1. Which is the BlackBerry push bearer? E-mail pushes come to the device through WAP, GPRS or something else?
2. Do the first 2KB of a message travel together with the push notification?
Forget SMS or IP. You're thinking SMS from a phone standpoint and IP from a computing stand point, neither are relevent here. When an email leaves the BES server it gets thrown over GPRS to the device PIN. Effectively the packets of data are travelling through the wireless carriers specific APN for the BlackBerry service to the device PIN.