I'd be willing to bet that somehow wlancond or something that wlancond talks to reads this out of the same "hidden" NAND partition that holds the WLAN MAC address and the lock code and other data that persists between reflashes. My reasoning is that my tarball of Debian does not use wlancond and lets me choose all channels up to 13. If you want me to do any testing, just ask.

-John