Loading "enabled facility locks" breaks modem on samsung-serranove on MM 1.18

MM 1.18 seems to introduce a regression for the modem on samsung-serranove (Qualcomm MSM8916, supported in postmarketOS). The modem no longer probes successfully and is no longer functional after ModemManager was started. Comparing the logs this seems to be related to new "UIM Get CK Status" messages that were not sent in MM 1.16. After those are sent, the modem returns FAILURE: Internal for all DMS/UIM related commands.

[1645]: [/dev/rpmsg0] Sent message...
<<<<<< RAW:
<<<<<<   length = 17
<<<<<<   data   = 01:10:00:00:02:01:00:0E:00:40:00:04:00:01:01:00:04
[1645]: [/dev/rpmsg0] Sent generic request (translated)...
<<<<<< QMUX:
<<<<<<   length  = 16
<<<<<<   flags   = 0x00
<<<<<<   service = "dms"
<<<<<<   client  = 1
<<<<<< QMI:
<<<<<<   flags       = "none"
<<<<<<   transaction = 14
<<<<<<   tlv_length  = 4
<<<<<<   message     = "UIM Get CK Status" (0x0040)
<<<<<< TLV:
<<<<<<   type       = "Facility" (0x01)
<<<<<<   length     = 1
<<<<<<   value      = 04
<<<<<<   translated = pf
[1645]: [/dev/rpmsg0] Received message...
<<<<<< RAW:
<<<<<<   length = 20
<<<<<<   data   = 01:13:00:80:02:01:02:0E:00:40:00:07:00:02:04:00:01:00:03:00
[1645]: [/dev/rpmsg0] Received generic response (translated)...
<<<<<< QMUX:
<<<<<<   length  = 19
<<<<<<   flags   = 0x80
<<<<<<   service = "dms"
<<<<<<   client  = 1
<<<<<< QMI:
<<<<<<   flags       = "response"
<<<<<<   transaction = 14
<<<<<<   tlv_length  = 7
<<<<<<   message     = "UIM Get CK Status" (0x0040)
<<<<<< TLV:
<<<<<<   type       = "Result" (0x02)
<<<<<<   length     = 4
<<<<<<   value      = 01:00:03:00
<<<<<<   translated = FAILURE: Internal
[1645]: <debug> [000000141.715209] [modem0] couldn't query facility 'ph-sim' status, assuming disabled
[more UIM Get CK Status messages...]
[1645]: <debug> [000000141.728976] [modem0] retrieving PIN status to check for enabled PIN
[1645]: [/dev/rpmsg0] Sent message...
<<<<<< RAW:
<<<<<<   length = 13
<<<<<<   data   = 01:0C:00:00:02:01:00:13:00:2B:00:00:00
[1645]: [/dev/rpmsg0] Sent generic request (translated)...
<<<<<< QMUX:
<<<<<<   length  = 12
<<<<<<   flags   = 0x00
<<<<<<   service = "dms"
<<<<<<   client  = 1
<<<<<< QMI:
<<<<<<   flags       = "none"
<<<<<<   transaction = 19
<<<<<<   tlv_length  = 0
<<<<<<   message     = "UIM Get PIN Status" (0x002B)
[1645]: [/dev/rpmsg0] Received message...
<<<<<< RAW:
<<<<<<   length = 20
<<<<<<   data   = 01:13:00:80:02:01:02:13:00:2B:00:07:00:02:04:00:01:00:03:00
[1645]: [/dev/rpmsg0] Received generic response (translated)...
<<<<<< QMUX:
<<<<<<   length  = 19
<<<<<<   flags   = 0x80
<<<<<<   service = "dms"
<<<<<<   client  = 1
<<<<<< QMI:
<<<<<<   flags       = "response"
<<<<<<   transaction = 19
<<<<<<   tlv_length  = 7
<<<<<<   message     = "UIM Get PIN Status" (0x002B)
<<<<<< TLV:
<<<<<<   type       = "Result" (0x02)
<<<<<<   length     = 4
<<<<<<   value      = 01:00:03:00
<<<<<<   translated = FAILURE: Internal
[everything DMS/UIM related now only returns FAILURE: Internal...]

I thought this might be related to #431 at first, but setting dms_uim_deprecated does not fix the problem. In fact, exactly the same happens after sending the UIM Get Configuration message.

However, removing load_enabled_facility_locks from mm-broadband-modem-qmi.c fixes the problem, which makes it clear that loading these "enabled facility locks" is what causes the regression.

The implementation of load_enabled_facility_locks does not seem new in MM 1.18, but something is now calling this during modem probe time for some reason.

Any ideas? :)