RIL, audio, wifi and accelerometer, to name a few. Additionaly, the entire radio stack is also closed source (it is outside the OS - it runs on separate CPU, is stored separately in ROM and RIL communicates with it using shared memory).