Patch against Android Base framework, patched with 4.2 OpenPDroid patches from March 2013. Fixes the Cell Tower bug. Tested with an i9100 / cm10.1. This is probably bad coding style, see https://github.com/wsot/openpdroid_support/issues/1 for details.

gistfile1.diff

diff --git a/services/java/com/android/server/PrivacyTelephonyRegistry.java b/services/java/com/android/server/PrivacyTelephonyRegistry.java
index 36f2d9e..95a3f58 100644
--- a/services/java/com/android/server/PrivacyTelephonyRegistry.java
+++ b/services/java/com/android/server/PrivacyTelephonyRegistry.java
@@ -44,17 +44,25 @@ public class PrivacyTelephonyRegistry extends TelephonyRegistry{
        private static final int PERMISSION_CALL_STATE = 3;
        
        private static final int PERMISSION_SERVICE_STATE = 4;
+
+       private Context _context;
        
        public PrivacyTelephonyRegistry(Context context) {
                super(context);
-               pSetMan = new PrivacySettingsManager(context, IPrivacySettingsManager.Stub.asInterface(ServiceManager.getService("privacy")));
-               try{
-                       registerPrivacy();
-               } catch(Exception e){
-                       Log.e(P_TAG,"failed to register privacy broadcastreceiver");
-               }
+               this._context = context;
                Log.i(P_TAG,"constructor ready");
        }
+
+       private void initialize() {
+               if(ServiceManager.getService("privacy") != null) {
+                       pSetMan = new PrivacySettingsManager(_context, IPrivacySettingsManager.Stub.asInterface(ServiceManager.getService("privacy")));
+                       try{
+                               registerPrivacy();
+                       } catch(Exception e){
+                               Log.e(P_TAG,"failed to register privacy broadcastreceiver");
+                       }
+               }
+       }
        
        /** This broadCastReceiver receives the privacy intent for blocking phonecalls and faking phonestate */
        private final BroadcastReceiver privacyReceiver = new BroadcastReceiver()
@@ -255,6 +263,10 @@ public class PrivacyTelephonyRegistry extends TelephonyRegistry{
        
        
        private boolean isPackageAllowed(int PERMISSION, String packageName){
+               if(pSetMan == null) {
+                       initialize();
+                       if(pSetMan == null) return false;
+               }
                PrivacySettings settings = pSetMan.getSettings(packageName, Process.myUid());
                if(settings == null) return false;
                switch(PERMISSION){