diff --git a/src/libmsc/gsm_04_11_gsup.c b/src/libmsc/gsm_04_11_gsup.c
index b4d74c7..331092a 100644
--- a/src/libmsc/gsm_04_11_gsup.c
+++ b/src/libmsc/gsm_04_11_gsup.c
@@ -117,19 +117,13 @@
 }
 
 /* Triggers either RP-ACK or RP-ERROR on response from SMSC */
-static int gsm411_gsup_mo_handler(struct vlr_subscr *vsub,
-	const struct osmo_gsup_message *gsup_msg)
+static int gsm411_gsup_mo_handler(struct gsm_network *net, struct vlr_subscr *vsub,
+				  const struct osmo_gsup_message *gsup_msg)
 {
-	struct vlr_instance *vlr;
-	struct gsm_network *net;
 	struct gsm_trans *trans;
 	const char *msg_name;
 	bool msg_is_err;
 
-	/* Obtain required pointers */
-	vlr = vsub->vlr;
-	net = (struct gsm_network *) vlr->user_ctx;
-
 	/* Associate logging messages with this subscriber */
 	log_set_context(LOG_CTX_VLR_SUBSCR, vsub);
 
@@ -230,16 +224,12 @@
 }
 
 /* Handles MT SMS (and triggers Paging Request if required) */
-static int gsm411_gsup_mt_handler(struct vlr_subscr *vsub,
-	const struct osmo_gsup_message *gsup_msg)
+static int gsm411_gsup_mt_handler(struct gsm_network *net, struct vlr_subscr *vsub,
+				  const struct osmo_gsup_message *gsup_msg)
 {
-	struct gsm_network *net;
 	bool sm_rp_mmts_ind;
 	int rc;
 
-	/* Obtain required pointers */
-	net = (struct gsm_network *) vsub->vlr->user_ctx;
-
 	/* Associate logging messages with this subscriber */
 	log_set_context(LOG_CTX_VLR_SUBSCR, vsub);
 
@@ -296,8 +286,8 @@
 
 int gsm411_gsup_rx(struct gsup_client_mux *gcm, void *data, const struct osmo_gsup_message *gsup_msg)
 {
-	struct vlr_instance *vlr = data;
-	struct vlr_subscr *vsub = vlr_subscr_find_by_imsi(vlr, gsup_msg->imsi, __func__);
+	struct gsm_network *net = (struct gsm_network *) data;
+	struct vlr_subscr *vsub = vlr_subscr_find_by_imsi(net->vlr, gsup_msg->imsi, __func__);
 
 	if (!vsub) {
 		LOGP(DLSMS, LOGL_ERROR, "Rx %s for unknown subscriber, rejecting\n",
@@ -313,12 +303,12 @@
 	case OSMO_GSUP_MSGT_READY_FOR_SM_ERROR:
 	case OSMO_GSUP_MSGT_READY_FOR_SM_RESULT:
 		DEBUGP(DMSC, "Routed to GSM 04.11 MO handler\n");
-		return gsm411_gsup_mo_handler(vsub, gsup_msg);
+		return gsm411_gsup_mo_handler(net, vsub, gsup_msg);
 
 	/* GSM 04.11 code implementing MT SMS */
 	case OSMO_GSUP_MSGT_MT_FORWARD_SM_REQUEST:
 		DEBUGP(DMSC, "Routed to GSM 04.11 MT handler\n");
-		return gsm411_gsup_mt_handler(vsub, gsup_msg);
+		return gsm411_gsup_mt_handler(net, vsub, gsup_msg);
 
 	default:
 		LOGP(DMM, LOGL_ERROR, "No handler found for %s, dropping message...\n",
diff --git a/src/libmsc/gsm_09_11.c b/src/libmsc/gsm_09_11.c
index f85c3f6..51cb2fb 100644
--- a/src/libmsc/gsm_09_11.c
+++ b/src/libmsc/gsm_09_11.c
@@ -402,14 +402,13 @@
 
 int gsm0911_gsup_rx(struct gsup_client_mux *gcm, void *data, const struct osmo_gsup_message *gsup_msg)
 {
-	struct vlr_instance *vlr = data;
-	struct gsm_network *net;
+	struct gsm_network *net = (struct gsm_network *) data;
 	struct gsm_trans *trans;
 	struct gsm48_hdr *gh;
 	struct msgb *ss_msg;
 	bool trans_end;
 	struct msc_a *msc_a;
-	struct vlr_subscr *vsub = vlr_subscr_find_by_imsi(vlr, gsup_msg->imsi, __func__);
+	struct vlr_subscr *vsub = vlr_subscr_find_by_imsi(net->vlr, gsup_msg->imsi, __func__);
 
 	if (!vsub) {
 		LOGP(DSS, LOGL_ERROR, "Rx %s for unknown subscriber, rejecting\n",
@@ -421,14 +420,6 @@
 	/* Associate logging messages with this subscriber */
 	log_set_context(LOG_CTX_VLR_SUBSCR, vsub);
 
-	/* Obtain pointer to vlr_instance */
-	vlr = vsub->vlr;
-	OSMO_ASSERT(vlr);
-
-	/* Obtain pointer to gsm_network */
-	net = (struct gsm_network *) vlr->user_ctx;
-	OSMO_ASSERT(net);
-
 	/* Handle errors */
 	if (OSMO_GSUP_IS_MSGT_ERROR(gsup_msg->message_type)) {
 		/* FIXME: handle this error somehow! */
diff --git a/src/libmsc/msc_net_init.c b/src/libmsc/msc_net_init.c
index 637ee74..4a752bf 100644
--- a/src/libmsc/msc_net_init.c
+++ b/src/libmsc/msc_net_init.c
@@ -117,8 +117,8 @@
 		.rx_cb = {
 			/* vlr.c sets up its own cb and data */
 			/* MSC-A and MSC-B set up their own cb and data */
-			[OSMO_GSUP_MESSAGE_CLASS_SMS] = { .func = gsm411_gsup_rx, .data = net->vlr },
-			[OSMO_GSUP_MESSAGE_CLASS_USSD] = { .func = gsm0911_gsup_rx, .data = net->vlr },
+			[OSMO_GSUP_MESSAGE_CLASS_SMS] = { .func = gsm411_gsup_rx, .data = net },
+			[OSMO_GSUP_MESSAGE_CLASS_USSD] = { .func = gsm0911_gsup_rx, .data = net },
 		},
 	};