Making some progress today.
I found a message in the kernel log that indicated rild was trying to start service pppd_gprs1 but didn't have permission. The service start permissions are hardcoded in the init source, and I don't see how to change that.
Additionally, I was mistaken when I said that my init binary worked before. So I was feeling pretty screwed.
Finally I tracked down the issue with my init. It was my own stupid mistake that caused it not to work. Protip: make sure your debugging code doesn't crash the program!
Anyway, so I added permission for rild to start pppd_gprs1 and now pppd is launching. But it won't stay up, because there is some miscommunication and/or missing data in the SETUP_DATA_CALL response. The result is this in the radio log:
D/RILJ ( 1670): [0038]< SETUP_DATA_CALL DataCallState: {version=3 status=0 retry=-1 cid=0 active=0 type='' ifname='ppp0' addresses=[] dnses=[] gateways=[]}
D/CDMA ( 1670): [CdmaDC-1] DcActivatingState msg.what=EVENT_SETUP_DATA_CONNECTION_DONE
D/CDMA ( 1670): [CdmaDC-1] onSetupConnectionCompleted received DataCallState: DataCallState: {version=3 status=0 retry=-1 cid=0 active=0 type='' ifname='ppp0' addresses=[] dnses=[] gateways=[]}
D/GSM ( 1670): setLinkProperties: UnknownHostException java.net.UnknownHostException: no address for ifname=ppp0
D/RILC ( 1367): RIL onRequestComplete: free
D/CDMA ( 1670): [CdmaDCT] notifyOffApnsOfAvailability - reason= null
D/RILB ( 1670): getLteOnCdmaMode=0 curVal=-1 product_type='' lteOnCdmaProductType=''
D/CDMA ( 1670): [CdmaSST] getOtasp: state=3
D/GSM ( 1670): setLinkProperties: error clearing LinkProperties status=0 result=ERR_UnacceptableParameter SetupResult.mFailCause=NONE
D/CDMA ( 1670): [CdmaDC-1] updateLinkProperty failed : ERR_UnacceptableParameter SetupResult.mFailCause=NONE
D/CDMA ( 1670): [CdmaDC-1] DcActivatingState onSetupConnectionCompleted result=ERR_UnacceptableParameter SetupResult.mFailCause=NONE
D/CDMA ( 1670): [CdmaDC-1] tearDownData radio is on, call deactivateDataCall
But the main log clearly shows that pppd is firing up properly:
I/pppd ( 2686): Starting pppd for cid=1
I/pppd ( 2688): pppd options in effect:
I/pppd ( 2688): debug # (from command line)
I/pppd ( 2688): nodetach # (from command line)
I/pppd ( 2688): connect-delay 10000 # (from command line)
I/pppd ( 2688): dump # (from command line)
I/pppd ( 2688): /dev/pts4 # (from command line)
I/pppd ( 2688): 115200 # (from command line)
I/pppd ( 2688): mru 1472 # (from command line)
I/pppd ( 2688): mtu 1472 # (from command line)
I/pppd ( 2688): ipcp-accept-local # (from command line)
I/pppd ( 2688): ipcp-accept-remote # (from command line)
I/pppd ( 2688): ipparam 1 # (from command line)
I/pppd ( 2688): usepeerdns # (from command line)
D/pppd ( 2688): using channel 1
I/pppd ( 2688): Using interface ppp0
I/pppd ( 2688): Connect: ppp0 <--> /dev/pts4
D/pppd ( 2688): sent [LCP ConfReq id=0x1 <mru 1472> <asyncmap 0x0> <magic 0xe33e81f1> <pcomp> <accomp>]
D/pppd ( 2688): rcvd [LCP ConfReq id=0x0 <asyncmap 0x0> <magic 0x59b3685a> <pcomp> <accomp>]
D/pppd ( 2688): sent [LCP ConfAck id=0x0 <asyncmap 0x0> <magic 0x59b3685a> <pcomp> <accomp>]
D/pppd ( 2688): rcvd [LCP ConfRej id=0x1 <mru 1472>]
D/pppd ( 2688): sent [LCP ConfReq id=0x2 <asyncmap 0x0> <magic 0xe33e81f1> <pcomp> <accomp>]
D/pppd ( 2688): rcvd [LCP ConfAck id=0x2 <asyncmap 0x0> <magic 0xe33e81f1> <pcomp> <accomp>]
D/pppd ( 2688): sent [CCP ConfReq id=0x1 <deflate 15> <deflate(old#) 15> <bsd v1 15>]
D/pppd ( 2688): sent [IPCP ConfReq id=0x1 <compress VJ 0f 01> <addr 0.0.0.0> <ms-dns1 0.0.0.0> <ms-dns3 0.0.0.0>]
D/pppd ( 2688): rcvd [LCP DiscReq id=0x2 magic=0x59b3685a]
D/pppd ( 2688): rcvd [IPCP ConfReq id=0x0 <addr 66.1.0.193>]
D/pppd ( 2688): sent [IPCP ConfAck id=0x0 <addr 66.1.0.193>]
D/pppd ( 2688): rcvd [LCP ProtRej id=0x3 80 fd 01 01 00 0f 1a 04 78 00 18 04 78 00 15 03 2f]
D/pppd ( 2688): rcvd [IPCP ConfNak id=0x1 <addr 28.205.92.91> <ms-dns1 66.1.0.133> <ms-dns3 66.1.0.132>]
D/pppd ( 2688): sent [IPCP ConfReq id=0x2 <compress VJ 0f 01> <addr 28.205.92.91> <ms-dns1 66.1.0.133> <ms-dns3 66.1.0.132>]
D/pppd ( 2688): rcvd [IPCP ConfAck id=0x2 <compress VJ 0f 01> <addr 28.205.92.91> <ms-dns1 66.1.0.133> <ms-dns3 66.1.0.132>]
I/pppd ( 2688): local IP address 28.205.92.91
I/pppd ( 2688): remote IP address 66.1.0.193
I/pppd ( 2688): primary DNS address 66.1.0.133
I/pppd ( 2688): secondary DNS address 66.1.0.132
D/pppd ( 2688): Script /etc/ppp/ip-up started (pid 2697)
I/pppd ( 2713): ip_up: cid=1 iface=ppp0 ip=28.205.92.91 remote=66.1.0.193 dns1=66.1.0.133 dns2=66.1.0.132
D/pppd ( 2688): Script /etc/ppp/ip-up finished (pid 2697), status = 0x0