[Xiaomi Mi Max 2  Guides, News, & Discussion] ZHNN:
Hi there! Thanks for the excellent thread and collection of links. I started here and found a setting on this phone's NVRAM that I have not seen mentioned anywhere else, and you will need it for LTE unlocking.

Below are the exact steps, many taken from this guide, that I used to go from a phone with an unlocked bootloader to flipping the LTE B2 and LTE B4 bits on. After I did it and rebooted, I suddenly had a working LTE connection!

I cannot yet PROVE that this actually enabled the bands, but it hasn't hurt anything. I will test for that in a couple days, because the only dumb thing I did was afterwards, when I accidentally re-locked the bootloader by not paying attention to what I was doing. If you use the MiFlash program to install a ROM, don't forget to change the setting in the lower right corner!

Notes for those wishing to use this as a guide:

I don't think you can brick the phone completely playing with just these settings, but you should be prepared to restore everything. Take backups where I mention them, and if you need the device working, you should have a current MIUI fastboot flashable image, available from the official website, on hand.

This is LTE only and there are different settings for GSM that work the same way.

The steps are numbered, but you should also understand mostly what they do.

You may ignore the VM part and just boot your normal Win7 with driver signature checking DISABLED (F8 on boot). I use Linux and I'm security-conscious about downloading programs that I can't verify, so I'm using a VM.

There is a dialpad option for opening the diag port (if you have root), but it did not work for me, so I have provided a method that I know works and it clears itself upon reboot

QXDM's NV browser has a checkbox for "DUAL SIM". You don't need to check it for this process, you won't lose SIM2.

Downloads section:

(REQUIRED) Most are in the links provided by OP:

MiFlash (official one)

QPST 2.7.460

QXDM 3.12.714

Minimal adb and fastboot

no-verity-opt-encrypt-6.0.zip

twrp-3.2.1-0-oxygen.zip

SuperSU-v2.82-201705271822.zip

(OPTIONAL, needed if you mess up. I chose to have it ready to go.):

From MIUI official site, go to the ROMs for the Max 2. The one on the download button here is NOT what you want.

Select Flashing guide, then on on the left hand side select FastBoot.

Download the image for your device. I have a copy of oxygen_global_images_V9.0.3.0.NDDMIEI_20171209.0000.00_7.1_global_298fd5f49c.tgz

SETUP SECTION (install tools and root phone):

Enable developer mode and USB debugging on phone

Boot into a Windows VM, pressing F8 to go into unsigned drivers mode

Install MiFlash, just to get the drivers

Install QPST and QXDM for later

Install adb and fastboot

Pass USB port through to VM and check adb is working by twice typing

adb devices

Shutdown phone and remove SD card from phone.

Add no-verity-opt-encrypt-6.0.zip and SuperSU-v2.82-201705271822.zip to SD card

Put SD card back in phone

Reboot phone into fastboot mode using PWR & VOL-, and re-pass to VM if needed

From cmd terminal in adb folder,

fastboot flash recovery twrp-3.2.1-0-oxygen.img

fastboot boot twrp-3.2.1-0-oxygen.img

Once TWRP comes up, install no-verity-opt-encrypt-6.0.zip

(OPTIONAL) Make a backup. I didn't because I don't want the ROM that's on there anyway.

Reboot and ensure MIUI loads

Shutdown phone and reboot into TWRP using PWR & VOL+

Install SuperSU as a system app

Reboot into MIUI

Access and edit the NVRAM:

Connect the device back to the computer, pass to VM if necessary

From your terminal in the adb folder,

adb devices

Grant debug permission on the device, if it asks again

adb shell

$su

Grant permission in superSU popup

#setprop sys.usb.config diag,adb

When the device reconnects, re-pass to VM if needed, and it may install another driver

Open QPST Configuration and make sure the device's port is enabled.

At the top, go to "start clients" and open "software download"

In the "Backup" tab, choose a location to save your file and hit Start, just in case you do break something

Once finished, close "software download" but leave QPST Configuration running

Open QXDM Professional

Under Options->Communications, make sure your phone is set "active" then set "target port" to the port it's on, then press OK

Go to NV Browser in the dropdown on the upper left.

Scroll down to 06828 :"nv_lte_bc_config_type.lte_bc_config"

Press READ and save this value somewhere in case you forget which bits you set! Mine was: 2061584302293

It's little-endian, and I wanted to flip bits from 0 to 1 to enable bands {2} and {4}, so I added 2^({2}-1)+2^({4}-1) = 10 to get a value of 2061584302303

Enter your new value in the "value" field and press "write"

Now, scroll down to the corresponding LTE prefs value at 65633

Read again. This should be the same number you had before, in hexadecimal format. Mine was 0x1E0000000D5, so to add B2 and B4 (Combined value 0xA), I changed it to 0x1E0000000DF

Again, enter your new value in the "value" field and press "write"

I doubt this requires any sort of "safe shutdown," but I hit "offline" then closed QXDM, then closed QPST, then rebooted the phone.

For a quick test, you can set network preferences to "LTE ONLY" by going to the dialpad and hitting *#*#INFO#*#*, then selecting your SIM card and using the dropdown in there. Mine was preferring HSPAP because the signal was stronger, even though the data was blocked.

Further testing I want to do when I get the bootloader unlocked again:

Use an app that shows what bands are in use to prove I'm on B2 or B4

Try disabling bands I will never use that have similar frequencies to the bands I want to see if signal improves