[Essential Phone Questions & Answers] smokeyou:
One idea.. Has anyone asked Sonim?

They gave me debug images along with flash tools for the XP8 when I asked about a year ago.. Although not as useful as the early (unlockable) debug images provided by eleotk.. Sonim had to verify I was local in the US and it took a few days but was not an issue. We are seeing now that many variations of the debug image exist for the XP8 so I'm sure it's the same case on this XP5812.

They do seem to keep a tighter grip on the XP5s since custom apps require Sonim direct validation/signing but it may be worth a shot since any debug images they provide would have the required mbn file for flashing.

Obviously you need to give them a developer style excuse as they will likely not help if they know your trying to modify the device.

I would ask them myself however the only XP5s I have is a Sprint XP5800 that's working with the ZTE 8920 mbn file. This issue appears unique to the variant I believe? Aside from the XP5823 label - it looks simular on my end.

XP5823:/ $ su
XP5823:/ # cat /proc/partitions
major minor #blocks name

254 0 524288 zram0
179 0 15388672 mmcblk0
179 1 106496 mmcblk0p1
179 2 1 mmcblk0p2
179 3 8 mmcblk0p3
179 4 512 mmcblk0p4
179 5 512 mmcblk0p5
179 6 512 mmcblk0p6
179 7 512 mmcblk0p7
179 8 2048 mmcblk0p8
179 9 2048 mmcblk0p9
179 10 256 mmcblk0p10
179 11 256 mmcblk0p11
179 12 16384 mmcblk0p12
179 13 1536 mmcblk0p13
179 14 1536 mmcblk0p14
179 15 32 mmcblk0p15
179 16 1536 mmcblk0p16
179 17 16 mmcblk0p17
179 18 11264 mmcblk0p18
179 19 1024 mmcblk0p19
179 20 1024 mmcblk0p20
179 21 65536 mmcblk0p21
179 22 65536 mmcblk0p22
179 23 1024 mmcblk0p23
179 24 2621440 mmcblk0p24
179 25 1048576 mmcblk0p25
179 26 32768 mmcblk0p26
179 27 1024 mmcblk0p27
179 28 512 mmcblk0p28
179 29 32 mmcblk0p29
179 30 262144 mmcblk0p30
179 31 32 mmcblk0p31
259 0 512 mmcblk0p32
259 1 1024 mmcblk0p33
259 2 32768 mmcblk0p34
259 3 512 mmcblk0p35
259 4 4096 mmcblk0p36
259 5 256 mmcblk0p37
259 6 256 mmcblk0p38
259 7 256 mmcblk0p39
259 8 256 mmcblk0p40
259 9 256 mmcblk0p41
259 10 256 mmcblk0p42
259 11 256 mmcblk0p43
259 12 256 mmcblk0p44
259 13 8 mmcblk0p45
259 14 9020 mmcblk0p46
259 15 7636 mmcblk0p47
259 16 5824 mmcblk0p48
259 17 4820 mmcblk0p49
259 18 10576707 mmcblk0p50
179 32 4096 mmcblk0rpmb
253 0 10576691 dm-0

XP5823:/ # cat /proc/cpuinfo
Processor : AArch64 Processor rev 4 (aarch64)
processor : 0
BogoMIPS : 38.40
Features : fp asimd evtstrm aes pmull sha1 sha2 crc32
CPU implementer : 0x41
CPU architecture: 8
CPU variant : 0x0
CPU part : 0xd03
CPU revision : 4

processor : 1
BogoMIPS : 38.40
Features : fp asimd evtstrm aes pmull sha1 sha2 crc32
CPU implementer : 0x41
CPU architecture: 8
CPU variant : 0x0
CPU part : 0xd03
CPU revision : 4

processor : 2
BogoMIPS : 38.40
Features : fp asimd evtstrm aes pmull sha1 sha2 crc32
CPU implementer : 0x41
CPU architecture: 8
CPU variant : 0x0
CPU part : 0xd03
CPU revision : 4

processor : 3
BogoMIPS : 38.40
Features : fp asimd evtstrm aes pmull sha1 sha2 crc32
CPU implementer : 0x41
CPU architecture: 8
CPU variant : 0x0
CPU part : 0xd03
CPU revision : 4

Hardware : Qualcomm Technologies, Inc MSM8920
XP5823:/ #

Edit.. Missed the bootloader options. The Sprint variant at least seems to be shipped in an unlocked state with secure boot also disabled. This is likely why it trusts the ZTE mbn file.

(bootloader) version:0.5
(bootloader) battery-soc-ok:yes
(bootloader) battery-voltage:3745000
(bootloader) variant:QRD eMMC
(bootloader) secure:no
(bootloader) version-baseband:
(bootloader) version-bootloader:
(bootloader) display-panel:
(bootloader) off-mode-charge:0
(bootloader) charger-screen-enabled:0
(bootloader) max-download-size: 0x1ff00000
(bootloader) partition-type:cache:ext4
(bootloader) partition-size:cache: 0x40000000
(bootloader) partition-type:userdata:ext4
(bootloader) partition-size:userdata: 0x2858d0e00
(bootloader) partition-type:system:ext4
(bootloader) partition-size:system: 0xa0000000
(bootloader) model:XP5800
(bootloader) build:5SA.0.2-03-7.1.2-29.03.00
(bootloader) imei:XXXXXXXXXXXXXXX
(bootloader) serialno:XXXXXXXX
(bootloader) kernel:lk
(bootloader) product:QC_REFERENCE_PHONE
all:
finished. total time: 0.030s