cfg.db: The Black Box of the Baseband
Android's CarrierConfig only handles operating system policy control. The actual RF parameters, EN-DC combination (dual-connectivity combination) support list, and SA registration policy are controlled by an SQLite database within the baseband firmware. On Pixel devices, this file is located at /vendor/firmware/carrierconfig/cfg.db.
This database contains large binary configuration objects (BLOBs) for specific carriers (indexed by MCC/MNC). When a SIM card is inserted, the baseband queries this database:
Successful match: If the SIM card's MCC/MNC has a corresponding record in the database, the baseband loads the carrier-specific configuration (including specific frequency band combinations, SA on/off, etc.).
Failed match: If the database does not contain a record for that carrier (e.g., China Unicom 46001 or Denmark Telia 23820 are not defined in the US version of Pixel), the baseband falls back to the general configuration pointed to by the regional_fallback table.
The Pitfalls of Regional Fallback
The problem is that the default regional_fallback configuration set by Google/Samsung is often extremely restrictive—it frequently disables 5G SA and even limits the EN-DC combination, causing devices to only reside on LTE networks.
This is why simply modifying the Android XML is ineffective: Even if a user forcibly modifies the carrier_nr_availabilities_int_array in the Android layer to ``` via root or Shizuku, when the Android phone stack sends a RIL_REQUEST_SET_INITIAL_ATTACH_APN or similar command to the baseband to attempt to establish a 5G connection, the baseband will reject the request based on its internal cfg.db policy, because it "thinks" the current carrier does not support 5G.
SQL Injection Solution
The technical community (especially GrapheneOS developers and XDA geeks) has discovered a way to bypass this limitation: directly modifying the regional_fallback pointer in cfg.db.
Operation Command:
UPDATE regional_fallback set carrier_id = $FALLBACK_CARRIER_ID
Principle Explanation: This SQL statement redirects the default configuration of an "unknown carrier" to a "known and fully functional" carrier configuration ID.
Example: Denmark's Telia (23820): This carrier is missing in the default database. The user finds a carrier_id (e.g., ID 656) from a Swedish or general European operator with similar frequency band deployment and points the regional_fallback to it.
Result: When a Telia SIM card is inserted, although the baseband does not recognize it, the fallback logic loads the configuration of ID 656. Since ID 656 enables n78 SA and n28+n78 CA, the baseband removes physical layer restrictions, thus successfully connecting to 5G.
This discovery proves that Pixel phones fully support mainstream global 5G frequency bands in terms of hardware; the limitation stems purely from the whitelist mechanism in software configuration.
Key Frequency Band Combination Examples
Based on real-world testing data from tools like Network Signal Guru on the Pixel 6/7 Pro, the following combinations are crucial for unlocking high-performance 5G:
n78 + n41 (Mainstream in Asia): This is a key combination for operators like China Unicom and China Mobile. If the baseband configuration (cfg.db) lacks the CA combination definition for n41-n78, even with excellent single-band signal strength, users cannot achieve gigabit speeds. This is one reason why modifying regional_fallback is effective—it often borrows configurations that support these combinations.
n28 + n78 (Mainstream in Europe): Telia, Vodafone, and others widely use n28 (700MHz) for wide coverage and n78 (3.5GHz) for capacity. Not supporting this CA combination will cause the phone to frequently switch between the two frequency bands, resulting in power consumption and network drops, instead of utilizing both simultaneously. 3C-1_n78-n78 (Three-Carrier Aggregation): This indicates LTE Band 3 (two consecutive carriers) + LTE Band 1 + NR n78 (two consecutive carriers). This complex cross-standard (EN-DC) and intra-band continuous aggregation configuration must be explicitly defined in the baseband firmware.
Android's 5G SA and carrier aggregation configuration system is a sophisticated system comprised of upper-layer policies (XML) and lower-layer capabilities (Database).
For ordinary users: In supported regions, the system handles everything automatically. In unsupported regions (such as China using Pixel), it must be recognized that simply modifying Android settings (such as ##4636##) is usually ineffective because the underlying "split-brain" configuration will intercept requests.
For developers and engineers: Enabling SA requires verifying that carrier_nr_availabilities_int_array contains 2.
When troubleshooting the issue of the "5G+" icon not displaying, both the bandwidth threshold (nr_advanced_threshold) and the frequency band whitelist (additional_nr_advanced_bands) need to be checked.
The ultimate solution to the "signal available but no 5G" problem lies in correcting the regional_fallback in the baseband database.