...IIRC, there is an UART debug line that can be used to talk to the modem directly. On Nexus S, the ttyFIQ0 node was related to UART. Maybe you can route the modem to ttyFIQ0 by dealing with /sys/class/sec/uart_switch/UART_SEL/value Important fact: note this on Galaxy S2...