diff --git a/src/tests/hnb-test-layers.h b/src/tests/hnb-test-layers.h
new file mode 100644
index 0000000..4b17461
--- /dev/null
+++ b/src/tests/hnb-test-layers.h
@@ -0,0 +1,15 @@
+#pragma once
+
+struct ANY;
+struct ranap_message_s;
+struct hnb_test;
+
+/* main calls RUA */
+void hnb_test_rua_dt_handle(struct hnb_test *hnb, struct ANY *in);
+
+/* RUA calls RANAP */
+void hnb_test_rua_dt_handle_ranap(struct hnb_test *hnb,
+				  struct ranap_message_s *ranap_msg);
+
+/* RANAP calls main with actual payload*/
+void hnb_test_nas_rx_dtap(struct hnb_test *hnb, void *data, int len);
diff --git a/src/tests/hnb-test-ranap.c b/src/tests/hnb-test-ranap.c
index 7412d83..63e3d92 100644
--- a/src/tests/hnb-test-ranap.c
+++ b/src/tests/hnb-test-ranap.c
@@ -1,6 +1,8 @@
 #include <osmocom/core/msgb.h>
 #include <osmocom/ranap/ranap_ies_defs.h>
 
+#include "hnb-test-layers.h"
+
 static const char *printstr(OCTET_STRING_t *s)
 {
 	return osmo_hexdump((char*)s->buf, s->size);
@@ -10,38 +12,25 @@
 	printf(#octet_string_t " = %s\n",\
 	       printstr(&octet_string_t))
 
-void ranap_msg_dt_print(void *ctx, ranap_message *ranap_msg)
+void hnb_test_rua_dt_handle_ranap(struct hnb_test *hnb,
+				  struct ranap_message_s *ranap_msg)
 {
-	OSMO_ASSERT(ranap_msg->procedureCode ==
-		    RANAP_ProcedureCode_id_DirectTransfer);
+	int len;
+	char *data;
 
-	printf("rx DirectTransfer: presence = %hx\n", ranap_msg->msg.directTransferIEs.presenceMask);
-	PP(ranap_msg->msg.directTransferIEs.nas_pdu);
-	
-/*
-typedef struct RANAP_DirectTransferIEs_s {
-    uint16_t  presenceMask;
-    RANAP_NAS_PDU_t nas_pdu;
-    RANAP_LAI_t lai; ///< Optional field
-    RANAP_RAC_t rac; ///< Optional field
-    RANAP_SAI_t sai; ///< Optional field
-    RANAP_SAPI_t sapi; ///< Optional field
-} RANAP_DirectTransferIEs_t;
-*/
-}
+	printf("rx ranap_msg->procedureCode %d\n",
+	       ranap_msg->procedureCode);
 
-void ranap_msg_dt_get(void *ctx, ranap_message *ranap_msg)
-{
-	struct msgb *m = ctx;
-	OSMO_ASSERT(ranap_msg->procedureCode ==
-		    RANAP_ProcedureCode_id_DirectTransfer);
+	switch (ranap_msg->procedureCode) {
+	case RANAP_ProcedureCode_id_DirectTransfer:
+		printf("rx DirectTransfer: presence = %hx\n",
+		       ranap_msg->msg.directTransferIEs.presenceMask);
+		PP(ranap_msg->msg.directTransferIEs.nas_pdu);
 
-	printf("rx DirectTransfer: presence = %hx\n", ranap_msg->msg.directTransferIEs.presenceMask);
-	PP(ranap_msg->msg.directTransferIEs.nas_pdu);
+		len = ranap_msg->msg.directTransferIEs.nas_pdu.size;
+		data = ranap_msg->msg.directTransferIEs.nas_pdu.buf;
 
-	int len = ranap_msg->msg.directTransferIEs.nas_pdu.size;
-	char *data = ranap_msg->msg.directTransferIEs.nas_pdu.buf;
-
-	m->l3h = m->data;
-	memcpy(msgb_put(m, len), data, len);
+		hnb_test_nas_rx_dtap(hnb, data, len);
+		return;
+	}
 }
diff --git a/src/tests/hnb-test-rua.c b/src/tests/hnb-test-rua.c
index 41df4f2..e3f44c5 100644
--- a/src/tests/hnb-test-rua.c
+++ b/src/tests/hnb-test-rua.c
@@ -2,36 +2,22 @@
 #include <asn1c/ANY.h>
 #include "../rua_ies_defs.h"
 
-struct ranap_message_s;
+#include "hnb-test-layers.h"
 
-typedef void (*ranap_handle_cb)(void *ctx, struct ranap_message_s *ranap_msg);
-
-extern void ranap_msg_dt_print(void *ctx, struct ranap_message_s *ranap_msg);
-extern void ranap_msg_dt_get(void *ctx, struct ranap_message_s *ranap_msg);
-
-static void direct_transfer_nas_pdu_handle(ANY_t *in, ranap_handle_cb handler, void *ctx)
+void hnb_test_rua_dt_handle(struct hnb_test *hnb, ANY_t *in)
 {
 	RUA_DirectTransferIEs_t ies;
 	int rc;
 
 	rc = rua_decode_directtransferies(&ies, in);
 	if (rc < 0) {
-		printf("print_rua_init_dt(): failed to decode rua IEs\n");
+		printf("failed to decode RUA DT IEs\n");
 		return;
 	}
 
-	rc = ranap_cn_rx_co(handler, ctx, ies.ranaP_Message.buf, ies.ranaP_Message.size);
+	rc = ranap_cn_rx_co(hnb_test_rua_dt_handle_ranap, hnb, ies.ranaP_Message.buf, ies.ranaP_Message.size);
 
 	/* FIXME: what to do with the asn1c-allocated memory */
 	rua_free_directtransferies(&ies);
 }
 
-void direct_transfer_nas_pdu_print(ANY_t *in)
-{
-	direct_transfer_nas_pdu_handle(in, ranap_msg_dt_print, NULL);
-}
-
-void direct_transfer_nas_pdu_get(ANY_t *in, struct msgb *m)
-{
-	direct_transfer_nas_pdu_handle(in, ranap_msg_dt_get, m);
-}
diff --git a/src/tests/hnb-test.c b/src/tests/hnb-test.c
index 4940fa8..0f5b231 100644
--- a/src/tests/hnb-test.c
+++ b/src/tests/hnb-test.c
@@ -51,6 +51,7 @@
 #include <osmocom/crypt/auth.h>
 
 #include "hnb-test.h"
+#include "hnb-test-layers.h"
 #include "hnbap_common.h"
 #include "hnbap_ies_defs.h"
 #include "rua_msg_factory.h"
@@ -240,28 +241,16 @@
 	return 0;
 }
 
-static struct tlv_parsed *parse_mm(struct msgb *rxm)
+static struct tlv_parsed *parse_mm(struct gsm48_hdr *gh, int len)
 {
 	static struct tlv_parsed tp;
-	struct gsm48_hdr *gh;
 	int parse_res;
-	int length = msgb_l3len(rxm);
 
-	if (length < sizeof(*gh)) {
-		printf("GSM48 header does not fit.\n");
-		return NULL;
-	}
-
-	gh = (struct gsm48_hdr *) msgb_l3(rxm);
-	if (!gh) {
-		printf("received msg buffer with invalid layer 3. Ignoring.\n");
-		return -1;
-	}
-	length -= (const char *)&gh->data[0] - (const char *)gh;
+	len -= (const char *)&gh->data[0] - (const char *)gh;
 
 	OSMO_ASSERT(gsm48_hdr_pdisc(gh) == GSM48_PDISC_MM);
 
-	parse_res = tlv_parse(&tp, &gsm48_mm_att_tlvdef, &gh->data[0], length, 0, 0);
+	parse_res = tlv_parse(&tp, &gsm48_mm_att_tlvdef, &gh->data[0], len, 0, 0);
 	if (parse_res <= 0) {
 		uint8_t msg_type = gsm48_hdr_msg_type(gh);
 		printf("Error parsing MM message 0x%hhx: %d\n", msg_type, parse_res);
@@ -271,23 +260,11 @@
 	return &tp;
 }
 
-int hnb_test_nas_rx_lu_accept(struct msgb *rxm, int *sent_tmsi)
+int hnb_test_nas_rx_lu_accept(struct gsm48_hdr *gh, int len, int *sent_tmsi)
 {
 	printf(" :D Location Update Accept :D\n");
-	struct gsm48_hdr *gh;
 	struct gsm48_loc_area_id *lai;
-	int length = msgb_l3len(rxm);
 
-	if (length < sizeof(*gh)) {
-		printf("GSM48 header does not fit.\n");
-		return -1;
-	}
-
-	gh = (struct gsm48_hdr *)msgb_l3(rxm);
-	if (!gh) {
-		printf("received msg buffer with invalid layer 3. Ignoring.\n");
-		return -1;
-	}
 	lai = (struct gsm48_loc_area_id *)&gh->data[0];
 
 	uint16_t mcc, mnc, lac;
@@ -298,8 +275,8 @@
 	struct tlv_parsed tp;
 	int parse_res;
 
-	length -= (const char *)&gh->data[0] - (const char *)gh;
-	parse_res = tlv_parse(&tp, &gsm48_mm_att_tlvdef, &gh->data[0], length, 0, 0);
+	len -= (const char *)&gh->data[0] - (const char *)gh;
+	parse_res = tlv_parse(&tp, &gsm48_mm_att_tlvdef, &gh->data[0], len, 0, 0);
 	if (parse_res <= 0) {
 		printf("Error parsing Location Update Accept message: %d\n", parse_res);
 		return -1;
@@ -314,10 +291,10 @@
 	return 0;
 }
 
-void hnb_test_nas_rx_mm_info(struct msgb *rxm)
+void hnb_test_nas_rx_mm_info(struct gsm48_hdr *gh, int len)
 {
 	printf(" :) MM Info :)\n");
-	struct tlv_parsed *tp = parse_mm(rxm);
+	struct tlv_parsed *tp = parse_mm(gh, len);
 	if (!tp)
 		return;
 
@@ -338,26 +315,15 @@
 	}
 }
 
-static int hnb_test_nas_rx_auth_req(struct hnb_test *hnb, struct msgb *rxm)
+static int hnb_test_nas_rx_auth_req(struct hnb_test *hnb, struct gsm48_hdr *gh,
+				    int len)
 {
-	struct gsm48_hdr *gh;
 	struct gsm48_auth_req *ar;
 	int parse_res;
-	int length = msgb_l3len(rxm);
 
-	if (length < sizeof(*gh)) {
-		printf("GSM48 header does not fit.\n");
-		return;
-	}
+	len -= (const char *)&gh->data[0] - (const char *)gh;
 
-	gh = (struct gsm48_hdr *) msgb_l3(rxm);
-	if (!gh) {
-		printf("received msg buffer with invalid layer 3. Ignoring.\n");
-		return -1;
-	}
-	length -= (const char *)&gh->data[0] - (const char *)gh;
-
-	if (length < sizeof(*ar)) {
+	if (len < sizeof(*ar)) {
 		printf("GSM48 Auth Req does not fit.\n");
 		return;
 	}
@@ -391,7 +357,7 @@
 	return hnb_test_nas_tx_dt(hnb, gen_nas_auth_resp(vec.sres));
 }
 
-static int hnb_test_nas_rx_mm(struct hnb_test *hnb, struct msgb *rxm)
+static int hnb_test_nas_rx_mm(struct hnb_test *hnb, struct gsm48_hdr *gh, int len)
 {
 	struct hnbtest_chan *chan;
 
@@ -403,11 +369,6 @@
 
 	OSMO_ASSERT(!chan->is_ps);
 
-	struct gsm48_hdr *gh = msgb_l3(rxm);
-	if (!gh) {
-		printf("received msg buffer with invalid layer 3. Ignoring.\n");
-		return -1;
-	}
 	uint8_t msg_type = gsm48_hdr_msg_type(gh);
 	int sent_tmsi;
 
@@ -416,7 +377,7 @@
 		return hnb_test_nas_tx_dt(hnb, gen_nas_id_resp());
 
 	case GSM48_MT_MM_LOC_UPD_ACCEPT:
-		if (hnb_test_nas_rx_lu_accept(rxm, &sent_tmsi))
+		if (hnb_test_nas_rx_lu_accept(gh, len, &sent_tmsi))
 			return -1;
 		if (sent_tmsi)
 			return hnb_test_nas_tx_dt(hnb, gen_nas_tmsi_realloc_compl());
@@ -428,11 +389,11 @@
 		return 0;
 
 	case GSM48_MT_MM_INFO:
-		hnb_test_nas_rx_mm_info(rxm);
+		hnb_test_nas_rx_mm_info(gh, len);
 		return 0;
 
 	case GSM48_MT_MM_AUTH_REQ:
-		return hnb_test_nas_rx_auth_req(hnb, rxm);
+		return hnb_test_nas_rx_auth_req(hnb, gh, len);
 
 	default:
 		printf("04.08 message type not handled by hnb-test: 0x%x\n",
@@ -442,30 +403,33 @@
 
 }
 
-static int hnb_test_nas_rx_dtap(struct hnb_test *hnb, struct msgb *msg)
+void hnb_test_nas_rx_dtap(struct hnb_test *hnb, void *data, int len)
 {
-	printf("got %d bytes: %s\n", msg->len, osmo_hexdump(msg->data, msg->len));
+	int rc;
+	printf("got %d bytes: %s\n", len, osmo_hexdump(data, len));
 
 	// nas_pdu == '05 08 12' ==> IMEI Identity request
 	//            '05 04 0d' ==> LU reject
 
-	struct gsm48_hdr *gh = msgb_l3(msg);
-	if (!gh) {
-		printf("received msg buffer with invalid layer 3. Ignoring.\n");
-		return -1;
+	struct gsm48_hdr *gh = data;
+	if (len < sizeof(*gh)) {
+		printf("hnb_test_nas_rx_dtap(): NAS PDU is too short: %d. Ignoring.\n",
+		       len);
+		return;
 	}
 	uint8_t pdisc = gsm48_hdr_pdisc(gh);
 
 	switch (pdisc) {
 	case GSM48_PDISC_MM:
-		return hnb_test_nas_rx_mm(hnb, msg);
+		rc = hnb_test_nas_rx_mm(hnb, gh, len);
+		if (rc != 0)
+			printf("Error receiving MM message: %d\n", rc);
+		return;
 	default:
 		printf("04.08 discriminator not handled by hnb-test: %d\n",
 		       pdisc);
-		return 0;
+		return;
 	}
-
-
 }
 
 int hnb_test_hnbap_rx(struct hnb_test *hnb, struct msgb *msg)
@@ -544,14 +508,7 @@
 		break;
 	case RUA_ProcedureCode_id_DirectTransfer:
 		printf("RUA rx DirectTransfer\n");
-		{
-			struct msgb *m = msgb_alloc(1500, "direct_transfer_nas_pdu");
-			direct_transfer_nas_pdu_get(&pdu->choice.successfulOutcome.value, m);
-
-			hnb_test_nas_rx_dtap(hnb, m);
-
-			msgb_free(m);
-		}
+		hnb_test_rua_dt_handle(hnb, &pdu->choice.successfulOutcome.value);
 		break;
 	case RUA_ProcedureCode_id_Disconnect:
 		printf("RUA rx Disconnect\n");