• A Quectel LTE module enumerates on the head unit's USB bus, but Android does not run the cellular stack — there are no modem serial/QMI ports. It only uses a cdc_ether link (usb0) as a DHCP client.
• So Android is just a client behind a router-modem = the TBox. The TBox holds the modem +

SIM, is always-on (the head unit suspends to RAM when the car is locked), and is the

• *secure CAN gateway**. That is why OEM remote climate went cloud → TBox → CAN, never

touching the sleeping head unit.

Reached on the usb0 peer link. Open ports found: 21 (FTP, authentication required — anonymous refused), 53 (DNS/dnsmasq), 50000 (a binary telematics protocol).

The head-unit ↔ TBox link on port 50000 was reverse-engineered and found to carry only telephony / eCall / B-call signalling (call state, network type, signal strength). It carries no vehicle control. Remote climate/charge logic lives inside the TBox firmware, on the internal CAN bus — which is exactly why it keeps working while the head unit sleeps.

Practical gotcha: the TBox link collides on the same 192.168.1.x subnet as a typical home router, which can break reply routing. Put the home network on a different subnet to reach the car reliably over Wi-Fi.