int_osx_receive_prim() in gsm-fw/gpf/osx/osx.c: there was an error in the reconstruction of this function from disassembly in the logic that implements special handling for MPHC_RXLEV_REQ messages. The code is now fixed to properly match what the binary object version does; with this fix the firmware now performs the power measurement phase correctly and the initial network registration succeeds.

/*
 * Handling of TMFFS2 responses from ETM
 */

#include <sys/types.h>
#include <stdio.h>

extern u_char rvi_msg[];
extern int rvi_msg_len;

void
handle_ffs2_response()
{
	if (rvi_msg[3])
		print_etm_pkt_raw("FFS2 error");
	else if (rvi_msg_len == 5)
		async_msg_output("FFS2 command successful");
	else
		print_etm_pkt_raw("FFS2 response");
}