Is there any way I can log/sniff the GSM packets on a (rooted) HTC Desire ?
(I'm talking about the actual low level GSM packets on the Um interface, not IP packets over a 3g connection.)
Try OpenBTS. You'll need a Faraday cage and a couple thousand dollars in hardware, but you can control all interactions between the phone and your base station.
You will need a license to run a base station outside of a Faraday cage.
Harald Welte's blog is a good one to follow if you're interested in GSM as a low-level protocol.
The "SMS of death" presentation at Chaos Computer Club one year used this sort of setup to test SMS buffer overflows.