There is a negative-size memcpy (heap overflow) when decoding the body of SIP multipart messages. According to debug strings in the modem image, this functionality is implemented in IMSPL_SipFragDecode.
008713e1403417d96115cab8cea235d3b9c02eefab2c7765ee120627abe0c5b3