherController( 315): setDnsForwarders(1 = '10.180.12.172')

D/TetherController( 315): Sending update msg to dnsmasq [update_dns;10.177.0.34;10.180.12.172]

D/Tethering( 1000): notifying tethered with iface =rmnet1

D/Tethering( 1000): TetheredState.processMessage what=12

D/WifiStateMachine( 1000): processMsg: TetheredState

When using fast, these show up instead:

D/Tethering( 998): chooseUpstreamType(true), preferredApn =4, got type=-1

D/Tethering( 998): notifying tethered with iface =null

D/Tethering( 998): TetheredState.processMessage what=12

D/Tethering( 998): TetheredState.processMessage what=12

and repeat over and over. There is another check being done before tethering will be completed.