[Xiaomi Mi Max 2  Questions & Answers] ZHNN:
Update: Changing the settings is easy, and it LOOKS LIKE it worked because I had 4G where there was none before, and it has gone away after I reflashed.

Unfortunately, I realized I was running a "vendor ROM" and went to flash the official MIUI ROM with MiFlash. When I did that, I forgot to uncheck, in the lower right, "flash and lock." Now I have to wait for unlock code to do it again and verify.

Steps I took on an already-unlocked Max 2 are below. Note that this is LTE only and there are different settings for GSM that work the same way.

(You may ignore the VM part and just boot your normal Win7 with driver signature checking DISABLED. I need multiple versions of QFIL installed and don't run Windows normally):

Setup (install tools and root phone):

Enable developer mode and USB debugging on phone

Boot into a Windows VM, pressing F8 to go into unsigned drivers mode

Install MiFlash, just to get the drivers

Install QPST and QXDM for later

Install adb and fastboot

Pass USB port through to VM and check adb is working

Remove SD card from phone.

Add no-verity-opt-encrypt-6.0.zip and SuperSU-v2.82-201705271822.zip to SD card

Put SD card back in phone

Reboot phone into fastboot mode, and re-pass to VM

From cmd terminal in adb folder,

fastboot flash recovery twrp-3.2.1-0-oxygen.img

fastboot boot twrp-3.2.1-0-oxygen.img

Once TWRP comes up, go ahead and and install no-verity-opt-encrypt-6.0.zip

(Optional) Make a backup. I didn't because I don't want the ROM that's on there anyway.

Reboot and ensure MIUI loads

Shutdown and reboot into TWRP

Install SuperSU as a system app

Reboot into MIUI

Access and edit the NVRAM:

Connect the device back to the computer, pass to VM if necessary

From your terminal in the adb folder,

adb devices

Grant debug permission on the device, if it asks again

adb shell

$su

Grant permission in superSU popup

#setprop sys.usb.config diag,adb

When the device reconnects, re-pass to VM if needed, and it may install another driver

Open QPST Configuration and make sure the device's port is enabled.

At the top, go to "start clients" and open "software download"

In the "Backup" tab, choose a location to save your file and hit Start, just in case you do break something

Once finished, close software download but leave QPST Configuration running

Open QXDM Professional

Under Options->Communications, make sure your phone is set "active" and set "target port" to the port it's on, then press OK

Go to NV Browser in the dropdown on the upper left.

Scroll down to 06828 :"nv_lte_bc_config_type.lte_bc_config"

Press READ and save this value somewhere in case you forget which bits you flipped! Mine was: 2061584302293

It's little-endian, and I wanted to flip bits to enable bands {2} and {4}, so I added 2^({2}-1)+2^({4}-1) = 10 to get a value of 2061584302303

Enter your new value in the "value" field and press "write"

Now, scroll down to the corresponding LTE prefs value at 65633

Read again. This should be the same number you had before, in hexadecimal format. Mine was 0x1E0000000D5, so to add B2 and B4 (Combined value 0xA), I changed it to 0x1E0000000DF

Again, enter your new value in the "value" field and press "write"

I doubt this requires any sort of "safe shutdown," but I hit "offline" then closed QXDM, then closed QPST, then rebooted the phone.

For a quick test, you can set network preferences to "LTE ONLY" by going to the dialpad and hitting *#*#INFO#*#*, then selecting your SIM card and using the dropdown in there. Mine was preferring HSPAP because the signal was stronger, even though the data was blocked.

Further testing I want to do when I get the bootloader unlocked again:

Find an app that shows what bands are in use

Try disabling bands I will never use that have similar frequencies to the bands I want to see if signal improves