diff --git a/openbsc/src/bsc_init.c b/openbsc/src/bsc_init.c
index 01ff70a..86a1c8d 100644
--- a/openbsc/src/bsc_init.c
+++ b/openbsc/src/bsc_init.c
@@ -1184,7 +1184,7 @@
 	return 0;
 }
 
-int bsc_bootstrap_network(int (*mncc_recv)(struct gsm_network *, int, void *),
+int bsc_bootstrap_network(int (*mncc_recv)(struct gsm_network *, struct msgb *),
 			  const char *config_file)
 {
 	struct telnet_connection dummy_conn;
diff --git a/openbsc/src/gsm_data.c b/openbsc/src/gsm_data.c
index 27d0732..705c107 100644
--- a/openbsc/src/gsm_data.c
+++ b/openbsc/src/gsm_data.c
@@ -248,7 +248,7 @@
 }
 
 struct gsm_network *gsm_network_init(u_int16_t country_code, u_int16_t network_code,
-				     int (*mncc_recv)(struct gsm_network *, int, void *))
+				     int (*mncc_recv)(struct gsm_network *, struct msgb *))
 {
 	struct gsm_network *net;
 
diff --git a/openbsc/src/mncc.c b/openbsc/src/mncc.c
index d20b4ef..34093a8 100644
--- a/openbsc/src/mncc.c
+++ b/openbsc/src/mncc.c
@@ -110,7 +110,5 @@
 
 void cc_tx_to_mncc(struct gsm_network *net, struct msgb *msg)
 {
-	struct gsm_mncc *mncc = msgb_data(msg);
-
-	net->mncc_recv(net, mncc->msg_type, mncc);
+	net->mncc_recv(net, msg);
 }
diff --git a/openbsc/src/mncc_builtin.c b/openbsc/src/mncc_builtin.c
index a819108..640a286 100644
--- a/openbsc/src/mncc_builtin.c
+++ b/openbsc/src/mncc_builtin.c
@@ -277,9 +277,11 @@
 
 
 /* Internal MNCC handler input function (from CC -> MNCC -> here) */
-int int_mncc_recv(struct gsm_network *net, int msg_type, void *arg)
+int int_mncc_recv(struct gsm_network *net, struct msgb *msg)
 {
+	void *arg = msgb_data(msg);
 	struct gsm_mncc *data = arg;
+	int msg_type = data->msg_type;
 	int callref;
 	struct gsm_call *call = NULL, *callt;
 	int rc = 0;
@@ -300,7 +302,7 @@
 	/* create callref, if setup is received */
 	if (!call) {
 		if (msg_type != MNCC_SETUP_IND)
-			return 0; /* drop */
+			goto out_free; /* drop */
 		/* create call */
 		if (!(call = talloc_zero(tall_call_ctx, struct gsm_call))) {
 			struct gsm_mncc rel;
@@ -310,7 +312,7 @@
 			mncc_set_cause(&rel, GSM48_CAUSE_LOC_PRN_S_LU,
 				       GSM48_CC_CAUSE_RESOURCE_UNAVAIL);
 			mncc_tx_to_cc(net, MNCC_REL_REQ, &rel);
-			return 0;
+			goto out_free;
 		}
 		llist_add_tail(&call->entry, &call_list);
 		call->net = net;
@@ -396,5 +398,8 @@
 		break;
 	}
 
+out_free:
+	talloc_free(msg);
+
 	return rc;
 }