int_osx_receive_prim() in gsm-fw/gpf/osx/osx.c: there was an error in the reconstruction of this function from disassembly in the logic that implements special handling for MPHC_RXLEV_REQ messages. The code is now fixed to properly match what the binary object version does; with this fix the firmware now performs the power measurement phase correctly and the initial network registration succeeds.

#include <stdarg.h>

extern void _sprintf_putchar();

int
sprintf(char *strdest, char *fmt, ...)
{
	va_list ap;
	char *strptr;
	int len;

	strptr = strdest;
	va_start(ap, fmt);
	len = _doprnt(fmt, ap, &_sprintf_putchar, &strptr);
	va_end(ap);
	*strptr = '\0';
	return(len);
}