Memory corruptions in cellular basebands are critical because they can be remotely exploited over-the-air, resulting in severe consequences such as remote code execution, denial of service, and information leakage. While previous research has made significant contributions to detecting memory corruptions in basebands, particularly in layer 3 protocols (e.g., NAS and RRC), the lower layers have received comparatively less attention, with only a few works exploring them in a limited and non-systematic manner.