As someone who spent some time in the mobile industry the telecom operators are the greatest barrier to overcome in these situations. They're quite inflexible.

As someone who spent some time in the mobile industry the telecom operators are the greatest barrier to overcome in these situations. They're quite inflexible. When I was involved in a phone project we were provided a firmware blob for the baseband and it had DMA to the main processor. We did quite a bit of RF fuzzing and well, the results are what you would expect.