diff --git a/openbsc/include/openbsc/gsm_data.h b/openbsc/include/openbsc/gsm_data.h
index f74ece8..21c7889 100644
--- a/openbsc/include/openbsc/gsm_data.h
+++ b/openbsc/include/openbsc/gsm_data.h
@@ -11,6 +11,8 @@
 
 #define OBSC_NM_W_ACK_CB(__msgb) (__msgb)->cb[3]
 
+struct mncc_sock_state;
+
 /* the data structure stored in msgb->cb for openbsc apps */
 struct openbsc_msgb_cb {
 	unsigned char *bssgph;
@@ -247,6 +249,7 @@
 	struct gsmnet_stats stats;
 
 	/* layer 4 */
+	struct mncc_sock_state *mncc_state;
 	int (*mncc_recv) (struct gsm_network *net, struct msgb *msg);
 	struct llist_head upqueue;
 	struct llist_head trans_list;
diff --git a/openbsc/src/libmsc/mncc_sock.c b/openbsc/src/libmsc/mncc_sock.c
index d8caf07..3ab40a8 100644
--- a/openbsc/src/libmsc/mncc_sock.c
+++ b/openbsc/src/libmsc/mncc_sock.c
@@ -43,9 +43,6 @@
 	struct osmo_fd conn_bfd;		/* fd for connection to lcr */
 };
 
-/* FIXME: avoid this */
-static struct mncc_sock_state *g_state;
-
 /* input from CC code into mncc_sock */
 int mncc_sock_from_cc(struct gsm_network *net, struct msgb *msg)
 {
@@ -53,7 +50,7 @@
 	int msg_type = mncc_in->msg_type;
 
 	/* Check if we currently have a MNCC handler connected */
-	if (g_state->conn_bfd.fd < 0) {
+	if (net->mncc_state->conn_bfd.fd < 0) {
 		LOGP(DMNCC, LOGL_ERROR, "mncc_sock receives %s for external CC app "
 			"but socket is gone\n", get_mncc_name(msg_type));
 		if (msg_type != GSM_TCHF_FRAME &&
@@ -75,15 +72,10 @@
 
 	/* Actually enqueue the message and mark socket write need */
 	msgb_enqueue(&net->upqueue, msg);
-	g_state->conn_bfd.when |= BSC_FD_WRITE;
+	net->mncc_state->conn_bfd.when |= BSC_FD_WRITE;
 	return 0;
 }
 
-void mncc_sock_write_pending(void)
-{
-	g_state->conn_bfd.when |= BSC_FD_WRITE;
-}
-
 /* FIXME: move this to libosmocore */
 int osmo_unixsock_listen(struct osmo_fd *bfd, int type, const char *path);
 
@@ -292,7 +284,7 @@
 		return rc;
 	}
 
-	g_state = state;
+	net->mncc_state = state;
 
 	return 0;
 }