SenseCAP T1000-B how to reset dev_nonce?

My SenseCAP T1000-B sends a dev_nonce of 65535, which means it can’t work reliably. How do I reset the dev_nonce to zero?

I tried a factory reset (in the Android app), I switched between networks (which the manual says resets things), and I changed devEUI. None of these reset the dev_nonce.

A dev_nonce of 65535 means the device is unusable. I can get it to join by resetting the nonces on the server side but then a day later when the T1000 tries to rejoin it reuses the 65535 dev_nonce value and can’t join. That effectively kicks it off the network. Is my T1000 now e-waste?