With the latest update to ITAR rules, it looks like covered GNSS receivers are defined as follows:
(2) Global Navigation Satellite System (GNSS) receiving equipment, as follows:
(i) GNSS receiving equipment specially designed for military applications (MT if designed or modified for airborne applications and capable of providing navigation information at speeds in excess of 600 m/s);
(ii) Global Positioning System (GPS) receiving equipment specially designed for encryption or decryption (e.g., Y-Code, M-Code) of GPS precise positioning service (PPS) signals (MT if designed or modified for airborne applications);
(iii) GNSS receiving equipment specially designed for use with an antenna described in Category XI(c)(10) (MT if designed or modified for airborne applications); or
(iv) GNSS receiving equipment specially designed for use with rockets, missiles, SLVs, drones, or unmanned air vehicle systems capable of delivering at least a 500 kg payload to a range of at least 300 km (MT);
NB: MT is an abbreviation for Missile Technology (Control Regime)
Do open source software defined GPS receivers fall under these laws? In particular, point 2.i is quite worrying: while they are probably not specifically designed for airborne applications, I think they probably are capable of working airborne, and they can certainly produce a position fix at speeds in excess of 600 m/s.