So thanks to the magic of an activation emulator and the original work of Dvd Jon, I got the activation/unlock record of a French unlocked iPhone. The field looks like
"UnlockCode" = "NO=111111111111111&";
with the 1's replaced by the code. I'm not sure what "NO" means, but there are fifteen digits, so I'm pretty sure the NCK length is 15. This is out of range of a bruteforcer, and I doubt, although its possible, that the NCK's are based off the IMEI/DevID. I would think Apple just has a big lookup table.