LTESniffer: An Open-Source LTE Downlink/Uplink Eavesdropper

Too bad the hardware for this is eyewateringly expensive :'(

True? How are phone modems inexpensive?

I'm wondering the same thing.

Can someone outline the architectural limitations of using a smartphone modem for such network debugging/sniffing tasks?

Smartphone modems (baseband) are super optimised for battery life. They don't send any traffic that isn't meant for the device itself on to the CPU. That would only cause unnecessary load.

They could perhaps be modified to do that but the baseband firmware is usually very closed source.

There is only one example I know, there was one particular dumbphone from the 2G era for which the baseband sourcecode was available due to a hack. You could use several (one for uplink and one for downlink) of these with modified firmware to sniff 2G traffic. I forget which model it was exactly but obviously the price ballooned on eBay :)

Haven't heard of this happening with later models. Baseband sourcecode firmware is really rare.

You may be thinking about the Motorola C123. Back in the days, you could use it to dump TMSI and IMSI using OsmoconBB : https://osmocom.org/projects/baseband/wiki/MotorolaC123