They make it seem like the only way to remove the 10 mA range is to send the second command, and the eeprom is the logical place to store it.
Can you check what cal info string is shown on the device?
You could go crazy with some poke 24,0,1 23 or 26,27 and just see what happens BECAUSE YOU HAVE A BACKUP. DO NOT DO THIS WITHOUT CAL BACKUP. CAL MEMORY CORRUPTION IS LIKELY.
But doing just the one poke to show what bit is flipped (and IF a bit is flipped...) in the dump might shine some light.
Also storing a setting (then dump) and then changing one part of that setting and store it again (dump again) should point to the memory are where settings are stored.
And IF the state settings are stored in the eeprom at all...
edit: In the service manual the "Cal eeprom" is the only place I can find information can be stored in a persistent way by the device itself. Let's see if 10mA and state settings turn up?