Curiosity killed the cat. I hope it doesn't kill me. The Libre sensor data can be read by (almost) any NFC reader including, somewhat conveniently, the one that had been sitting completely useless in my Galaxy Note 2.
Reading the tag from time to time has led to some insight about its content. It's quite clear that the sensor running time in minutes is stored as a word at 013C and 013D. Some large zones don't change from sensor to sensor. And some data is definitely stored and updated in 6 bytes long records.
Here's a dump from tonight, with some correlation values as exported by the receiver. Blue circles on the right highlight the 15 minutes spaced values that the reader uses to build its curves. The green circles highlight spot checks values displayed by the reader (in some cases, on a T1D user varying quickly, the spot values do not even fit in the average values - maybe a topic for another post). Left hex panel is approximately 14 mins later than right hex panel. Lots of things have changed at the top, possibly the two minutes internal checks. One neat 5 bytes record has changed below. And the timer has moved as expected. Lots of nibble shifts as well it seems.
Any insight you want to share? Do not hesitate contacting me in private. I've made the raw data available on github. I have no doubt that if you know what a nibble is and are interested, you will find it.