I have always thought that when the Agilent E4406A has the BAF (WCDMA) option, it can enable 100MHz SPAN (using the "intermod" mode in the WCDMA measurement function).
But when I purchased the E4406A, none of the 40 stocks in the seller had BAF options. They are all used for GSM and CDMA measurements. My E4406A has a CDMA2000 measurement option. When I studied it, I found that the CDMA2000 measurement function also had intermodulation measurements, which worked the same way as the WCDMA option. This provides a bit of convenience for "wideband" measurements.