The reason it wasn't working so far is that the baseband firmware appears have a compile-time white-list of AT commands for which the AT command forwarding is permitted. Any other commands are rejected with error 48 (invalid argument) :/