diff --git a/tests/gb/gprs_ns_test.c b/tests/gb/gprs_ns_test.c
index d56bf9a..ad8e6d5 100644
--- a/tests/gb/gprs_ns_test.c
+++ b/tests/gb/gprs_ns_test.c
@@ -791,6 +791,69 @@
 	nsi = NULL;
 }
 
+static void test_sgsn_reset_invalid_state()
+{
+	struct gprs_ns_inst *nsi = gprs_ns_instantiate(gprs_ns_callback, NULL);
+	struct sockaddr_in sgsn_peer= {0};
+	struct gprs_nsvc *nsvc;
+	int retry;
+	uint8_t dummy_sdu[] = {0x01, 0x02, 0x03, 0x04};
+
+	sgsn_peer.sin_family = AF_INET;
+	sgsn_peer.sin_port = htons(32000);
+	sgsn_peer.sin_addr.s_addr = htonl(REMOTE_SGSN_ADDR);
+
+	gprs_dump_nsi(nsi);
+
+	printf("=== %s ===\n", __func__);
+	printf("--- Setup SGSN connection, BSS -> SGSN ---\n\n");
+
+	gprs_ns_nsip_connect(nsi, &sgsn_peer, SGSN_NSEI, SGSN_NSEI+1);
+	OSMO_ASSERT(sent_pdu_type == NS_PDUT_RESET);
+	send_ns_reset_ack(nsi, &sgsn_peer, SGSN_NSEI+1, SGSN_NSEI);
+	OSMO_ASSERT(sent_pdu_type == NS_PDUT_ALIVE);
+	send_ns_alive_ack(nsi, &sgsn_peer);
+	OSMO_ASSERT(sent_pdu_type == NS_PDUT_UNBLOCK);
+	send_ns_unblock_ack(nsi, &sgsn_peer);
+	gprs_dump_nsi(nsi);
+	nsvc = gprs_nsvc_by_nsvci(nsi, SGSN_NSEI+1);
+	OSMO_ASSERT(nsvc->state == NSE_S_ALIVE);
+	OSMO_ASSERT(nsvc->remote_state == NSE_S_ALIVE);
+
+	printf("--- Time out local test procedure ---\n\n");
+
+	OSMO_ASSERT(expire_nsvc_timer(nsvc) == NSVC_TIMER_TNS_TEST);
+	OSMO_ASSERT(expire_nsvc_timer(nsvc) == NSVC_TIMER_TNS_ALIVE);
+
+	for (retry = 1; retry <= nsi->timeout[NS_TOUT_TNS_ALIVE_RETRIES]; ++retry)
+		OSMO_ASSERT(expire_nsvc_timer(nsvc) == NSVC_TIMER_TNS_ALIVE);
+
+	OSMO_ASSERT(nsvc->state == NSE_S_BLOCKED);
+
+	printf("--- Remote test procedure continues ---\n\n");
+
+	send_ns_alive(nsi, &sgsn_peer);
+	OSMO_ASSERT(sent_pdu_type == NS_PDUT_RESET);
+
+	printf("--- Don't send a NS_RESET_ACK message (pretend it is lost) ---\n\n");
+
+	sent_pdu_type = -1;
+	send_ns_alive(nsi, &sgsn_peer);
+	/* Disabled, since it is not yet fixed
+	OSMO_ASSERT(sent_pdu_type == -1);
+	send_ns_reset_ack(nsi, &sgsn_peer, SGSN_NSEI+1, SGSN_NSEI);
+	OSMO_ASSERT(sent_pdu_type == NS_PDUT_ALIVE);
+	send_ns_alive_ack(nsi, &sgsn_peer);
+	OSMO_ASSERT(sent_pdu_type == NS_PDUT_UNBLOCK);
+	send_ns_unblock_ack(nsi, &sgsn_peer);
+	*/
+
+	send_ns_unitdata(nsi, &sgsn_peer, 0x1234, dummy_sdu, sizeof(dummy_sdu));
+
+	gprs_ns_destroy(nsi);
+	nsi = NULL;
+}
+
 static void test_sgsn_output()
 {
 	struct gprs_ns_inst *nsi = gprs_ns_instantiate(gprs_ns_callback, NULL);
@@ -875,6 +938,7 @@
 	test_bss_port_changes();
 	test_bss_reset_ack();
 	test_sgsn_reset();
+	test_sgsn_reset_invalid_state();
 	test_sgsn_output();
 	printf("===== NS protocol test END\n\n");
 
diff --git a/tests/gb/gprs_ns_test.ok b/tests/gb/gprs_ns_test.ok
index 0d4b7fb..66b1dbb 100644
--- a/tests/gb/gprs_ns_test.ok
+++ b/tests/gb/gprs_ns_test.ok
@@ -722,6 +722,105 @@
 
 Current NS-VCIs:
 
+=== test_sgsn_reset_invalid_state ===
+--- Setup SGSN connection, BSS -> SGSN ---
+
+MESSAGE to SGSN, msg length 12
+02 00 81 01 01 82 01 01 04 82 01 00 
+
+PROCESSING RESET_ACK from 0x05060708:32000
+03 01 82 01 01 04 82 01 00 
+
+MESSAGE to SGSN, msg length 1
+0a 
+
+result (RESET_ACK) = 1
+
+PROCESSING ALIVE_ACK from 0x05060708:32000
+0b 
+
+MESSAGE to SGSN, msg length 1
+06 
+
+result (ALIVE_ACK) = 1
+
+PROCESSING UNBLOCK_ACK from 0x05060708:32000
+07 
+
+==> got signal NS_UNBLOCK, NS-VC 0x0101/5.6.7.8:32000
+result (UNBLOCK_ACK) = 0
+
+Current NS-VCIs:
+    VCI 0x0101, NSEI 0x0100, peer 0x05060708:32000
+         NS-VC Block count         : 1
+
+--- Time out local test procedure ---
+
+MESSAGE to SGSN, msg length 1
+0a 
+
+MESSAGE to SGSN, msg length 1
+0a 
+
+MESSAGE to SGSN, msg length 1
+0a 
+
+MESSAGE to SGSN, msg length 1
+0a 
+
+MESSAGE to SGSN, msg length 1
+0a 
+
+MESSAGE to SGSN, msg length 1
+0a 
+
+MESSAGE to SGSN, msg length 1
+0a 
+
+MESSAGE to SGSN, msg length 1
+0a 
+
+MESSAGE to SGSN, msg length 1
+0a 
+
+MESSAGE to SGSN, msg length 1
+0a 
+
+MESSAGE to SGSN, msg length 1
+0a 
+
+==> got signal NS_ALIVE_EXP, NS-VC 0x0101/5.6.7.8:32000
+==> got signal NS_BLOCK, NS-VC 0x0101/5.6.7.8:32000
+--- Remote test procedure continues ---
+
+PROCESSING ALIVE from 0x05060708:32000
+0a 
+
+MESSAGE to SGSN, msg length 12
+02 00 81 0a 01 82 01 01 04 82 01 00 
+
+result (ALIVE) = 12
+
+--- Don't send a NS_RESET_ACK message (pretend it is lost) ---
+
+PROCESSING ALIVE from 0x05060708:32000
+0a 
+
+MESSAGE to SGSN, msg length 1
+0b 
+
+result (ALIVE) = 1
+
+PROCESSING UNITDATA from 0x05060708:32000
+00 00 12 34 01 02 03 04 
+
+MESSAGE to SGSN, msg length 8
+08 00 81 03 01 82 01 01 
+
+result (UNITDATA) = 8
+
+Current NS-VCIs:
+
 --- Send message to SGSN ---
 
 SENDING BSSGP RESET to NSEI 0x0100, BVCI 0x0000