All of the CR1000A's Open Source information can be found here: https://www.verizon.com/support/residential/internet/equipment/open-source-software . If Verizon made any changes to GPL software in the router, it would be in their GitHub or committed back to the main project for everyone to share. Configuration files are not covered under such a thing.
You can sniff the mobility domain from an 802.11 packet with Wireshark. Refer to: https://osqa-ask.wireshark.org/questions/49385/bss-transition-supported-relationship-to-80211r-suppo...
