+
−There are 4 test points accessible from the battery compartment under the
+
−SIM card slot.  I shall number them as follows:
+
−
+
−	B
+
−	A (battery connector)
+
−	T
+
−
+
−+-----+
+
−|     |
+
−| SIM |
+
−|     |
+
−+-----+
+
−1 2 3 4
+
−
+
−i.e., the test point closest to the headset jack shall be numbered 4.
+
−
+
−TP 1 and TP 2 have tiny vias inside the TP pads themselves; these vias
+
−appear to go no deeper than L2.
+
−
+
−TP 1: on L2 it crosses over the tiny via coming from L1 to a larger via
+
−that penetrates almost the entire layer stack.  On L7 the latter via
+
−connects to a trace.  The latter trace runs at normal signal thickness
+
−until it hits yet another via.  On the other side of that via, still on
+
−the same L7, there is a dead-end arm of what appears to be the same net,
+
−and the latter arm is thick - almost as if it acts as an antenna of
+
−some kind.  From there the connections are unclear, but it appears to
+
−connect a bunch of fat traces and possibly even copper fill on other
+
−layers, so it's unlikely to be an interesting signal.
+
−
+
−TP 2: on L2 it goes to a trace, that trace goes to another via at image
+
−coords (4378,1746).
+
−
+
−TP 3 connects to a via; that via appears to make a solid connection to
+
−the copper flood-fill on L6.
+
−
+
−TP 4 is connected to the L1 GND copper fill with thermals.