diff --git a/tests/msc_vlr/msc_vlr_test_call.c b/tests/msc_vlr/msc_vlr_test_call.c
index 065af25..392d38d 100644
--- a/tests/msc_vlr/msc_vlr_test_call.c
+++ b/tests/msc_vlr/msc_vlr_test_call.c
@@ -213,6 +213,25 @@
 	OSMO_ASSERT(cc_to_mncc_tx_confirmed);
 	mncc.callref = cc_to_mncc_tx_got_callref;
 
+	btw("MNCC replies with MNCC_RTP_CREATE, causing MGW endpoint CRCX to RAN");
+	expect_crcx(RTP_TO_RAN);
+	mncc_sends_to_cc(MNCC_RTP_CREATE, &mncc);
+	OSMO_ASSERT(got_crcx);
+
+	btw("MGW acknowledges the CRCX, triggering Assignment");
+	expect_iu_rab_assignment();
+	crcx_ok(RTP_TO_RAN);
+	OSMO_ASSERT(iu_rab_assignment_sent);
+
+	btw("Assignment succeeds, triggering CRCX to CN");
+	expect_crcx(RTP_TO_CN);
+	ms_sends_assignment_complete(CODEC_AMR_8000_1);
+	OSMO_ASSERT(got_crcx);
+
+	btw("CN RTP address is available, trigger MNCC_RTP_CREATE");
+	cc_to_mncc_expect_tx("", MNCC_RTP_CREATE);
+	crcx_ok(RTP_TO_CN);
+
 	btw("MNCC says that's fine");
 	dtap_expect_tx("8302" /* CC: Call Proceeding */);
 	mncc_sends_to_cc(MNCC_CALL_PROC_REQ, &mncc);
@@ -298,11 +317,32 @@
 	dtap_expect_tx("0305" /* CC: Setup */);
 	ms_sends_security_mode_complete();
 
+	btw("MS confirms call, we create a RAN-side RTP and forward MNCC_CALL_CONF_IND");
+	expect_crcx(RTP_TO_RAN);
 	cc_to_mncc_expect_tx(IMSI, MNCC_CALL_CONF_IND);
 	ms_sends_msg("8348" /* CC: Call Confirmed */
 		     "0406600402000581" /* Bearer Capability */
 		     "15020100" /* Call Control Capabilities */
 		     "40080402600400021f00" /* Supported Codec List */);
+	OSMO_ASSERT(got_crcx);
+	OSMO_ASSERT(cc_to_mncc_tx_confirmed);
+
+	btw("MNCC sends MNCC_RTP_CREATE");
+	mncc_sends_to_cc(MNCC_RTP_CREATE, &mncc);
+
+	btw("MGW acknowledges the CRCX to RAN, triggering Assignment");
+	expect_iu_rab_assignment();
+	crcx_ok(RTP_TO_RAN);
+	OSMO_ASSERT(iu_rab_assignment_sent);
+
+	btw("Assignment completes, triggering CRCX to CN");
+	expect_crcx(RTP_TO_CN);
+	ms_sends_assignment_complete(CODEC_AMR_8000_1);
+	OSMO_ASSERT(got_crcx);
+
+	btw("When the CN side RTP address is known, send MNCC_RTP_CREATE");
+	cc_to_mncc_expect_tx("", MNCC_RTP_CREATE);
+	crcx_ok(RTP_TO_CN);
 
 	fake_time_passes(1, 23);
 
@@ -380,13 +420,32 @@
 	dtap_expect_tx("0305" /* CC: Setup */);
 	ms_sends_security_mode_complete();
 
+	btw("MS confirms call, we create a RAN-side RTP and forward MNCC_CALL_CONF_IND");
+	expect_crcx(RTP_TO_RAN);
 	cc_to_mncc_expect_tx(IMSI, MNCC_CALL_CONF_IND);
 	ms_sends_msg("8348" /* CC: Call Confirmed */
 		     "0406600402000581" /* Bearer Capability */
 		     "15020100" /* Call Control Capabilities */
 		     "40080402600400021f00" /* Supported Codec List */);
+	OSMO_ASSERT(got_crcx);
 	OSMO_ASSERT(cc_to_mncc_tx_confirmed);
 
+	btw("MNCC sends MNCC_RTP_CREATE");
+	mncc_sends_to_cc(MNCC_RTP_CREATE, &mncc);
+
+	btw("MGW acknowledges the CRCX to RAN, triggering Assignment");
+	expect_iu_rab_assignment();
+	crcx_ok(RTP_TO_RAN);
+	OSMO_ASSERT(iu_rab_assignment_sent);
+
+	btw("Assignment completes, triggering CRCX to CN");
+	expect_crcx(RTP_TO_CN);
+	ms_sends_assignment_complete(CODEC_AMR_8000_1);
+	OSMO_ASSERT(got_crcx);
+
+	btw("When the CN side RTP address is known, send MNCC_RTP_CREATE");
+	cc_to_mncc_expect_tx("", MNCC_RTP_CREATE);
+	crcx_ok(RTP_TO_CN);
 	fake_time_passes(1, 23);
 
 	cc_to_mncc_expect_tx("", MNCC_ALERT_IND);
@@ -470,6 +529,25 @@
 	OSMO_ASSERT(cc_to_mncc_tx_confirmed);
 	mncc.callref = cc_to_mncc_tx_got_callref;
 
+	btw("MNCC replies with MNCC_RTP_CREATE, causing MGW endpoint CRCX to RAN");
+	expect_crcx(RTP_TO_RAN);
+	mncc_sends_to_cc(MNCC_RTP_CREATE, &mncc);
+	OSMO_ASSERT(got_crcx);
+
+	btw("MGW acknowledges the CRCX, triggering Assignment");
+	expect_iu_rab_assignment();
+	crcx_ok(RTP_TO_RAN);
+	OSMO_ASSERT(iu_rab_assignment_sent);
+
+	btw("Assignment succeeds, triggering CRCX to CN");
+	expect_crcx(RTP_TO_CN);
+	ms_sends_assignment_complete(CODEC_AMR_8000_1);
+	OSMO_ASSERT(got_crcx);
+
+	btw("CN RTP address is available, trigger MNCC_RTP_CREATE");
+	cc_to_mncc_expect_tx("", MNCC_RTP_CREATE);
+	crcx_ok(RTP_TO_CN);
+
 	btw("MNCC says that's fine");
 	dtap_expect_tx("8302" /* CC: Call Proceeding */);
 	mncc_sends_to_cc(MNCC_CALL_PROC_REQ, &mncc);
@@ -547,6 +625,25 @@
 	OSMO_ASSERT(cc_to_mncc_tx_confirmed);
 	mncc.callref = cc_to_mncc_tx_got_callref;
 
+	btw("MNCC replies with MNCC_RTP_CREATE, causing MGW endpoint CRCX to RAN");
+	expect_crcx(RTP_TO_RAN);
+	mncc_sends_to_cc(MNCC_RTP_CREATE, &mncc);
+	OSMO_ASSERT(got_crcx);
+
+	btw("MGW acknowledges the CRCX, triggering Assignment");
+	expect_iu_rab_assignment();
+	crcx_ok(RTP_TO_RAN);
+	OSMO_ASSERT(iu_rab_assignment_sent);
+
+	btw("Assignment succeeds, triggering CRCX to CN");
+	expect_crcx(RTP_TO_CN);
+	ms_sends_assignment_complete(CODEC_AMR_8000_1);
+	OSMO_ASSERT(got_crcx);
+
+	btw("CN RTP address is available, trigger MNCC_RTP_CREATE");
+	cc_to_mncc_expect_tx("", MNCC_RTP_CREATE);
+	crcx_ok(RTP_TO_CN);
+
 	btw("MNCC says that's fine");
 	dtap_expect_tx("8302" /* CC: Call Proceeding */);
 	mncc_sends_to_cc(MNCC_CALL_PROC_REQ, &mncc);
diff --git a/tests/msc_vlr/msc_vlr_test_call.err b/tests/msc_vlr/msc_vlr_test_call.err
index 4f8f925..7f9940b 100644
--- a/tests/msc_vlr/msc_vlr_test_call.err
+++ b/tests/msc_vlr/msc_vlr_test_call.err
@@ -296,6 +296,37 @@
 DMNCC trans(CC:INITIATED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ callref-0x80000001 tid-8) tx MNCC_SETUP_IND
   MSC --> MNCC: callref 0x80000001: MNCC_SETUP_IND
 DREF msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_COMMUNICATING}: - rx_from_ms: now used by 1 (cc)
+- MNCC replies with MNCC_RTP_CREATE, causing MGW endpoint CRCX to RAN
+DMNCC trans(CC:INITIATED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ callref-0x80000001 tid-8) rx MNCC_RTP_CREATE
+DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_COMMUNICATING}: Starting call assignment
+DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){ESTABLISHING}: Allocated
+DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){ESTABLISHING}: is child of msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ)
+  MGW <--CRCX to RTP_TO_RAN-- MSC: callref=0x80000001
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){UNINITIALIZED}: Allocated
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){UNINITIALIZED}: is child of call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ)
+- MGW acknowledges the CRCX, triggering Assignment
+  MGW --CRCX OK to RTP_TO_RAN--> MSC
+DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){ESTABLISHING}: Received Event CALL_LEG_EV_RTP_STREAM_ADDR_AVAILABLE
+DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_COMMUNICATING}: Received Event MSC_EV_CALL_LEG_RTP_LOCAL_ADDR_AVAILABLE
+DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_COMMUNICATING}: MGW endpoint's RTP address available for the CI RTP_TO_RAN: 10.23.23.1:23 (osmux=no:-2)
+DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_COMMUNICATING}: RAN encode: ASSIGNMENT_COMMAND on UTRAN-Iu
+DMSC dummy_msc_i(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){0}: Received Event MSC_I_EV_FROM_A_FORWARD_ACCESS_SIGNALLING_REQUEST
+- Assignment succeeds, triggering CRCX to CN
+DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_COMMUNICATING}: RAN decode: ASSIGNMENT_COMPLETE
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ:trans-8:call-2147483649:RTP_TO_RAN:no-CI){UNINITIALIZED}: setting codec to AMR/8000/1
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ:trans-8:call-2147483649:RTP_TO_RAN:no-CI:local-10-23-23-1-23){UNINITIALIZED}: setting remote addr to :0
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ:trans-8:call-2147483649:RTP_TO_RAN:no-CI:local-10-23-23-1-23){UNINITIALIZED}: Not committing: no MGW endpoint CI set up
+  MGW <--CRCX to RTP_TO_CN-- MSC: callref=0x80000001
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){UNINITIALIZED}: Allocated
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){UNINITIALIZED}: is child of call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ)
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ:trans-8:call-2147483649:RTP_TO_CN:no-CI){UNINITIALIZED}: setting codec to AMR/8000/1
+- CN RTP address is available, trigger MNCC_RTP_CREATE
+  MGW --CRCX OK to RTP_TO_CN--> MSC
+DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){ESTABLISHING}: Received Event CALL_LEG_EV_RTP_STREAM_ADDR_AVAILABLE
+DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_COMMUNICATING}: Received Event MSC_EV_CALL_LEG_RTP_LOCAL_ADDR_AVAILABLE
+DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_COMMUNICATING}: MGW endpoint's RTP address available for the CI RTP_TO_CN: 10.23.23.1:23 (osmux=no:-2)
+DMNCC trans(CC:INITIATED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ callref-0x80000001 tid-8) tx MNCC_RTP_CREATE
+  MSC --> MNCC: callref 0x80000001: MNCC_RTP_CREATE
 - MNCC says that's fine
 DMNCC trans(CC:INITIATED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ callref-0x80000001 tid-8) rx MNCC_CALL_PROC_REQ
 DCC trans(CC:INITIATED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ callref-0x80000001 tid-8) stopping pending guard timer
@@ -307,10 +338,7 @@
 - DTAP --UTRAN-Iu--> MS: GSM48_MT_CC_CALL_PROC: 8302
 - DTAP matches expected message
 DMSC dummy_msc_i(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){0}: Received Event MSC_I_EV_FROM_A_FORWARD_ACCESS_SIGNALLING_REQUEST
-DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_COMMUNICATING}: Starting call assignment
-DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){ESTABLISHING}: Allocated
-DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){ESTABLISHING}: is child of msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ)
-  MS <--Call Assignment-- MSC: callref=0x80000001
+DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_COMMUNICATING}: Assignment for this trans already started earlier
 - Total time passed: 1.000023 s
 - The other call leg got established (not shown here), MNCC tells us so
 DMNCC trans(CC:MO_CALL_PROC IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ callref-0x80000001 tid-8) rx MNCC_ALERT_REQ
@@ -394,9 +422,15 @@
 DREF VLR subscr IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100 - vlr_subscr_cancel_attach_fsm: now used by 3 (attached,active-conn,msc_a_fsm_releasing_onenter)
 DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){ESTABLISHING}: state_chg to RELEASING
 DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){RELEASING}: Terminating (cause = OSMO_FSM_TERM_REGULAR)
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ:trans-8:call-2147483649:RTP_TO_CN:no-CI){UNINITIALIZED}: Terminating in cascade, depth 2 (cause = OSMO_FSM_TERM_PARENT, caused by: call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ))
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ:trans-8:call-2147483649:RTP_TO_CN:no-CI){UNINITIALIZED}: Removing from parent call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ)
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ:trans-8:call-2147483649:RTP_TO_CN:no-CI){UNINITIALIZED}: Deferring: will deallocate with call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ)
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ:trans-8:call-2147483649:RTP_TO_RAN:no-CI:local-10-23-23-1-23){UNINITIALIZED}: Terminating in cascade, depth 2 (cause = OSMO_FSM_TERM_PARENT, caused by: call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ))
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ:trans-8:call-2147483649:RTP_TO_RAN:no-CI:local-10-23-23-1-23){UNINITIALIZED}: Removing from parent call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ)
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ:trans-8:call-2147483649:RTP_TO_RAN:no-CI:local-10-23-23-1-23){UNINITIALIZED}: Deferring: will deallocate with call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ)
 DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){RELEASING}: Removing from parent msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ)
 DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_RELEASING}: Received Event MSC_EV_CALL_LEG_TERM
-DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){RELEASING}: Deallocated
+DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){RELEASING}: Deallocated, including all deferred deallocations
 DREF msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_RELEASING}: + wait-Clear-Complete: now used by 1 (wait-Clear-Complete)
 DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_RELEASING}: RAN encode: CLEAR_COMMAND on UTRAN-Iu
 DMSC dummy_msc_i(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){0}: Received Event MSC_I_EV_FROM_A_FORWARD_ACCESS_SIGNALLING_REQUEST
@@ -726,6 +760,7 @@
 DMSC dummy_msc_i(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){0}: Received Event MSC_I_EV_FROM_A_FORWARD_ACCESS_SIGNALLING_REQUEST
 DREF VLR subscr IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100 - Paging: now used by 3 (attached,CC,active-conn)
 DREF msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_COMMUNICATING}: - paging-response: now used by 1 (cc)
+- MS confirms call, we create a RAN-side RTP and forward MNCC_CALL_CONF_IND
   MSC <--UTRAN-Iu-- MS: GSM48_MT_CC_CALL_CONF
 DREF msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_COMMUNICATING}: + rx_from_ms: now used by 2 (cc,rx_from_ms)
 DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_COMMUNICATING}: RAN decode: DTAP
@@ -737,10 +772,38 @@
 DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_COMMUNICATING}: Starting call assignment
 DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){ESTABLISHING}: Allocated
 DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){ESTABLISHING}: is child of msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP)
-  MS <--Call Assignment-- MSC: callref=0x423
+  MGW <--CRCX to RTP_TO_RAN-- MSC: callref=0x423
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){UNINITIALIZED}: Allocated
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){UNINITIALIZED}: is child of call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP)
 DMNCC trans(CC:MO_TERM_CALL_CONF IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) tx MNCC_CALL_CONF_IND
   MSC --> MNCC: callref 0x423: MNCC_CALL_CONF_IND
 DREF msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_COMMUNICATING}: - rx_from_ms: now used by 1 (cc)
+- MNCC sends MNCC_RTP_CREATE
+DMNCC trans(CC:MO_TERM_CALL_CONF IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) rx MNCC_RTP_CREATE
+DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_COMMUNICATING}: Assignment for this trans already started earlier
+- MGW acknowledges the CRCX to RAN, triggering Assignment
+  MGW --CRCX OK to RTP_TO_RAN--> MSC
+DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){ESTABLISHING}: Received Event CALL_LEG_EV_RTP_STREAM_ADDR_AVAILABLE
+DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_COMMUNICATING}: Received Event MSC_EV_CALL_LEG_RTP_LOCAL_ADDR_AVAILABLE
+DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_COMMUNICATING}: MGW endpoint's RTP address available for the CI RTP_TO_RAN: 10.23.23.1:23 (osmux=no:-2)
+DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_COMMUNICATING}: RAN encode: ASSIGNMENT_COMMAND on UTRAN-Iu
+DMSC dummy_msc_i(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){0}: Received Event MSC_I_EV_FROM_A_FORWARD_ACCESS_SIGNALLING_REQUEST
+- Assignment completes, triggering CRCX to CN
+DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_COMMUNICATING}: RAN decode: ASSIGNMENT_COMPLETE
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP:trans-0:call-1059:RTP_TO_RAN:no-CI){UNINITIALIZED}: setting codec to AMR/8000/1
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP:trans-0:call-1059:RTP_TO_RAN:no-CI:local-10-23-23-1-23){UNINITIALIZED}: setting remote addr to :0
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP:trans-0:call-1059:RTP_TO_RAN:no-CI:local-10-23-23-1-23){UNINITIALIZED}: Not committing: no MGW endpoint CI set up
+  MGW <--CRCX to RTP_TO_CN-- MSC: callref=0x423
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){UNINITIALIZED}: Allocated
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){UNINITIALIZED}: is child of call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP)
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP:trans-0:call-1059:RTP_TO_CN:no-CI){UNINITIALIZED}: setting codec to AMR/8000/1
+- When the CN side RTP address is known, send MNCC_RTP_CREATE
+  MGW --CRCX OK to RTP_TO_CN--> MSC
+DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){ESTABLISHING}: Received Event CALL_LEG_EV_RTP_STREAM_ADDR_AVAILABLE
+DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_COMMUNICATING}: Received Event MSC_EV_CALL_LEG_RTP_LOCAL_ADDR_AVAILABLE
+DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_COMMUNICATING}: MGW endpoint's RTP address available for the CI RTP_TO_CN: 10.23.23.1:23 (osmux=no:-2)
+DMNCC trans(CC:MO_TERM_CALL_CONF IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) tx MNCC_RTP_CREATE
+  MSC --> MNCC: callref 0x423: MNCC_RTP_CREATE
 - Total time passed: 1.000023 s
   MSC <--UTRAN-Iu-- MS: GSM48_MT_CC_ALERTING
 DREF msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_COMMUNICATING}: + rx_from_ms: now used by 2 (cc,rx_from_ms)
@@ -822,9 +885,15 @@
 DREF VLR subscr IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100 - vlr_subscr_cancel_attach_fsm: now used by 3 (attached,active-conn,msc_a_fsm_releasing_onenter)
 DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){ESTABLISHING}: state_chg to RELEASING
 DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){RELEASING}: Terminating (cause = OSMO_FSM_TERM_REGULAR)
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP:trans-0:call-1059:RTP_TO_CN:no-CI){UNINITIALIZED}: Terminating in cascade, depth 2 (cause = OSMO_FSM_TERM_PARENT, caused by: call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP))
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP:trans-0:call-1059:RTP_TO_CN:no-CI){UNINITIALIZED}: Removing from parent call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP)
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP:trans-0:call-1059:RTP_TO_CN:no-CI){UNINITIALIZED}: Deferring: will deallocate with call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP)
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP:trans-0:call-1059:RTP_TO_RAN:no-CI:local-10-23-23-1-23){UNINITIALIZED}: Terminating in cascade, depth 2 (cause = OSMO_FSM_TERM_PARENT, caused by: call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP))
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP:trans-0:call-1059:RTP_TO_RAN:no-CI:local-10-23-23-1-23){UNINITIALIZED}: Removing from parent call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP)
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP:trans-0:call-1059:RTP_TO_RAN:no-CI:local-10-23-23-1-23){UNINITIALIZED}: Deferring: will deallocate with call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP)
 DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){RELEASING}: Removing from parent msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP)
 DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_RELEASING}: Received Event MSC_EV_CALL_LEG_TERM
-DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){RELEASING}: Deallocated
+DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){RELEASING}: Deallocated, including all deferred deallocations
 DREF msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_RELEASING}: + wait-Clear-Complete: now used by 1 (wait-Clear-Complete)
 DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_RELEASING}: RAN encode: CLEAR_COMMAND on UTRAN-Iu
 DMSC dummy_msc_i(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){0}: Received Event MSC_I_EV_FROM_A_FORWARD_ACCESS_SIGNALLING_REQUEST
@@ -1154,6 +1223,7 @@
 DMSC dummy_msc_i(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){0}: Received Event MSC_I_EV_FROM_A_FORWARD_ACCESS_SIGNALLING_REQUEST
 DREF VLR subscr IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100 - Paging: now used by 3 (attached,CC,active-conn)
 DREF msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_COMMUNICATING}: - paging-response: now used by 1 (cc)
+- MS confirms call, we create a RAN-side RTP and forward MNCC_CALL_CONF_IND
   MSC <--UTRAN-Iu-- MS: GSM48_MT_CC_CALL_CONF
 DREF msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_COMMUNICATING}: + rx_from_ms: now used by 2 (cc,rx_from_ms)
 DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_COMMUNICATING}: RAN decode: DTAP
@@ -1165,10 +1235,38 @@
 DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_COMMUNICATING}: Starting call assignment
 DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){ESTABLISHING}: Allocated
 DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){ESTABLISHING}: is child of msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP)
-  MS <--Call Assignment-- MSC: callref=0x423
+  MGW <--CRCX to RTP_TO_RAN-- MSC: callref=0x423
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){UNINITIALIZED}: Allocated
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){UNINITIALIZED}: is child of call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP)
 DMNCC trans(CC:MO_TERM_CALL_CONF IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) tx MNCC_CALL_CONF_IND
   MSC --> MNCC: callref 0x423: MNCC_CALL_CONF_IND
 DREF msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_COMMUNICATING}: - rx_from_ms: now used by 1 (cc)
+- MNCC sends MNCC_RTP_CREATE
+DMNCC trans(CC:MO_TERM_CALL_CONF IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) rx MNCC_RTP_CREATE
+DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_COMMUNICATING}: Assignment for this trans already started earlier
+- MGW acknowledges the CRCX to RAN, triggering Assignment
+  MGW --CRCX OK to RTP_TO_RAN--> MSC
+DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){ESTABLISHING}: Received Event CALL_LEG_EV_RTP_STREAM_ADDR_AVAILABLE
+DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_COMMUNICATING}: Received Event MSC_EV_CALL_LEG_RTP_LOCAL_ADDR_AVAILABLE
+DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_COMMUNICATING}: MGW endpoint's RTP address available for the CI RTP_TO_RAN: 10.23.23.1:23 (osmux=no:-2)
+DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_COMMUNICATING}: RAN encode: ASSIGNMENT_COMMAND on UTRAN-Iu
+DMSC dummy_msc_i(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){0}: Received Event MSC_I_EV_FROM_A_FORWARD_ACCESS_SIGNALLING_REQUEST
+- Assignment completes, triggering CRCX to CN
+DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_COMMUNICATING}: RAN decode: ASSIGNMENT_COMPLETE
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP:trans-0:call-1059:RTP_TO_RAN:no-CI){UNINITIALIZED}: setting codec to AMR/8000/1
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP:trans-0:call-1059:RTP_TO_RAN:no-CI:local-10-23-23-1-23){UNINITIALIZED}: setting remote addr to :0
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP:trans-0:call-1059:RTP_TO_RAN:no-CI:local-10-23-23-1-23){UNINITIALIZED}: Not committing: no MGW endpoint CI set up
+  MGW <--CRCX to RTP_TO_CN-- MSC: callref=0x423
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){UNINITIALIZED}: Allocated
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){UNINITIALIZED}: is child of call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP)
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP:trans-0:call-1059:RTP_TO_CN:no-CI){UNINITIALIZED}: setting codec to AMR/8000/1
+- When the CN side RTP address is known, send MNCC_RTP_CREATE
+  MGW --CRCX OK to RTP_TO_CN--> MSC
+DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){ESTABLISHING}: Received Event CALL_LEG_EV_RTP_STREAM_ADDR_AVAILABLE
+DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_COMMUNICATING}: Received Event MSC_EV_CALL_LEG_RTP_LOCAL_ADDR_AVAILABLE
+DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_COMMUNICATING}: MGW endpoint's RTP address available for the CI RTP_TO_CN: 10.23.23.1:23 (osmux=no:-2)
+DMNCC trans(CC:MO_TERM_CALL_CONF IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) tx MNCC_RTP_CREATE
+  MSC --> MNCC: callref 0x423: MNCC_RTP_CREATE
 - Total time passed: 1.000023 s
   MSC <--UTRAN-Iu-- MS: GSM48_MT_CC_ALERTING
 DREF msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_COMMUNICATING}: + rx_from_ms: now used by 2 (cc,rx_from_ms)
@@ -1207,9 +1305,15 @@
 DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_RELEASING}: Received Event MSC_A_EV_UNUSED
 DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){ESTABLISHING}: state_chg to RELEASING
 DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){RELEASING}: Terminating (cause = OSMO_FSM_TERM_REGULAR)
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP:trans-0:call-1059:RTP_TO_CN:no-CI){UNINITIALIZED}: Terminating in cascade, depth 2 (cause = OSMO_FSM_TERM_PARENT, caused by: call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP))
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP:trans-0:call-1059:RTP_TO_CN:no-CI){UNINITIALIZED}: Removing from parent call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP)
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP:trans-0:call-1059:RTP_TO_CN:no-CI){UNINITIALIZED}: Deferring: will deallocate with call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP)
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP:trans-0:call-1059:RTP_TO_RAN:no-CI:local-10-23-23-1-23){UNINITIALIZED}: Terminating in cascade, depth 2 (cause = OSMO_FSM_TERM_PARENT, caused by: call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP))
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP:trans-0:call-1059:RTP_TO_RAN:no-CI:local-10-23-23-1-23){UNINITIALIZED}: Removing from parent call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP)
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP:trans-0:call-1059:RTP_TO_RAN:no-CI:local-10-23-23-1-23){UNINITIALIZED}: Deferring: will deallocate with call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP)
 DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){RELEASING}: Removing from parent msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP)
 DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_RELEASING}: Received Event MSC_EV_CALL_LEG_TERM
-DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){RELEASING}: Deallocated
+DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){RELEASING}: Deallocated, including all deferred deallocations
 DREF msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_RELEASING}: + wait-Clear-Complete: now used by 1 (wait-Clear-Complete)
 DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_RELEASING}: RAN encode: CLEAR_COMMAND on UTRAN-Iu
 DMSC dummy_msc_i(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){0}: Received Event MSC_I_EV_FROM_A_FORWARD_ACCESS_SIGNALLING_REQUEST
@@ -1540,6 +1644,37 @@
 DMNCC trans(CC:INITIATED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ callref-0x80000002 tid-8) tx MNCC_SETUP_IND
   MSC --> MNCC: callref 0x80000002: MNCC_SETUP_IND
 DREF msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_COMMUNICATING}: - rx_from_ms: now used by 1 (cc)
+- MNCC replies with MNCC_RTP_CREATE, causing MGW endpoint CRCX to RAN
+DMNCC trans(CC:INITIATED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ callref-0x80000002 tid-8) rx MNCC_RTP_CREATE
+DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_COMMUNICATING}: Starting call assignment
+DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){ESTABLISHING}: Allocated
+DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){ESTABLISHING}: is child of msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ)
+  MGW <--CRCX to RTP_TO_RAN-- MSC: callref=0x80000002
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){UNINITIALIZED}: Allocated
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){UNINITIALIZED}: is child of call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ)
+- MGW acknowledges the CRCX, triggering Assignment
+  MGW --CRCX OK to RTP_TO_RAN--> MSC
+DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){ESTABLISHING}: Received Event CALL_LEG_EV_RTP_STREAM_ADDR_AVAILABLE
+DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_COMMUNICATING}: Received Event MSC_EV_CALL_LEG_RTP_LOCAL_ADDR_AVAILABLE
+DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_COMMUNICATING}: MGW endpoint's RTP address available for the CI RTP_TO_RAN: 10.23.23.1:23 (osmux=no:-2)
+DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_COMMUNICATING}: RAN encode: ASSIGNMENT_COMMAND on UTRAN-Iu
+DMSC dummy_msc_i(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){0}: Received Event MSC_I_EV_FROM_A_FORWARD_ACCESS_SIGNALLING_REQUEST
+- Assignment succeeds, triggering CRCX to CN
+DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_COMMUNICATING}: RAN decode: ASSIGNMENT_COMPLETE
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ:trans-8:call-2147483650:RTP_TO_RAN:no-CI){UNINITIALIZED}: setting codec to AMR/8000/1
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ:trans-8:call-2147483650:RTP_TO_RAN:no-CI:local-10-23-23-1-23){UNINITIALIZED}: setting remote addr to :0
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ:trans-8:call-2147483650:RTP_TO_RAN:no-CI:local-10-23-23-1-23){UNINITIALIZED}: Not committing: no MGW endpoint CI set up
+  MGW <--CRCX to RTP_TO_CN-- MSC: callref=0x80000002
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){UNINITIALIZED}: Allocated
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){UNINITIALIZED}: is child of call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ)
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ:trans-8:call-2147483650:RTP_TO_CN:no-CI){UNINITIALIZED}: setting codec to AMR/8000/1
+- CN RTP address is available, trigger MNCC_RTP_CREATE
+  MGW --CRCX OK to RTP_TO_CN--> MSC
+DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){ESTABLISHING}: Received Event CALL_LEG_EV_RTP_STREAM_ADDR_AVAILABLE
+DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_COMMUNICATING}: Received Event MSC_EV_CALL_LEG_RTP_LOCAL_ADDR_AVAILABLE
+DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_COMMUNICATING}: MGW endpoint's RTP address available for the CI RTP_TO_CN: 10.23.23.1:23 (osmux=no:-2)
+DMNCC trans(CC:INITIATED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ callref-0x80000002 tid-8) tx MNCC_RTP_CREATE
+  MSC --> MNCC: callref 0x80000002: MNCC_RTP_CREATE
 - MNCC says that's fine
 DMNCC trans(CC:INITIATED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ callref-0x80000002 tid-8) rx MNCC_CALL_PROC_REQ
 DCC trans(CC:INITIATED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ callref-0x80000002 tid-8) stopping pending guard timer
@@ -1551,10 +1686,7 @@
 - DTAP --UTRAN-Iu--> MS: GSM48_MT_CC_CALL_PROC: 8302
 - DTAP matches expected message
 DMSC dummy_msc_i(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){0}: Received Event MSC_I_EV_FROM_A_FORWARD_ACCESS_SIGNALLING_REQUEST
-DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_COMMUNICATING}: Starting call assignment
-DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){ESTABLISHING}: Allocated
-DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){ESTABLISHING}: is child of msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ)
-  MS <--Call Assignment-- MSC: callref=0x80000002
+DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_COMMUNICATING}: Assignment for this trans already started earlier
 - But the other side's MSISDN could not be resolved, MNCC tells us to cancel
 DMNCC trans(CC:MO_CALL_PROC IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ callref-0x80000002 tid-8) rx MNCC_REL_REQ
 DCC trans(CC:MO_CALL_PROC IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ callref-0x80000002 tid-8) stopping pending guard timer
@@ -1596,9 +1728,15 @@
 DREF VLR subscr IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100 - vlr_subscr_cancel_attach_fsm: now used by 3 (attached,active-conn,msc_a_fsm_releasing_onenter)
 DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){ESTABLISHING}: state_chg to RELEASING
 DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){RELEASING}: Terminating (cause = OSMO_FSM_TERM_REGULAR)
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ:trans-8:call-2147483650:RTP_TO_CN:no-CI){UNINITIALIZED}: Terminating in cascade, depth 2 (cause = OSMO_FSM_TERM_PARENT, caused by: call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ))
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ:trans-8:call-2147483650:RTP_TO_CN:no-CI){UNINITIALIZED}: Removing from parent call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ)
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ:trans-8:call-2147483650:RTP_TO_CN:no-CI){UNINITIALIZED}: Deferring: will deallocate with call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ)
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ:trans-8:call-2147483650:RTP_TO_RAN:no-CI:local-10-23-23-1-23){UNINITIALIZED}: Terminating in cascade, depth 2 (cause = OSMO_FSM_TERM_PARENT, caused by: call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ))
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ:trans-8:call-2147483650:RTP_TO_RAN:no-CI:local-10-23-23-1-23){UNINITIALIZED}: Removing from parent call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ)
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ:trans-8:call-2147483650:RTP_TO_RAN:no-CI:local-10-23-23-1-23){UNINITIALIZED}: Deferring: will deallocate with call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ)
 DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){RELEASING}: Removing from parent msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ)
 DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_RELEASING}: Received Event MSC_EV_CALL_LEG_TERM
-DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){RELEASING}: Deallocated
+DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){RELEASING}: Deallocated, including all deferred deallocations
 DREF msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_RELEASING}: + wait-Clear-Complete: now used by 1 (wait-Clear-Complete)
 DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_RELEASING}: RAN encode: CLEAR_COMMAND on UTRAN-Iu
 DMSC dummy_msc_i(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){0}: Received Event MSC_I_EV_FROM_A_FORWARD_ACCESS_SIGNALLING_REQUEST
@@ -1928,6 +2066,37 @@
 DMNCC trans(CC:INITIATED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ callref-0x80000003 tid-8) tx MNCC_SETUP_IND
   MSC --> MNCC: callref 0x80000003: MNCC_SETUP_IND
 DREF msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_COMMUNICATING}: - rx_from_ms: now used by 1 (cc)
+- MNCC replies with MNCC_RTP_CREATE, causing MGW endpoint CRCX to RAN
+DMNCC trans(CC:INITIATED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ callref-0x80000003 tid-8) rx MNCC_RTP_CREATE
+DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_COMMUNICATING}: Starting call assignment
+DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){ESTABLISHING}: Allocated
+DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){ESTABLISHING}: is child of msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ)
+  MGW <--CRCX to RTP_TO_RAN-- MSC: callref=0x80000003
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){UNINITIALIZED}: Allocated
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){UNINITIALIZED}: is child of call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ)
+- MGW acknowledges the CRCX, triggering Assignment
+  MGW --CRCX OK to RTP_TO_RAN--> MSC
+DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){ESTABLISHING}: Received Event CALL_LEG_EV_RTP_STREAM_ADDR_AVAILABLE
+DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_COMMUNICATING}: Received Event MSC_EV_CALL_LEG_RTP_LOCAL_ADDR_AVAILABLE
+DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_COMMUNICATING}: MGW endpoint's RTP address available for the CI RTP_TO_RAN: 10.23.23.1:23 (osmux=no:-2)
+DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_COMMUNICATING}: RAN encode: ASSIGNMENT_COMMAND on UTRAN-Iu
+DMSC dummy_msc_i(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){0}: Received Event MSC_I_EV_FROM_A_FORWARD_ACCESS_SIGNALLING_REQUEST
+- Assignment succeeds, triggering CRCX to CN
+DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_COMMUNICATING}: RAN decode: ASSIGNMENT_COMPLETE
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ:trans-8:call-2147483651:RTP_TO_RAN:no-CI){UNINITIALIZED}: setting codec to AMR/8000/1
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ:trans-8:call-2147483651:RTP_TO_RAN:no-CI:local-10-23-23-1-23){UNINITIALIZED}: setting remote addr to :0
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ:trans-8:call-2147483651:RTP_TO_RAN:no-CI:local-10-23-23-1-23){UNINITIALIZED}: Not committing: no MGW endpoint CI set up
+  MGW <--CRCX to RTP_TO_CN-- MSC: callref=0x80000003
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){UNINITIALIZED}: Allocated
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){UNINITIALIZED}: is child of call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ)
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ:trans-8:call-2147483651:RTP_TO_CN:no-CI){UNINITIALIZED}: setting codec to AMR/8000/1
+- CN RTP address is available, trigger MNCC_RTP_CREATE
+  MGW --CRCX OK to RTP_TO_CN--> MSC
+DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){ESTABLISHING}: Received Event CALL_LEG_EV_RTP_STREAM_ADDR_AVAILABLE
+DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_COMMUNICATING}: Received Event MSC_EV_CALL_LEG_RTP_LOCAL_ADDR_AVAILABLE
+DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_COMMUNICATING}: MGW endpoint's RTP address available for the CI RTP_TO_CN: 10.23.23.1:23 (osmux=no:-2)
+DMNCC trans(CC:INITIATED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ callref-0x80000003 tid-8) tx MNCC_RTP_CREATE
+  MSC --> MNCC: callref 0x80000003: MNCC_RTP_CREATE
 - MNCC says that's fine
 DMNCC trans(CC:INITIATED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ callref-0x80000003 tid-8) rx MNCC_CALL_PROC_REQ
 DCC trans(CC:INITIATED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ callref-0x80000003 tid-8) stopping pending guard timer
@@ -1939,10 +2108,7 @@
 - DTAP --UTRAN-Iu--> MS: GSM48_MT_CC_CALL_PROC: 8302
 - DTAP matches expected message
 DMSC dummy_msc_i(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){0}: Received Event MSC_I_EV_FROM_A_FORWARD_ACCESS_SIGNALLING_REQUEST
-DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_COMMUNICATING}: Starting call assignment
-DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){ESTABLISHING}: Allocated
-DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){ESTABLISHING}: is child of msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ)
-  MS <--Call Assignment-- MSC: callref=0x80000003
+DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_COMMUNICATING}: Assignment for this trans already started earlier
 - But the other side's MSISDN could not be resolved, MNCC tells us to cancel
 DMNCC trans(CC:MO_CALL_PROC IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ callref-0x80000003 tid-8) rx MNCC_REL_REQ
 DCC trans(CC:MO_CALL_PROC IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ callref-0x80000003 tid-8) stopping pending guard timer
@@ -1980,9 +2146,15 @@
 DREF VLR subscr IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100 - vlr_subscr_cancel_attach_fsm: now used by 3 (attached,active-conn,msc_a_fsm_releasing_onenter)
 DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){ESTABLISHING}: state_chg to RELEASING
 DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){RELEASING}: Terminating (cause = OSMO_FSM_TERM_REGULAR)
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ:trans-8:call-2147483651:RTP_TO_CN:no-CI){UNINITIALIZED}: Terminating in cascade, depth 2 (cause = OSMO_FSM_TERM_PARENT, caused by: call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ))
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ:trans-8:call-2147483651:RTP_TO_CN:no-CI){UNINITIALIZED}: Removing from parent call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ)
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ:trans-8:call-2147483651:RTP_TO_CN:no-CI){UNINITIALIZED}: Deferring: will deallocate with call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ)
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ:trans-8:call-2147483651:RTP_TO_RAN:no-CI:local-10-23-23-1-23){UNINITIALIZED}: Terminating in cascade, depth 2 (cause = OSMO_FSM_TERM_PARENT, caused by: call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ))
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ:trans-8:call-2147483651:RTP_TO_RAN:no-CI:local-10-23-23-1-23){UNINITIALIZED}: Removing from parent call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ)
+DCC rtp_stream(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ:trans-8:call-2147483651:RTP_TO_RAN:no-CI:local-10-23-23-1-23){UNINITIALIZED}: Deferring: will deallocate with call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ)
 DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){RELEASING}: Removing from parent msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ)
 DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_RELEASING}: Received Event MSC_EV_CALL_LEG_TERM
-DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){RELEASING}: Deallocated
+DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){RELEASING}: Deallocated, including all deferred deallocations
 DREF msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_RELEASING}: + wait-Clear-Complete: now used by 1 (wait-Clear-Complete)
 DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_RELEASING}: RAN encode: CLEAR_COMMAND on UTRAN-Iu
 DMSC dummy_msc_i(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){0}: Received Event MSC_I_EV_FROM_A_FORWARD_ACCESS_SIGNALLING_REQUEST
diff --git a/tests/msc_vlr/msc_vlr_tests.c b/tests/msc_vlr/msc_vlr_tests.c
index 3d69ae8..de4913a 100644
--- a/tests/msc_vlr/msc_vlr_tests.c
+++ b/tests/msc_vlr/msc_vlr_tests.c
@@ -73,11 +73,19 @@
 bool bssap_clear_expected = false;
 bool bssap_clear_sent = false;
 
+bool bssap_assignment_expected = false;
+bool bssap_assignment_sent = false;
+bool iu_rab_assignment_expected = false;
+bool iu_rab_assignment_sent = false;
+
 uint32_t cc_to_mncc_tx_expected_msg_type = 0;
 const char *cc_to_mncc_tx_expected_imsi = NULL;
 bool cc_to_mncc_tx_confirmed = false;
 uint32_t cc_to_mncc_tx_got_callref = 0;
 
+enum rtp_direction expecting_crcx = -1;
+bool got_crcx = false;
+
 extern int ran_dec_dtap_undup_pdisc_ctr_bin(uint8_t pdisc);
 
 /* static state variables for the L3 send sequence numbers */
@@ -296,6 +304,20 @@
 	return 0;
 }
 
+static void bssap_validate_assignment_cmd()
+{
+	OSMO_ASSERT(bssap_assignment_expected);
+	bssap_assignment_expected = false;
+	bssap_assignment_sent = true;
+}
+
+static void iucs_validate_assignment_cmd()
+{
+	OSMO_ASSERT(iu_rab_assignment_expected);
+	iu_rab_assignment_expected = false;
+	iu_rab_assignment_sent = true;
+}
+
 static int iucs_validate_security_mode_ctrl(const struct ran_cipher_mode_command *cmd)
 {
 	const char *got_ik;
@@ -346,6 +368,18 @@
 			OSMO_ASSERT(false);
 		}
 		break;
+	case RAN_MSG_ASSIGNMENT_COMMAND:
+		switch (ran_type) {
+		case OSMO_RAT_GERAN_A:
+			bssap_validate_assignment_cmd();
+			break;
+		case OSMO_RAT_UTRAN_IU:
+			iucs_validate_assignment_cmd();
+			break;
+		default:
+			OSMO_ASSERT(false);
+		}
+		break;
 	default:
 		break;
 	}
@@ -602,6 +636,14 @@
 	bssap_clear_sent = false;
 
 	osmo_gettimeofday_override = false;
+
+	expecting_crcx = -1;
+	got_crcx = false;
+
+	bssap_assignment_expected = false;
+	bssap_assignment_sent = false;
+	iu_rab_assignment_expected = false;
+	iu_rab_assignment_sent = false;
 }
 
 static struct log_info_cat test_categories[] = {
@@ -763,14 +805,73 @@
 	return 0;
 }
 
-/* override, requires '-Wl,--wrap=call_leg_ensure_ci' */
-int __real_call_leg_ensure_ci(struct call_leg *cl, enum rtp_direction dir, uint32_t call_id, struct gsm_trans *for_trans);
-int __wrap_call_leg_ensure_ci(struct call_leg *cl, enum rtp_direction dir, uint32_t call_id, struct gsm_trans *for_trans)
+struct rtp_stream fake_rtp[2] = {
+	{
+		.dir = RTP_TO_RAN,
+		.local = {
+			.ip = "10.23.42.1",
+			.port = 99,
+		},
+		.remote = {
+			.ip = "10.23.42.2",
+			.port = 100,
+		},
+	},
+	{
+		.dir = RTP_TO_CN,
+		.local = {
+			.ip = "10.23.42.1",
+			.port = 23,
+		},
+		.remote = {
+			.ip = "10.23.42.2",
+			.port = 42,
+		},
+	},
+};
+
+void expect_crcx(enum rtp_direction towards)
 {
-	log("MS <--Call Assignment-- MSC: callref=0x%x", call_id);
+	OSMO_ASSERT(expecting_crcx == -1);
+	expecting_crcx = towards;
+	got_crcx = false;
+}
+
+/* override, requires '-Wl,--wrap=call_leg_ensure_ci' */
+int __real_call_leg_ensure_ci(struct call_leg *cl, enum rtp_direction dir, uint32_t call_id, struct gsm_trans *for_trans,
+			      const enum mgcp_codecs *codec_if_known, const struct osmo_sockaddr_str *remote_addr_if_known);
+int __wrap_call_leg_ensure_ci(struct call_leg *cl, enum rtp_direction dir, uint32_t call_id, struct gsm_trans *for_trans,
+			      const enum mgcp_codecs *codec_if_known, const struct osmo_sockaddr_str *remote_addr_if_known)
+{
+	if (!cl->rtp[dir]) {
+		log("MGW <--CRCX to %s-- MSC: callref=0x%x", rtp_direction_name(dir), call_id);
+
+		OSMO_ASSERT(expecting_crcx == dir);
+		expecting_crcx = -1;
+		got_crcx = true;
+
+		call_leg_ensure_rtp_alloc(cl, dir, call_id, for_trans);
+		if (codec_if_known)
+			rtp_stream_set_codec(cl->rtp[dir], *codec_if_known);
+		if (remote_addr_if_known && osmo_sockaddr_str_is_nonzero(remote_addr_if_known))
+			rtp_stream_set_remote_addr(cl->rtp[dir], remote_addr_if_known);
+	}
+
 	return 0;
 }
 
+void crcx_ok(enum rtp_direction dir)
+{
+	struct msc_a *msc_a = msub_msc_a(g_msub);
+	struct call_leg *cl = msc_a->cc.call_leg;
+	OSMO_ASSERT(cl);
+	OSMO_ASSERT(cl->rtp[dir]);
+	osmo_sockaddr_str_from_str(&cl->rtp[dir]->local, "10.23.23.1", 23);
+	//osmo_sockaddr_str_from_str(&cl->rtp[dir].remote, "10.42.42.1", 42);
+	log("MGW --CRCX OK to %s--> MSC", rtp_direction_name(dir));
+	osmo_fsm_inst_dispatch(cl->fi, CALL_LEG_EV_RTP_STREAM_ADDR_AVAILABLE, cl->rtp[dir]);
+}
+
 static int fake_vlr_tx_lu_acc(void *msc_conn_ref, uint32_t send_tmsi)
 {
 	struct msc_a *msc_a = msc_conn_ref;
@@ -895,6 +996,22 @@
 		g_msub = NULL;
 }
 
+void ms_sends_assignment_complete(enum mgcp_codecs assigned_codec)
+{
+	struct ran_msg ran_dec;
+
+	ran_dec = (struct ran_msg){
+		.msg_type = RAN_MSG_ASSIGNMENT_COMPLETE,
+		.assignment_complete = {
+			.codec = assigned_codec,
+		},
+	};
+	fake_msc_a_ran_dec(&ran_dec);
+
+	if (!conn_exists(g_msub))
+		g_msub = NULL;
+}
+
 void ran_sends_clear_complete()
 {
 	struct ran_msg ran_dec;
diff --git a/tests/msc_vlr/msc_vlr_tests.h b/tests/msc_vlr/msc_vlr_tests.h
index 9df9cf0..57022b4 100644
--- a/tests/msc_vlr/msc_vlr_tests.h
+++ b/tests/msc_vlr/msc_vlr_tests.h
@@ -31,6 +31,8 @@
 #include <osmocom/msc/msub.h>
 #include <osmocom/msc/msc_a.h>
 #include <osmocom/msc/mncc.h>
+#include <osmocom/msc/call_leg.h>
+#include <osmocom/msc/rtp_stream.h>
 
 extern bool _log_lines;
 #define _log(fmt, args...) do { \
@@ -140,6 +142,23 @@
 	}
 }
 
+extern bool bssap_assignment_expected;
+extern bool bssap_assignment_sent;
+extern bool iu_rab_assignment_expected;
+extern bool iu_rab_assignment_sent;
+
+static inline void expect_bssap_assignment()
+{
+	bssap_assignment_expected = true;
+	bssap_assignment_sent = false;
+}
+
+static inline void expect_iu_rab_assignment()
+{
+	iu_rab_assignment_expected = true;
+	iu_rab_assignment_sent = false;
+}
+
 struct msc_vlr_test_cmdline_opts {
 	bool verbose;
 	int run_test_nr;
@@ -163,10 +182,12 @@
 void ms_sends_classmark_update(const struct osmo_gsm48_classmark *classmark);
 void ms_sends_ciphering_mode_complete(const char *inner_nas_msg);
 void ms_sends_security_mode_complete();
+void ms_sends_assignment_complete(enum mgcp_codecs assigned_codec);
 void gsup_rx(const char *rx_hex, const char *expect_tx_hex);
 void send_sms(struct vlr_subscr *receiver,
 	      struct vlr_subscr *sender,
 	      char *str);
+void crcx_ok(enum rtp_direction dir);
 
 void ran_sends_clear_complete();
 
@@ -248,3 +269,6 @@
 #define VLR_TO_HLR "0a0101"
 #define EUSE_TO_MSC_USSD "0a0103"
 #define MSC_USSD_TO_EUSE "0a0103"
+
+extern bool got_crcx;
+void expect_crcx(enum rtp_direction towards);