There exists FOSS that could do this too (start with "osmocombb").

But the real problem here isn't technical, it's a business/legal issue: the carriers and their regulators are trying to minimize (or at least, reduce) the ability for bad actors to operate large numbers of "cell phones" at minimal cost/complexity.

So everything that could be done (technically) to make this work is, in practice, prevented by those business/legal considerations.

> osmocombb

Open source stacks are already or basically on the verge of being obsolete in most of the world's telco networks if you want to actually use them. They are incredibly cool and a huge undertaking but no one is saying they are practical for actual usage, and that's ignoring the clear illegality of broadcasting with such firmware.

Osmocom and others like FreeCalypso only work on very old devices with TI Calypso chipsets.

But in this context, I think the supported devices don't matter: the idea is to interface with one-or-more telcos directly at a higher level of the 3GPP stack?

You won't need the air interface - hypothetically just an appropriately rooted femtocell, carrier HSS/HLR/MME that can authn/authz you, and Asterisk server that is secure. Or a flooded Nokia Flexi on a rack shelf, I mean, they look cool, don't they...