int_osx_receive_prim() in gsm-fw/gpf/osx/osx.c: there was an error in the reconstruction of this function from disassembly in the logic that implements special handling for MPHC_RXLEV_REQ messages. The code is now fixed to properly match what the binary object version does; with this fix the firmware now performs the power measurement phase correctly and the initial network registration succeeds.

#include <stdarg.h>

int
vsprintf(str, fmt, ap)
	va_list ap;
	char *str, *fmt;
{
	char *strptr;
	int len;

	strptr = str;
	len = _doprnt(fmt, ap, &strptr);
	*strptr = '\0';
	return(len);
}