It took me long to understand how the channel frequency settings are stored in flash but now I do and I was able to write my own command line tool to read device flash data! By reading the complete content, I found:

a) Flash content wraps at 0x2000
b) Unknown content starting at 0x1A00, that is neither read nor written by the official app. Possibly relicts from developement?