Maybe restoring the NVRAM from backup fixes the mac address issue.
Unfortunately, I don't think the problem is quite so simple. At least mine isn't.
I did make an NVRAM backup. And while I didn't restore it, I did another backup after the problem appeared, and compared the two. They were identical. So I don't think that restoring it would make a difference.
Also, when I reflash using "firmware upgrade" mode (but no restore of the original NVRAM backup), I do get my original MAC address back. (I didn't really pay attention to the IMEI; don't know about that). So the MAC address does seem to be uncorrupted in the NVRAM. It just isn't getting set on the interface after the first android boot.
But the problem does seem to be related to the early-boot NVRAM settings. I don't really understand the process well enough to say what is going on. Informed speculation is welcome.