diff --git a/src/db_hlr.c b/src/db_hlr.c
index d1bb7b8..b800c0b 100644
--- a/src/db_hlr.c
+++ b/src/db_hlr.c
@@ -662,7 +662,7 @@
 
 	for (i = 0; i < rat_types_len; i++) {
 		char *pos = rat_types_str + strnlen(rat_types_str, sizeof(rat_types_str));
-		int len = pos - rat_types_str;
+		int len = sizeof(rat_types_str) - (pos - rat_types_str);
 		rc = snprintf(pos, len, "%s%s", pos == rat_types_str ? "" : ",", osmo_rat_type_name(rat_types[i]));
 		if (rc > len) {
 			osmo_strlcpy(rat_types_str + sizeof(rat_types_str) - 4, "...", 4);
diff --git a/src/hlr_ussd.c b/src/hlr_ussd.c
index 727a6ce..7ef72a4 100644
--- a/src/hlr_ussd.c
+++ b/src/hlr_ussd.c
@@ -325,23 +325,27 @@
 			       const struct ss_request *req)
 {
 	struct hlr_subscriber subscr;
-	const char *response;
+	char response[512];
 	int rc;
-
-#define RAN_TYPE_DESC "Available RAN types: "
-#define RAN_TYPE_HINT " (experimental 3G: to enable dial *#301# -- to disable dial *#300#)"
+	const char *rat;
 
 	rc = db_subscr_get_by_imsi(g_hlr->dbc, ss->imsi, &subscr);
 	switch (rc) {
 	case 0:
-		if (subscr.rat_types[OSMO_RAT_GERAN_A] && subscr.rat_types[OSMO_RAT_UTRAN_IU])
-			response = RAN_TYPE_DESC "GERAN-A (2G) & UTRAN-Iu (3G)" RAN_TYPE_HINT;
-		else if (subscr.rat_types[OSMO_RAT_GERAN_A])
-			response = RAN_TYPE_DESC "GERAN-A (2G)" RAN_TYPE_HINT;
-		else if (subscr.rat_types[OSMO_RAT_UTRAN_IU])
-			response = RAN_TYPE_DESC "UTRAN-Iu (3G)" RAN_TYPE_HINT;
+		if (!*subscr.last_lu_rat)
+			rat = "nothing, you don't exist";
+		else if (!strcmp(subscr.last_lu_rat, "GERAN-A"))
+			rat = "2G";
+		else if (!strcmp(subscr.last_lu_rat, "UTRAN-Iu"))
+			rat = "3G";
 		else
-			response = "No RAN types available";
+			rat = subscr.last_lu_rat;
+
+		snprintf(response, sizeof(response),
+			 "Now on %s. Available:%s%s."
+			 " (enable 3G: *#301#  disable 3G: *#300#)", rat,
+			 subscr.rat_types[OSMO_RAT_GERAN_A]? " 2G" : "",
+			 subscr.rat_types[OSMO_RAT_UTRAN_IU]? " 3G" : "");
 
 		rc = ss_tx_ussd_7bit(ss, true, req->invoke_id, response);
 		break;
diff --git a/tests/db/db_test.c b/tests/db/db_test.c
index 81ff312..bb6a644 100644
--- a/tests/db/db_test.c
+++ b/tests/db/db_test.c
@@ -159,6 +159,7 @@
 		Pfo(lmsi, "0x%x", subscr);
 	Pb(true, ms_purged_cs);
 	Pb(true, ms_purged_ps);
+	Ps(last_lu_rat);
 	fprintf(stderr, "}\n");
 #undef Ps
 #undef Pd
@@ -212,6 +213,7 @@
 static const char *imsi2 = "123456789000002";
 static const char *short_imsi = "123456";
 static const char *unknown_imsi = "999999999";
+static const enum osmo_rat_type rat_types[2] = { OSMO_RAT_GERAN_A, OSMO_RAT_UTRAN_IU, };
 
 static void test_subscr_create_update_sel_delete()
 {
@@ -353,6 +355,11 @@
 	ASSERT_RC(db_subscr_lu(dbc, id0, "222", false, NULL, 0), 0);
 	ASSERT_SEL(id, id0, 0);
 
+	ASSERT_RC(db_subscr_lu(dbc, id0, "333", false, rat_types, 1), 0);
+	ASSERT_SEL(id, id0, 0);
+	ASSERT_RC(db_subscr_lu(dbc, id0, "333", false, rat_types, 1), 0);
+	ASSERT_SEL(id, id0, 0);
+
 	comment("Unset LU info for PS and CS (SGSN and VLR names)");
 	ASSERT_RC(db_subscr_lu(dbc, id0, "", true, NULL, 0), 0);
 	ASSERT_SEL(id, id0, 0);
diff --git a/tests/db/db_test.err b/tests/db/db_test.err
index faa37b9..adbd291 100644
--- a/tests/db/db_test.err
+++ b/tests/db/db_test.err
@@ -441,6 +441,30 @@
   .sgsn_number = '111',
 }
 
+db_subscr_lu(dbc, id0, "333", false, rat_types, 1) --> 0
+
+db_subscr_get_by_id(dbc, id0, &g_subscr) --> 0
+struct hlr_subscriber {
+  .id = 1,
+  .imsi = '123456789000000',
+  .msisdn = '543210123456789',
+  .vlr_number = '333',
+  .sgsn_number = '111',
+  .last_lu_rat = 'GERAN-A',
+}
+
+db_subscr_lu(dbc, id0, "333", false, rat_types, 1) --> 0
+
+db_subscr_get_by_id(dbc, id0, &g_subscr) --> 0
+struct hlr_subscriber {
+  .id = 1,
+  .imsi = '123456789000000',
+  .msisdn = '543210123456789',
+  .vlr_number = '333',
+  .sgsn_number = '111',
+  .last_lu_rat = 'GERAN-A',
+}
+
 
 --- Unset LU info for PS and CS (SGSN and VLR names)
 
@@ -451,7 +475,7 @@
   .id = 1,
   .imsi = '123456789000000',
   .msisdn = '543210123456789',
-  .vlr_number = '222',
+  .vlr_number = '333',
 }
 
 db_subscr_lu(dbc, id0, "", false, NULL, 0) --> 0