There are 4 test points accessible from the battery compartment under the
SIM card slot.  I shall number them as follows:

	B
	A (battery connector)
	T

+-----+
|     |
| SIM |
|     |
+-----+
1 2 3 4

i.e., the test point closest to the headset jack shall be numbered 4.

TP 1 and TP 2 have tiny vias inside the TP pads themselves; these vias
appear to go no deeper than L2.

TP 1: on L2 it crosses over the tiny via coming from L1 to a larger via
that penetrates almost the entire layer stack.  On L7 the latter via
connects to a trace.  The latter trace runs at normal signal thickness
until it hits yet another via.  On the other side of that via, still on
the same L7, there is a dead-end arm of what appears to be the same net,
and the latter arm is thick - almost as if it acts as an antenna of
some kind.  From there the connections are unclear, but it appears to
connect a bunch of fat traces and possibly even copper fill on other
layers, so it's unlikely to be an interesting signal.

TP 2: on L2 it goes to a trace, that trace goes to another via at image
coords (4378,1746).

TP 3 connects to a via; that via appears to make a solid connection to
the copper flood-fill on L6.

TP 4 is connected to the L1 GND copper fill with thermals.