I have used TelephonyManager API to get cell info which returns 6 or less neighbors with cell IDs/RSSIs. Same is the case if you communicate through RIL to get ARFCNs/RSSIs then we always get 6 neighbors. But normally there are more than 6 neighbors (upto 32 I think that an Android device can see) in range. My goal is to get info of all those neighbors.
I have also download android source code, built it and a kernel with Loadable Kernel Module (LKM) support and successfully flashed in case if a source code change is required. I am just looking for a direction to move on. Again my goal is to get all neighbors info no matter what i have to do like rooting, flashing new OS, flashing new kernel or other hacking stuff.
As far as I know cells in range is something the modem knows. What it decides to report the Android space depends on implementation of the vendor and the kind of network you use(UMTS/GSM/HSPA..). Most vendors have closed sourced modem which runs in some kind of arm/dsp/rt secondary processor.
The communication with the modem is done using RPC in chipset specific manner which eventually connects to RIL layer and android apis. I dont think there is easy way to hack beyond messing up with the android/ril layer which is also kind of limited. Hacking the kernel is also useless.
Maybe newer devices have more information coming through and this can be what you are looking for..