====== Connectivity: modem vs TBox ======

  * A **Quectel LTE module** enumerates on the head unit's USB bus, **but Android does not run the
    cellular stack** — there are no modem serial/QMI ports. It only uses a **''cdc_ether'' link
    (''usb0'')** as a DHCP client.
  * So Android is just a **client behind a router-modem = the TBox**. The TBox holds the modem +
    SIM, is **always-on** (the head unit suspends to RAM when the car is locked), and is the
    **secure CAN gateway**. That is why OEM remote climate went ''cloud → TBox → CAN'', never
    touching the sleeping head unit.

===== The TBox =====

Reached on the ''usb0'' peer link. Open ports found: **21** (FTP, authentication required —
anonymous refused), **53** (DNS/dnsmasq), **50000** (a binary telematics protocol).

The head-unit ↔ TBox link on port **50000** was reverse-engineered and found to carry only
**telephony / eCall / B-call** signalling (call state, network type, signal strength). **It carries
no vehicle control.** Remote climate/charge logic lives //inside// the TBox firmware, on the
internal CAN bus — which is exactly why it keeps working while the head unit sleeps.

**Practical gotcha:** the TBox link collides on the same ''192.168.1.x'' subnet as a typical home
router, which can break reply routing. Put the home network on a different subnet to reach the car
reliably over Wi-Fi.