OnePlus 9 — Qualcomm Instrument UE Acquisition and Validation

This guide is for a phone you own, with a lab SIM, attached only to the isolated mobility bench. It does not authorize testing against public networks or third-party subscribers.

1. Why the device change is reasonable

The three phones now have different jobs:

OnePlus lists the OnePlus 9 with a Qualcomm Snapdragon 888 and integrated X60 5G modem. QCSuper uses Qualcomm DIAG and has a maintainer-labeled report of a rooted OnePlus 9 working through --adb. The same report says direct DIAG exposure did not work for that tester, so the evidence supports “rooted --adb path confirmed on at least one unit,” not “every OnePlus 9 exposes a serial DIAG port.”

Sources: OnePlus 9 specifications, QCSuper README, QCSuper OnePlus 9 confirmed-working report, SCAT README.

2. Choose the right unit before paying

Preferred purchase profile

OnePlus maps OxygenOS 13 builds as NA LE2115, EU LE2113, and IN LE2111. That mapping identifies software families; it does not by itself prove a particular used unit is bootloader-unlockable. Source: OnePlus OxygenOS 13 release post.

T-Mobile edition: avoid unless intentionally accepted

OnePlus still describes a token application for T-Mobile-edition devices: SIM unlock first, enable OEM unlocking, collect IMEI/serial/unlock code, then wait for approval. For this lab, that is needless uncertainty when a non-carrier edition is available. Source: OnePlus T-Mobile unlock-token page.

3. Mental model: independent capability gates

flowchart LR
  A[Correct physical model] --> B[SIM/carrier unlocked]
  B --> C[OEM unlock toggle available]
  C --> D[Bootloader actually unlocks
factory reset]
  D --> E[Matching boot image + root]
  E --> F[Qualcomm DIAG transport reachable]
  F --> G[Useful LTE/5G messages decode]

Passing a gate does not imply the next one:

• Snapdragon/X60 hardware does not guarantee the vendor exposes DIAG on the installed build.
• An available OEM toggle does not mean the bootloader has already been unlocked.
• Root does not guarantee a /dev/diag node; newer kernels may require USB mode-switching instead.
• A DIAG byte stream does not guarantee SCAT/QCSuper decodes every 5G log packet version.

4. Non-destructive arrival preflight

Do this during the return window. Stop before any wipe.

4.1 Android / ADB identity

adb devices -l
adb shell getprop ro.product.manufacturer
adb shell getprop ro.product.model
adb shell getprop ro.product.device
adb shell getprop ro.build.display.id
adb shell getprop ro.boot.flash.locked
adb shell getprop ro.boot.verifiedbootstate
adb shell dumpsys device_policy

Expected shape:

manufacturer: OnePlus
device: lemonade
flash.locked: 1
verifiedbootstate: green

The locked/green result is normal before instrument preparation. Record the actual model/build; do not force an expected value into the evidence note.

4.2 Human-visible OEM gate

On the phone:

1. Enable Developer options.
2. Open Settings → System → Developer options → OEM unlocking.
3. Confirm the control is selectable.
4. Record whether it is off/selectable, on, or greyed out and the displayed reason.

If greyed out after normal setup, network check-in, and policy inspection, the unit fails the instrument purchase gate. Do not substitute an unofficial bypass for a return.

4.3 Read-only bootloader view

Run on the machine physically attached to USB:

adb reboot bootloader
fastboot devices
fastboot getvar product
fastboot getvar unlocked
fastboot getvar secure
fastboot flashing get_unlock_ability
fastboot reboot

Interpretation:

Android's reference flow states that fastboot flashing unlock must be denied unless unlock ability is 1, and that a successful unlock performs a factory reset. Source: AOSP bootloader locking/unlocking.

5. Destructive preparation gate

Before approval, capture:

• exact model and OxygenOS build;
• battery level and working USB cable/host;
• a tested stock recovery/restore source for that exact variant;
• hashes and origin of any image to be patched;
• proof that the phone has only a lab account and lab SIM;
• baseline adb and fastboot getvar evidence.

Do not copy a Pixel command that assumes boot.img versus init_boot.img. Determine the patch target from the exact OnePlus build and the current Magisk/device documentation at execution time.

6. DIAG validation after approved root

6.1 Verify root separately

adb shell su -c id
# Expected: uid=0(root) ...

If this fails, stop. ADB authorization is not root.

6.2 Inspect, then let QCSuper choose the transport

adb shell su -c 'getprop sys.usb.config'
adb shell su -c 'ls -l /dev/diag /dev/ffs-diag* 2>/dev/null'

# Preferred first attempt because a OnePlus 9 is confirmed working this way:
qcsuper --adb --pcap-dump oneplus9-diag.pcap

# Live view after file capture works:
qcsuper --adb --wireshark-live

QCSuper documents two modern paths: an ADB/root-assisted path and a USB DIAG pseudo-serial path. On newer kernels, /dev/diag can be absent and QCSuper may mode-switch USB instead. Do not mark the phone incompatible merely because /dev/diag is missing; require the tool result and USB enumeration as evidence. Source: QCSuper README.

6.3 Validate content, not just file creation

A nonempty PCAP is only the transport gate. Open it in Wireshark and record:

QCSuper describes broad Qualcomm support but limits its stated capture support to 2G/3G/4G and certain 5G models. SCAT parses Qualcomm and Samsung diagnostic messages, but its availability does not prove this handset/build emits every desired log. Until the lab evidence above exists, label OnePlus 9 5G support candidate / cited-not-verified-on-device.

7. Worked example: do not overclaim a modem crash

Suppose the RAN log shows an attach timeout and the phone momentarily loses service.

DIAG improves correlation. It does not by itself turn a timeout into a CVE.

8. Evidence worksheet

Save as artifacts/evidence/YYYY-MM-DD-oneplus9-preflight.md in the relevant run workspace:

# OnePlus 9 instrument preflight

- Scope: owned handset, lab SIM, isolated bench
- Seller/edition claim:
- Return deadline:
- Model/build:
- `ro.product.device`:
- SIM/carrier unlocked: yes/no/evidence
- OEM toggle: selectable/on/grey + reason
- Device policy owner: none/details
- Fastboot product:
- `unlocked`:
- `get_unlock_ability`:
- Root verified: not attempted / yes / no
- QCSuper transport: not attempted / pass / fail
- LTE NAS/RRC decode: not attempted / pass / fail
- 5G NAS/RRC decode: not attempted / pass / fail
- Evidence paths/hashes:
- Limitations:
- Next action:

9. Decision tree

flowchart TD
  A[OnePlus 9 arrives] --> B{Correct model/build
and clean identity?}
  B -- no --> R[Return]
  B -- yes --> C{OEM toggle selectable
and unlock ability 1?}
  C -- no --> L[Locked baseline only
or return]
  C -- yes --> D[Record baseline + restore plan]
  D --> E{Human approval for wipe/unlock?}
  E -- no --> S[Stop at read-only evidence]
  E -- yes --> F[Unlock + exact-build root workflow]
  F --> G{QCSuper --adb works?}
  G -- no --> H[Collect logs / inspect USB mode
do not assume SCAT works]
  G -- yes --> I[Validate LTE then 5G decode
three repeat runs]

10. Alternative if the goal is DIAG only

If Android app-layer instrumentation is not required on the same device, a supported Qualcomm modem module can be cleaner than any phone because it can expose AT/DIAG over USB without bootloader or Magisk work. The mobility mastery plan currently names an RM500Q-GL/X55 kit as that alternative, but its exact QCSuper/SCAT compatibility must also be confirmed before purchase. Choose:

• OnePlus 9 when one device should cover Android apps, root tooling, and a candidate Qualcomm DIAG path.
• Dedicated modem module when repeatable modem protocol capture and band/mode control matter more than Android.

Sources checked 2026-10-20

• OnePlus 9 official specifications
• OnePlus OxygenOS 13 release families
• OnePlus T-Mobile edition unlock-token workflow
• AOSP — lock and unlock the bootloader
• Android SDK Platform-Tools
• QCSuper README
• QCSuper issue #150 — rooted OnePlus 9 confirmed working via --adb
• QCSuper issue #91 — /dev/diag absence on newer Android builds
• SCAT README