This is the deal with the MAC address issue (I never changed anything):
Each device has its own unique address that cannot be changed. It's all the way down to the hardware level, however, it apparently can be changed at the software level. What's happening is there a default configuration file to start the WIFI driver and module. This file (nvram.txt) has a default mac addy that is loaded so that the driver/hardware can start.
Now, as far as I can tell, what Huawei did was create a function in one of the hardware libraries (libhardware_legacy) found in the source code to catch the true mac addy. So, it would go something like this:
Phone starts ---> boots kernel ---> kernel speaks to WIFI ---> hardware is initialized ---> software is loaded along with libhardware_legacy.so ---> Mac addy is caught and properly reported to the ROM.
Now, I can't say this is for sure, but I'm guessing it's close. I used a hex editor a long time ago to open up the libhardware_legacy lib from the stock/2.2 ROMs and you can see something performing this task. However, I wasn't able to make a function in libhardware because the lib was already prebuilt. It shouldn't be too difficult for someone who knows C++ and I've seen example of this from sites found with Google.