[Sprint Samsung Galaxy S III] crayoncrawler:
Posting my results after fixing the problem where MMS comes in as random symbols from the number 9999999999.

Background: I flashed a Sprint Galaxy S3 over to VM. I was able to get voice, SMS, and data working, and even MMS sending, but the only problem was receiving MMS. Not sure how helpful this is since the simpler solution would probably be to flash a custom ROM where the fix is implemented already. I decided to take the hard way and patch the smali code manually

Reference solution implementation in CdmaSMSDispatcher.java: http://review.cyanogenmod.org/#/c/31229/1/src/java/com/android/internal/telephony/cdma/CdmaSMSDispatcher.java

Steps:

1) Decompile odex where CdmaSMSDispatcher.java is located. In my case, it was in /system/framework/telephony-common.odex

2) Edit CdmaSMSDispatcher.smali. Details below.

3) Recompile into odex and push to phone

Guide to deodex and reodex: http://xdaforums.com/galaxy-s2/themes-apps/how-to-manually-deodex-odex-t1208320

Smali details: Looking at the reference Java code, the first thing we want to do is to find where dispatchNormalMessage is called so we can insert our patch right above it.

In my case, it looked like this:

.line 456
.end local v2 # "phoneRestriction":Landroid/sec/enterprise/PhoneRestrictionPolicy;
.end local v8 # "e":Ljava/lang/Exception;
:cond_2c0
invoke-virtual/range {p0 .. p1}, Lcom/android/internal/telephony/SMSDispatcher;->dispatchNormalMessage(Lcom/android/internal/telephony/SmsMessageBase;)I

move-result v3

goto/16 :goto_a

Now we can apply our fix here. Compared with the actual implementation in CM, I only chose the most important lines, since coding in smali is pretty annoying.

Updated section:

:end_patch

invoke-virtual/range {p0 .. p1}, Lcom/android/internal/telephony/SMSDispatcher;->dispatchNormalMessage(Lcom/android/internal/telephony/SmsMessageBase;)I

move-result v3
goto/16 :goto_a

.line 456
.end local v2 # "phoneRestriction":Landroid/sec/enterprise/PhoneRestrictionPolicy;
.end local v8 # "e":Ljava/lang/Exception;
:cond_2c0

invoke-virtual {v14}, Lcom/android/internal/telephony/SmsMessageBase;->getOriginatingAddress()Ljava/lang/String;

move-result-object v1

const-string v5, "9999999999"

invoke-virtual {v1, v5}, Ljava/lang/String;->equals(Ljava/lang/Object;)Z
move-result v1

if-eqz v1, :end_patch

:try_start_2z

const/4 v1, 0x1
new-array v7, v1, [I #v7, aMessageRef

invoke-virtual {v14}, Lcom/android/internal/telephony/SmsMessageBase;->getUserData()[B
move-result-object v1 #v1, someEncodedMMSData

new-instance v6, Lcom/android/internal/util/BitwiseInputStream; #v6, ourInputStream
invoke-direct {v6, v1}, Lcom/android/internal/util/BitwiseInputStream;-><init>([B)V

const/16 v4, 0x14
invoke-virtual {v6, v4}, Lcom/android/internal/util/BitwiseInputStream;->skip(I)V

const/16 v4, 0x8
invoke-virtual {v6, v4}, Lcom/android/internal/util/BitwiseInputStream;->read(I)I
move-result v10

shl-int/lit8 v11, v10, 0x8 #v11, int j

invoke-virtual {v6, v4}, Lcom/android/internal/util/BitwiseInputStream;->read(I)I

move-result v9 #v9, int k

const/4 v4, 0x0
or-int v12, v10, v9 #aMessageRef[0] = j | k;
aput v12, v7, v4

const v12, 0xC
invoke-virtual {v6, v12}, Lcom/android/internal/util/BitwiseInputStream;->skip(I)V

const v12, 0x8
invoke-virtual {v6, v12}, Lcom/android/internal/util/BitwiseInputStream;->read(I)I
move-result v13

const v12, 0x2
sub-int v13, v13, v12 #v13, i1

const v12, 0xD
invoke-virtual {v6, v12}, Lcom/android/internal/util/BitwiseInputStream;->skip(I)V

const v12, 0x8
mul-int v13, v13, v12 #v13, desiredBitLength

invoke-virtual {v6, v13}, Lcom/android/internal/util/BitwiseInputStream;->readByteArray(I)[B
move-result-object v15 #v15, ret[]

const v3, 0x0
aget v10, v7, v3

const-string v5, "9999999999"
invoke-virtual {v0, v15, v10, v5}, Lcom/android/internal/telephony/cdma/CdmaSMSDispatcher;->processCdmaWapPdu([BILjava/lang/String;)I

move-result v3

:try_end_2z
.catch Ljava/lang/Exception; {:try_start_2z .. :try_end_2z} :catch_2z

goto/16 :goto_a

:catch_2z
move-exception v3
goto :end_patch

.end method

So that's all there is! I probably could have been more efficient with the registers but I'm just glad it works after spending more than a week on this.

Again, I don't think this will apply for many people, but is an option if someone wants to do the MMS fix without having a flash a custom ROM.