Hello,

Me and my friend bought cryptophones at the start of this year because we're stupid with money like that and we didn't have the patience to wait for the Neo900 (he's gonna get one too though, I would too but my finances aren't in a state to support it...).
I can answer any questions you might have about them to the best of my ability.
We got GSMK CryptoPhone 500's, they have actually 2 firewalls, an IP and a baseband one. The baseband firewall seems to be related to what you're ideating for Neo900, it keeps watch of the modem and inconsistencies between its and the OS's activity. The IP firewall at least kept preventing me from establishing a connection to a meterpreter shell I installed on the phone. When I was traveling in Norway at one point the baseband firewall started warning about IMSI-catchers or something of the sort, I assume this was related to the NATO military bases there
The phones have a variety of other features but my short summary of them would be a overly expensive gadget marketed for governments.