I can't get Network Positioning to return a location when using my T-Mobile (USA) SIM.

When using a borrowed AT&T SIM, a position is found in a handful of seconds.

With T-Mobile, enabling Network Positioning in the Location settings then selecting Street/District/City-level within My Availability > My Location shows a flashing satellite dish icon... forever. The status shown under Location when tapping the clock is always "Searching".

Workaround found: Use supl.google.com instead of supl.nokia.com and reboot. Follow the link for more details.

Some diagnostic steps I've tried:

It's not that the cell ID is unavailable from T-Mobile. Using dbus, I can successfully get information about the current cell:
A T-Mobile technician confirmed that the 278XXXXX number matches their cell ID scheme.

It's not that the outgoing port (7275) is blocked by T-Mobile or that the supl.nokia.com server is unresponsive. I can apparently connect to supl.nokia.com via wifi or T-Mobile 3G from the N900 with socat:
To further test this, I set up a TCP relay on my home machine, forwarding connections on port 7275 to supl.nokia.com's port 7275 and pointed the Location Server in the N900's Location settings at my machine. Capturing traffic on port 7275 on my relay machine and using socat on the N900 like this:
I observed a successful TCP connection made from the N900 to the relay, both over T-Mobile 3G and wifi.

Disabling and re-enabling Network Positioning does not appear to trigger a connection attempt from the Location service. However, with this relay and capture setup, on booting the N900, I observe what appears to be a successful connection to the relay, some binary data is transmitted from the N900 to the relay and sent along to supl.nokia.com, the response that comes back looks all SSL-ified, and that data is sent back to the N900. I can understand this probably not working properly due to the TCP relay of SSL data -- that's not the point. The point is that the N900 is trying to connect to its configured Location server, and it is sending some data and getting a response.

So, with the Location Server set back to supl.nokia.com, the connection is presumably made, but either something about the response isn't acceptable to the Location service, or something later in the process is hanging.

The location service never seems to retry the TCP connection. Perhaps the response is cached and re-used or perhaps the service is basically hung. The satellite dish icon just keeps blinking.

dmesg shows nothing of interest.

dbus-monitor --system, when run while enabling and disabling Offline Mode, shows that a dbus call of some sort is being made that returns the cell ID.

Is there anything further I should look into to determine why a coarse position is never obtained via T-Mobile? Or hopefully even fix this?