It was not setting emm_data->eplmn.plmn[X], only emm_data->eplmn.n_plmns,
leading to the UE to dig for PLMN 00000.

(It's not the end of the story, seems like the PLMN selection
does not work, the UE only tries one from what I've seen, but
I didn't dig much, may be wrong.)