ensure_internal_ports():

    *dup_ports = g_malloc (sizeof (MMModemPortInfo) * self->priv->ports->len);
    memcpy (*dup_ports, self->priv->ports->data, sizeof (MMModemPortInfo) * self->priv->ports->len);

Unfortunately, self->priv->ports is a GArray of MMModemPortInfo structures, which have the layout:

struct _MMModemPortInfo {
    gchar *name;
    MMModemPortType type;
};

ensure_internal_ports() only shallow-copies the structures, and fails to copy the 'name' item to the duplicated array.  This means that mm_modem_port_info_array_free() actually frees the port names held internally by the MMModem object, and leads to use-after-free if you call mm_modem_get_ports() more than once.