Here are a few possibilities I've come across:

* OsmocomBB (http://bb.osmocom.org/trac/)

* An old HN discussion: https://news.ycombinator.com/item?id=7064187

* OKL4, a hypervisor, is used widely in basebands. AFAICT It was developed by Open Kernel Labs and was open. It seems to have been acquired by General Dynamics and I don't know it's current status (does anyone know more about it?) (https://gdmissionsystems.com/cyber/products/trusted-computin...)

Oh, they cannot prevent you from installing the firmware… but if anyone catches you using it in the wild, you're in deep REDACTED.

E.g., If you're worried about the police monitoring your communications, giving them a perfectly legal reason to detain you is likely not your preferred course of action.

In this case we're not really worried about police monitoring. The police aren't magical, yet. If they're trying to surveil without the target's knowledge, and the first attempt fails, they'll try something else. If no electronic surveillance works, they'll find another way to investigate, or they'll prioritize other investigations. They really have no way to catch random people with unauthorized firmware, so long as that firmware generally follows FCC guidelines.

However it may be that other, less Constitutionally-constrained parties would have the ability to dragnet for nonstandard firmware to highlight people for more intense scrutiny. The police could use a parallel construction based on that. Then they could say that unauthorized firmware on a seized phone establishes some sort of criminal intent.

Sure, but assuming there isn't a serious bug in the baseband causing other spectrum users grief, how likely is it that someone will check your phone's baseband for tampering?

If you're a person of interest, the police can come up with a better reason to detain you than this.