correct way to determine length of MNC using CnS only

IoT Modules MC/EM Series
1

Hi.
I am writing a driver working via CnS protocol for a device that we expect to sell worldwide.
Everything is fine except one detail.

Query of 0x1004 object (get IMSI) returns MCC and MNC in BCD format (decimal digits in hex representation).
And since MCC is 3-digit only, the conversion of MCC is simple.
But MNC can be either 2 or 3-digit and there is no way to determnine the length from the response because the dummy digit ‘f’ is replaced to ‘0’

I see several ways to guess the proper length:

  1. to see length of MSIN, 10 digits are for 2-digit MNC and 9 digits are for 3-digit MNC - do not think it is reliable;
  2. to obtain IMSI via AT interface (AT+CIMI) then to compare - do not like to use another interface;
  3. to use predefined database of MCCs and to guess using it - may not reliable since the MCC database may be outdated or incorrect;
  4. to read from SIM EF IMSI file (6F07) and/or EF AD file (6FAD) - seems to be the most reliable way.

But the problem that the HIP and CnS protocols do not give ways to access SIM files. They are accesible via AT interface only.

So the questions are:

  1. why 0x1004 (get IMSI) response is ambigious (mostly rhetoric);
  2. how to access SIM files via HIP or CnS;
  3. what is the way to determine length of MNC using the HIP or CnS interface only

Thank you