[E 2015 General] spiked_mistborn:
After some trial and error I was able to successfully enable LTE band 12 on my xt1527 with the 5.1 baseband. This procedure only seems to work with the stock ROM, but then after it's done you might need to install a custom ROM like Cyanogenmod to actually make use of all the bands. Many people have done a lot of previous work to make this possible and they deserve credit, so don't forget to hit thanks on the linked threads. It might be possible to unlock different bands on the different models depending on what the radio will support. I have done my best to try to make sure that this is thorough, but there could be errors, so please let me know if any of the steps need to be revised or corrected.

**** Please note that by doing this it may be possible to permanently damage your phone, make it unable to access mobile networks, or cause radio interference, so you are doing this at your own risk! I am not responsible for any problems! ***

1. Be on a stock ROM (only tested on 5.0.2 and 5.1, see forums for how to restore stock ROM if you need help) Update: also works on 6.0

2. Make sure the Motorola Device Manager is installed https://motorola-global-portal.custhelp.com/app/answers/detail/a_id/88481

3. Select "BP Tools" from the bootloader menu (power off, hold vol-down, power on). The phone will look like it's booting normally.

4. You need to enable usb debugging in developer options. In Windows device manager you should see 3 USB devices without drivers loaded. I picked the first device and updated the driver by selecting Browse computer / Let me pick, and selecting Ports (Com&LPT), Motorola, Motorola QC Diag port. See this post for more info http://xdaforums.com/showpost.php?p=54338876&postcount=3 You should now see Motorola QC Diag Port (COMx)

5. Install QPST and QXDM from steps 4 and 5 in this thread http://xdaforums.com/galaxy-s5/general/how-to-add-rf-lte-frequency-bands-to-t2886059

6. In QXDM select Communications and you should see the COMx that you saw in Device Manager. Make sure the Target Port has this COM port selected as well. If it's not connecting double check that the driver is still loaded in Device Manager.

7. In the View box select NV Browser towards the top of the list, and in the window that opens choose LTE for Category filter.

8. The value that we want is in location 6828. Click on it and choose Read. Write this number down in case you have a problem! Convert this number to binary (I use Windows calculator) and these are your current LTE bands. Read from right to left and 0 means the band is disabled, 1 is enabled.

For example, the xt1527 has LTE bands 2,4,5,7, and 17 per the Motorola website.

The value in location 6828 is 65626, or 0001 0000 0000 0101 1010‬ in binary.

Binary Value 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 1 1 0 1 0
Active Bands[B] - - - 17 - - - - - - - - - 7 - 5 4 - 2 -[/B]
All Bands 20 ? ? 17 ? ? ? ? 12 ? ? ? ? 7 6 5 4 3 2 1

As you can see from this example, each bit corresponds to an LTE band being on or off. Different models (xt1521, xt1528, etc.) will obviously have different bands enabled. To help fill in the missing info on the bands please post a reply with your model, the value of 6828, and the bands that your phone supports according to Motorola.

To enable band 12, I changed the bit in that position to a 1 and converted the entire binary number back to decimal.

Binary Value 0 0 0 1 0 0 0 0 1 0 0 0 0 1 0 1 1 0 1 0
Active Bands[B] - - - 17 - - - - 12 - - - - 7 - 5 4 - 2 -[/B]
All Bands 20 ? ? 17 ? ? ? ? 12 ? ? ? ? 7 6 5 4 3 2 1

So this new binary number 0001 0000 1000 0101 1010 = 67674 in decimal.

9. After you have calculated your new value, type it into the 6828 input field and click Write.

10. Reboot to recovery, make a backup of the stock ROM, and then install your favorite custom ROM, such as Cyanogenmod. The stock ROM might still restrict bands even if they have been enabled in the baseband. You can use the LTEdiscovery app to check your bands, and there are probably other apps as well.

11. If you have any problems try writing the original value that you wrote down earlier back into location 6828 (you did write it down, right?). If that doesn't work, see the modem thread, or extract NON-HLOS.bin and fsg.mbn from your stock image and flash them using the following commands in fastboot.

fastboot flash modem NON-HLOS.bin
fastboot erase modemst1
fastboot erase modemst2
fastboot flash fsg fsg.mbn

Good luck, and don't forget that with the extended range LTE bands you might have data but not be able to make a voice call. You would have to go into Network settings and change the preferred network type to 3G to make an emergency call. Maybe a future project will be looking into putting the baseband from other SD410 devices that support VoLTE on surnia and then using this method to set the correct bands... Something to think about.

Update 17 Oct, 2016: Unknown bands have been replaced with question marks. Driver and utility installation instructions have been updated.