OM2000: make sure to route messages to IXU/DXU over BTS oml link

Messages to CF and other core objects need to go to the BTS (IXU/DXU)
OML link, not to the OML link of the primary TRX!
diff --git a/openbsc/src/libbsc/abis_om2000.c b/openbsc/src/libbsc/abis_om2000.c
index 1183895..716f17b 100644
--- a/openbsc/src/libbsc/abis_om2000.c
+++ b/openbsc/src/libbsc/abis_om2000.c
@@ -822,6 +822,7 @@
 				"non-existing TRX\n", om2k_mo_name(&o2h->mo));
 			return -ENODEV;
 		}
+		msg->dst = trx->oml_link;
 		break;
 	case OM2K_MO_CLS_TS:
 		/* Route through per-TRX OML Link to the appropriate TRX */
@@ -831,13 +832,13 @@
 				"non-existing TRX\n", om2k_mo_name(&o2h->mo));
 			return -ENODEV;
 		}
+		msg->dst = trx->oml_link;
 		break;
 	default:
 		/* Route through the IXU/DXU OML Link */
-		trx = bts->c0;
+		msg->dst = bts->oml_link;
 		break;
 	}
-	msg->dst = trx->oml_link;
 
 	return _abis_nm_sendmsg(msg);
 }