[Huawei Mate 9 Questions & Answers] cr2:
This is an unexpected result. An empirical rules says that the geodetic height uncertainty is twice the horizontal accuracy.

---------- Post added at 11:18 PM ---------- Previous post was at 10:43 PM ----------

I have found a way to kill arbitrary satellites through handcrafted RTI (realtime integrity) status files which are usually pulled from gllto.glpals.com (and scrambled using XXTEA https://en.wikipedia.org/wiki/XXTEA), but they can be replaced by your own copy (btw, wtf is BadQZSS=224?):

rtistatus.dat

Version=1
Timestamp=2018:01:09:03:30:00.000
BadGpsPRNs=4
BadQzssPRNs=224
BadGlonassOSNs=14
BadSbasPRNs=151

rtistatus2.dat

Version=2
Timestamp=2018:01:09:03:30:00
BadGpsPRNs=4
BadQzssPRNs=
BadGlonassOSNs=14
BadBeidouPRNs=1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37

rtistatus3.dat

Version=2
Timestamp=2018:01:09:15:10:00
BadGpsPRNs=4
BadQzssPRNs=
BadGlonassOSNs=14
BadBeidouPRNs=12

rtistatus4.dat

Version=4
Timestamp=2018:01:09:15:10:00
BadGpsPRNs=4
BadQzssPRNs=
BadGlonassOSNs=14
BadBeidouPRNs=12
BadGalileoPRNs=14,18,20

Pushing the handcrafted GAL almanac in gldata.sto was less successful.

The "new" entries are happily accepted by the NVRAM parser:

GlPeAlmMgr::Deserialize:Read Alm:GAL 01 Source:NVMEM OrgSrc:SV
GlPeAlmMgr::Deserialize:Read Alm:GAL 02 Source:NVMEM OrgSrc:SV
GlPeAlmMgr::Deserialize:Read Alm:GAL 03 Source:NVMEM OrgSrc:SV
GlPeAlmMgr::Deserialize:Read Alm:GAL 04 Source:NVMEM OrgSrc:SV
GlPeAlmMgr::Deserialize:Read Alm:GAL 05 Source:NVMEM OrgSrc:SV
GlPeAlmMgr::Deserialize:Read Alm:GAL 07 Source:NVMEM OrgSrc:SV
GlPeAlmMgr::Deserialize:Read Alm:GAL 08 Source:NVMEM OrgSrc:SV
GlPeAlmMgr::Deserialize:Read Alm:GAL 09 Source:NVMEM OrgSrc:SV
GlPeAlmMgr::Deserialize:Read Alm:GAL 12 Source:NVMEM OrgSrc:SV
GlPeAlmMgr::Deserialize:Read Alm:GAL 19 Source:NVMEM OrgSrc:SV
GlPeAlmMgr::Deserialize:Read Alm:GAL 24 Source:NVMEM OrgSrc:SV
GlPeAlmMgr::Deserialize:Read Alm:GAL 26 Source:NVMEM OrgSrc:SV
GlPeAlmMgr::Deserialize:Read Alm:GAL 30 Source:NVMEM OrgSrc:SV
GlPeAlmMgr::Deserialize:Read Alm:GAL 14 Source:NVMEM OrgSrc:SV
GlPeAlmMgr::Deserialize:Read Alm:GAL 18 Source:NVMEM OrgSrc:SV
GlPeAlmMgr::Deserialize:Read Alm:GAL 21 Source:NVMEM OrgSrc:SV
GlPeAlmMgr::Deserialize:Read Alm:GAL 25 Source:NVMEM OrgSrc:SV
GlPeAlmMgr::Deserialize:Read Alm:GAL 27 Source:NVMEM OrgSrc:SV
GlPeAlmMgr::Deserialize:Read Alm:GAL 31 Source:NVMEM OrgSrc:SV

but the changes are rejected by the NVRAM integrity check, which forces the cold restart ;)

NVMEM UnitId Check: Mismatch detected! NVRAM:d8 Expected:2c
Closed NVRAM file
NVMEM integrity error detected
GlPeTimeManager::Reset: Resetting Time Manager. Reason:NVMEM Checksum failure

GLL_Startup Type: Cold,Tim[F],Osc[F],Pos[T],Eph[F],Cbee[F],Lto[F],AEph[F]

GlPeTimeManager::saveNvRamAndRtc(123): Invalidate:T UnitId:0 NvRamData[0]:00000000 NvRamData[1]:00000000
GlDineCtrl::SaveNvRamAndRtc(123, 0, 0 , Invalidate NvRam!)

The NVRAM checksum / UnitId algorithm is not known ...

I am thinking about modifying the hardcoded almanac in the .rodata section,

but since there are only 12 slots for Galileo, i will reuse the 24 GLNS slots for GAL, and leave 12 GAL slots for the first 12 GLNS sats.

Such change needs a fixup in the .got section and maybe even more effort.

I will keep you informed, this looks like a really cool satnav project.