[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] lordnils:
Tried that, doesn't change a thing. :(

Neither does this. I checked with getprop persist.dbg.volte_avail_ovr which returned an empty line indicating the prop was properly removed after the reboot.

I had some Firebase-Errors about connectivity in logcat but they are normally only because I use a filtering hosts file (which I also removed for testing right now). Also when clocking the ModemSwitcher I get the following in logcat:

10-21 23:11:43.124 1863 3973 I ActivityManager: START u0 {act=android.intent.action.VIEW flg=0x10000000 cmp=com.sonymobile.customizationselector/.ModemSwitcherActivity bnds=[270,660][450,864]} from uid 10220
10-21 23:11:43.134 11587 11587 W ActivityThread: handleWindowVisibility: no activity for token android.os.BinderProxy@cd6d160
10-21 23:11:43.161 1163 1297 W SurfaceFlinger: Attempting to destroy on removed layer: AppWindowToken{10f0eff token=Token{273a61e ActivityRecord{d43ba59 u0 com.sonymobile.customizationselector/.ModemSwitcherActivity t15932}}}#0
10-21 23:11:43.168 1163 1297 E BufferQueueProducer: [Splash Screen com.sonymobile.customizationselector#0] dequeueBuffer: BufferQueue has been abandoned
10-21 23:11:43.169 1863 2009 E Surface : dequeueBuffer failed (No such device)
10-21 23:11:43.169 1863 2009 E ViewRootImpl[customizationselector]: Could not lock surface
10-21 23:11:43.169 1863 2009 E ViewRootImpl[customizationselector]: java.lang.IllegalArgumentException
10-21 23:11:43.169 1863 2009 E ViewRootImpl[customizationselector]: at android.view.Surface.nativeLockCanvas(Native Method)
10-21 23:11:43.169 1863 2009 E ViewRootImpl[customizationselector]: at android.view.Surface.lockCanvas(Surface.java:345)
10-21 23:11:43.169 1863 2009 E ViewRootImpl[customizationselector]: at android.view.ViewRootImpl.drawSoftware(ViewRootImpl.java:3385)
10-21 23:11:43.169 1863 2009 E ViewRootImpl[customizationselector]: at android.view.ViewRootImpl.draw(ViewRootImpl.java:3346)
10-21 23:11:43.169 1863 2009 E ViewRootImpl[customizationselector]: at android.view.ViewRootImpl.performDraw(ViewRootImpl.java:3122)
10-21 23:11:43.169 1863 2009 E ViewRootImpl[customizationselector]: at android.view.ViewRootImpl.performTraversals(ViewRootImpl.java:2481)
10-21 23:11:43.169 1863 2009 E ViewRootImpl[customizationselector]: at android.view.ViewRootImpl.doTraversal(ViewRootImpl.java:1463)
10-21 23:11:43.169 1863 2009 E ViewRootImpl[customizationselector]: at android.view.ViewRootImpl$TraversalRunnable.run(ViewRootImpl.java:7190)
10-21 23:11:43.169 1863 2009 E ViewRootImpl[customizationselector]: at android.view.Choreographer$CallbackRecord.run(Choreographer.java:949)
10-21 23:11:43.169 1863 2009 E ViewRootImpl[customizationselector]: at android.view.Choreographer.doCallbacks(Choreographer.java:761)
10-21 23:11:43.169 1863 2009 E ViewRootImpl[customizationselector]: at android.view.Choreographer.doFrame(Choreographer.java:696)
10-21 23:11:43.169 1863 2009 E ViewRootImpl[customizationselector]: at android.view.Choreographer$FrameDisplayEventReceiver.run(Choreographer.java:935)
10-21 23:11:43.169 1863 2009 E ViewRootImpl[customizationselector]: at android.os.Handler.handleCallback(Handler.java:873)
10-21 23:11:43.169 1863 2009 E ViewRootImpl[customizationselector]: at android.os.Handler.dispatchMessage(Handler.java:99)
10-21 23:11:43.169 1863 2009 E ViewRootImpl[customizationselector]: at android.os.Looper.loop(Looper.java:193)
10-21 23:11:43.169 1863 2009 E ViewRootImpl[customizationselector]: at android.os.HandlerThread.run(HandlerThread.java:65)
10-21 23:11:43.169 1863 2009 E ViewRootImpl[customizationselector]: at com.android.server.ServiceThread.run(ServiceThread.java:44)

Apparently there is some Buffer used by the Splash Screen and the other end of the queue is (whatever that might be) is not available (anymore?). Do we have the source code of com.sonymobile.customizationselector/.ModemSwitcherActivity somewhere? This might give a clue.