That step above is intended to be run ON THE MODEM, from the first telnet session, rather than on the connected PC.

No idea what the "ping" is in there for, but you can try it both with and without the ping prefix. So, from within the original telnet session, do this command on the modem:

telnetd -l sh -p 9999

This part (below) should not be necessary, as the modem is likely running busybox, and the busybox implementation of telnetd uses lowercase-l:

If that fails to do anything useful, try it again with an uppercase-L instead of lowercase:

telnetd -L sh -p 9999

Say, Stu: coming over for the Cambridge meet? Would love to meet you in person there!