diff --git a/openbsc/include/openbsc/rest_octets.h b/openbsc/include/openbsc/rest_octets.h
index 56d4e0d..963b010 100644
--- a/openbsc/include/openbsc/rest_octets.h
+++ b/openbsc/include/openbsc/rest_octets.h
@@ -55,7 +55,7 @@
 int rest_octets_si3(uint8_t *data, const struct gsm48_si_ro_info *si3);
 
 /* Generate SI4 Rest Octets (Chapter 10.5.2.35) */
-int rest_octets_si4(uint8_t *data, const struct gsm48_si_ro_info *si4);
+int rest_octets_si4(uint8_t *data, const struct gsm48_si_ro_info *si4, int len);
 
 enum pbcch_carrier_type {
 	PBCCH_BCCH,
diff --git a/openbsc/src/libbsc/rest_octets.c b/openbsc/src/libbsc/rest_octets.c
index 41bf505..4545794 100644
--- a/openbsc/src/libbsc/rest_octets.c
+++ b/openbsc/src/libbsc/rest_octets.c
@@ -141,13 +141,13 @@
 }
 
 /* Generate SI4 Rest Octets (Chapter 10.5.2.35) */
-int rest_octets_si4(uint8_t *data, const struct gsm48_si_ro_info *si4)
+int rest_octets_si4(uint8_t *data, const struct gsm48_si_ro_info *si4, int len)
 {
 	struct bitvec bv;
 
 	memset(&bv, 0, sizeof(bv));
 	bv.data = data;
-	bv.data_len = 10; /* FIXME: up to ? */
+	bv.data_len = len;
 
 	/* SI4 Rest Octets O */
 	append_selection_params(&bv, &si4->selection_params);
diff --git a/openbsc/src/libbsc/system_information.c b/openbsc/src/libbsc/system_information.c
index 8a6d026..5071b06 100644
--- a/openbsc/src/libbsc/system_information.c
+++ b/openbsc/src/libbsc/system_information.c
@@ -595,7 +595,7 @@
 	/* SI4 Rest Octets (10.5.2.35), containing
 		Optional Power offset, GPRS Indicator,
 		Cell Identity, LSA ID, Selection Parameter */
-	rc = rest_octets_si4(restoct, &si_info);
+	rc = rest_octets_si4(restoct, &si_info, output + GSM_MACBLOCK_LEN - restoct);
 
 	return l2_plen + 1 + rc;
 }