Instead of doing a lot of work implementing these Huawei specific commands you could consider using QMI for band selection instead. The AT^SYSCFGEX command just reflects the internal QMI state on Huawei QMI modems. It is probably still usefull on non-QMI modems like the E3276 though.
But looking at QMI, For example on an E392-u12:
AT^SYSCFGEX?
^SYSCFGEX:"00",3FFFFFFF,1,2,7FFFFFFFFFFFFFFF
Same info read via QMI (OK, a bit more verbose....):
sending to /dev/cdc-wdm1:
01 0c 00 00 03 09 00 02 00 34 00 00 00
=> QMUX Header:
=> len: 0x000c
=> sender: 0x00
=> svc: 0x03
=> cid: 0x09
=> QMI Header:
=> Flags: 0x00
=> TXN: 0x0002
=> Cmd: 0x0034
=> Size: 0x0000
reading from /dev/cdc-wdm1
[Thu May 16 15:02:02 2013] read 67 bytes from /dev/cdc-wdm1
01 42 00 80 03 09 02 02 00 34 00 36 00 02 04 00 00 00 00 00 10 01 00 00 11 02 00 1c 00 12 08 00 80 03 68 01 00 00 02 00 14 02 00 ff 00 15 08 00 c5 00 08 00 00 00 00 00 16 01 00 00 18 04 00 02 00 00 00
<= QMUX Header:
<= len: 0x0042
<= sender: 0x80
<= svc: 0x03
<= cid: 0x09
<= QMI Header:
<= Flags: 0x02
<= TXN: 0x0002
<= Cmd: 0x0034
<= Size: 0x0036
<= [0x02] ( 4) 00 00 00 00 SUCCESS – QMI_ERR_NONE
<= [0x10] ( 1) 00 Emergency mode: off
<= [0x11] ( 2) 1c 00 UMTS|GSM|LTE
<= [0x12] ( 8) 80 03 68 01 00 00 02 00 "GSM DCS 1800" + "GSM Extended GSM (E-GSM) 900" + "GSM Primary GSM (P-GSM) 900" + "GSM 850" + "GSM PCS 1900" + "WCDMA Europe, Japan, and China IMT 2100" + "WCDMA Europe and China DCS 1800" + "WCDMA Europe and Japan 900"
<= [0x14] ( 2) ff 00 Roaming preference: ANY
<= [0x15] ( 8) c5 00 08 00 00 00 00 00 E-UTRA Operating Bands 1, 3, 7, 8, 20
<= [0x16] ( 1) 00 Network Selection: automatic
<= [0x18] ( 4) 02 00 00 00 Circuit-switched and packet-switched
got match!
Here you see the UMTS/GSM band mask in TLV 0x12 and the LTE band mask in TLV 0x15. TLV 0x11 is also interesting. It shows the current system selection, which is independent of the band selection!
The reason Huawei can map that explicit band mask to 3FFFFFFF is because the current mask is identical to the device max supported bands, which can be read out using DMS command 0x0045:
sending to /dev/cdc-wdm1:
01 0c 00 00 02 02 00 02 00 45 00 00 00
=> QMUX Header:
=> len: 0x000c
=> sender: 0x00
=> svc: 0x02
=> cid: 0x02
=> QMI Header:
=> Flags: 0x00
=> TXN: 0x0002
=> Cmd: 0x0045
=> Size: 0x0000
reading from /dev/cdc-wdm1
[Thu May 16 15:10:14 2013] read 31 bytes from /dev/cdc-wdm1
01 1e 00 80 02 02 02 02 00 45 00 12 00 02 04 00 00 00 00 00 01 08 00 80 03 68 01 00 00 02 00
<= QMUX Header:
<= len: 0x001e
<= sender: 0x80
<= svc: 0x02
<= cid: 0x02
<= QMI Header:
<= Flags: 0x02
<= TXN: 0x0002
<= Cmd: 0x0045
<= Size: 0x0012
<= [0x01] ( 8) 80 03 68 01 00 00 02 00 ..h.....
<= [0x02] ( 4) 00 00 00 00 SUCCESS – QMI_ERR_NONE
got match!
(Hmm, there should have been a TLV 0x10 with the supported LTE bands here. Don't know why that's missing – might be a problem)
Anyway, removing a few supported bands will make the real band mask appear in the AT command as well:
sending to /dev/cdc-wdm1:
01 17 00 00 03 0a 00 02 00 33 00 0b 00 12 08 00 00 03 68 01 00 00 00 00
=> QMUX Header:
=> len: 0x0017
=> sender: 0x00
=> svc: 0x03
=> cid: 0x0a
=> QMI Header:
=> Flags: 0x00
=> TXN: 0x0002
=> Cmd: 0x0033
=> Size: 0x000b
=> [0x12] ( 8) 00 03 68 01 00 00 00 00 ..h.....
reading from /dev/cdc-wdm1
[Thu May 16 15:02:51 2013] read 20 bytes from /dev/cdc-wdm1
01 13 00 80 03 0a 02 02 00 33 00 07 00 02 04 00 00 00 00 00
<= QMUX Header:
<= len: 0x0013
<= sender: 0x80
<= svc: 0x03
<= cid: 0x0a
<= QMI Header:
<= Flags: 0x02
<= TXN: 0x0002
<= Cmd: 0x0033
<= Size: 0x0007
<= [0x02] ( 4) 00 00 00 00 SUCCESS – QMI_ERR_NONE
got match!
Now, the mask appears in the AT command as well , because it is less than the max supported mask:
AT^SYSCFGEX?
^SYSCFGEX:"00",1680300,1,2,7FFFFFFFFFFFFFFF
And just for completeness, the QMI query:
sending to /dev/cdc-wdm1:
01 0c 00 00 03 0d 00 02 00 34 00 00 00
=> QMUX Header:
=> len: 0x000c
=> sender: 0x00
=> svc: 0x03
=> cid: 0x0d
=> QMI Header:
=> Flags: 0x00
=> TXN: 0x0002
=> Cmd: 0x0034
=> Size: 0x0000
reading from /dev/cdc-wdm1
[Thu May 16 15:16:36 2013] read 67 bytes from /dev/cdc-wdm1
01 42 00 80 03 0d 02 02 00 34 00 36 00 02 04 00 00 00 00 00 10 01 00 00 11 02 00 1c 00 12 08 00 00 03 68 01 00 00 00 00 14 02 00 ff 00 15 08 00 c5 00 08 00 00 00 00 00 16 01 00 00 18 04 00 02 00 00 00
<= QMUX Header:
<= len: 0x0042
<= sender: 0x80
<= svc: 0x03
<= cid: 0x0d
<= QMI Header:
<= Flags: 0x02
<= TXN: 0x0002
<= Cmd: 0x0034
<= Size: 0x0036
<= [0x02] ( 4) 00 00 00 00 SUCCESS – QMI_ERR_NONE
<= [0x10] ( 1) 00 Emergency mode: off
<= [0x11] ( 2) 1c 00 UMTS|GSM|LTE
<= [0x12] ( 8) 00 03 68 01 00 00 00 00 "GSM Extended GSM (E-GSM) 900" + "GSM Primary GSM (P-GSM) 900" + "GSM 850" + "GSM PCS 1900" + "WCDMA Europe, Japan, and China IMT 2100" + "WCDMA Europe and China DCS 1800"
<= [0x14] ( 2) ff 00 Roaming preference: ANY
<= [0x15] ( 8) c5 00 08 00 00 00 00 00 E-UTRA Operating Bands 1, 3, 7, 8, 20
<= [0x16] ( 1) 00 Network Selection: automatic
<= [0x18] ( 4) 02 00 00 00 Circuit-switched and packet-switched
got match!
These commands should work on QMI devices from other vendors as well. They are of course still vendor specific (tied to Qualcomm chipsets), but at least more generic than the Huawei AT commands.
The QMI stuff is documented with an open source license (BSD 3-clause) in the CodeAurora Gobi project: https://www.codeaurora.org/patches/quic/gobi/
This makes it a lot more attractive than guessing vendor AT commands IMHO...