It's not clear how any of the suggested attacks constitute 'permanent' damage: disabling the transmitter, corrupting the antenna pointing logic, demod, power pa

It's not clear how any of the suggested attacks constitute 'permanent' damage: disabling the transmitter, corrupting the antenna pointing logic, demod, power params can all be solved by reflashing the firmware and FPGAs. Not always simple but possible at least by the manufacturer. One way to really destroy a transmitter is to transmit at full power without an antenna attached. Another is to burn the receiver front end by directing the full transmitter output to the receiver input. If the RF path is configured with software controlled RF switches a hack could burn out the front end circuitry for good. All depends on how permanent we're talking.