The specs are public from 3gpp2 (https://www.3gpp2.org/). I didn't have to reverse engineer but in the initial RF bringup, even with the specs, it took me a while and had to pick up some old CDMA test equipment to capture actual BTS signals to help me understand it better.
Yeah maybe at some point -- I'd need to learn about all the formal stuff though first, it's new to me. For now it's cocotb test benches and also I run it through the Klaus test (https://github.com/Klaus2m5/6502_65C02_functional_tests) which is pretty comprehensive. There are definitely edge cases though that I found when actually running it on physical hardware that my tests didn't find (i.e ran into some IRQ servicing issues), so not easy to be 100%.