My apologies for the blank message which went out a moment ago; that was a mis-click on the send button. I have found that the PCS1900 support on this C123 is sufficient to run the phone as a BTS using layer23/transceiver (with some code edits). PCS1900-only handsets in the same room can connect and exchange SMS/USSD messages when the C123 is operated in this manner. Using layer23/mobile, the C123 sees a PCS1900 control channel. When I try to camp on that channel, the host (PC) side of layer23/mobile segfaults, and I have not yet attempted to debug this. But it seems reasonable to expect that the phone would be able to camp on that cell were it not for whatever is making it crash. For what it's worth, on a standard PCS1900 phone, this particular control channel in the location where I am testing shows an RSSI somewhere between -87 and -97 dBm. On the C123 running layer23/mobile, it is usually closer to -97 dBm, but it seems like there should be more attenuation than that if it was passing through an imperfect 1800 MHz filter (at least, I would think). Another thing I intend to try (if I can) is to change the C123's menu language from Chinese to English, and then see if its built-in software can camp on the PCS1900 cell in question. Cheers, Rusty D