It seems that various firmwares just pass values from eg AT^SYSCFG straight through to the firmware so it's pretty easy to map them to the actual response here. Note that the NV mode pref item uses a different mapping than CM state info response. Yay.