diff --git a/openbsc/tests/gbproxy/gbproxy_test.c b/openbsc/tests/gbproxy/gbproxy_test.c
index 16dbf5b..350c9f0 100644
--- a/openbsc/tests/gbproxy/gbproxy_test.c
+++ b/openbsc/tests/gbproxy/gbproxy_test.c
@@ -3247,6 +3247,8 @@
 	unsigned bss_nu = 0;
 	unsigned sgsn_nu = 0;
 
+	LLIST_HEAD(rcv_list);
+
 	OSMO_ASSERT(local_tlli == gprs_tmsi2tlli(ptmsi, TLLI_LOCAL));
 
 	bssgp_nsi = nsi;
@@ -3288,11 +3290,15 @@
 
 	printf("--- Send message from BSS 1 to SGSN, BVCI 0x1002 ---\n\n");
 
+	received_messages = &rcv_list;
+
 	send_llc_ul_ui(nsi, "ATTACH REQUEST", &bss_peer[0], 0x1002,
 		       foreign_tlli, &rai_bss, cell_id,
 		       GPRS_SAPI_GMM, bss_nu++,
 		       dtap_attach_req, sizeof(dtap_attach_req));
 
+	OSMO_ASSERT(expect_gmm_msg(0x1000, 0x1002, GSM48_MT_GMM_ID_REQ));
+
 	dump_peers(stdout, 0, 0, &gbcfg);
 
 	link_info = gbproxy_link_info_by_tlli(peer, foreign_tlli);
@@ -3306,6 +3312,8 @@
 		       GPRS_SAPI_GMM, bss_nu++,
 		       dtap_identity_resp, sizeof(dtap_identity_resp));
 
+	OSMO_ASSERT(expect_gmm_msg(SGSN_NSEI, 0x1002, GSM48_MT_GMM_ATTACH_REQ));
+
 	dump_peers(stdout, 0, 0, &gbcfg);
 
 	link_info = gbproxy_link_info_by_tlli(peer, foreign_tlli);
@@ -3318,6 +3326,8 @@
 		       GPRS_SAPI_GMM, sgsn_nu++,
 		       dtap_identity_req, sizeof(dtap_identity_req));
 
+	OSMO_ASSERT(expect_gmm_msg(0x1000, 0x1002, GSM48_MT_GMM_ID_REQ));
+
 	dump_peers(stdout, 0, 0, &gbcfg);
 
 	send_llc_ul_ui(nsi, "IDENT RESPONSE", &bss_peer[0], 0x1002,
@@ -3325,6 +3335,8 @@
 		       GPRS_SAPI_GMM, bss_nu++,
 		       dtap_identity_resp, sizeof(dtap_identity_resp));
 
+	OSMO_ASSERT(expect_gmm_msg(SGSN_NSEI, 0x1002, GSM48_MT_GMM_ID_RESP));
+
 	dump_peers(stdout, 0, 0, &gbcfg);
 
 	link_info = gbproxy_link_info_by_tlli(peer, foreign_tlli);
@@ -3337,6 +3349,8 @@
 		       GPRS_SAPI_GMM, sgsn_nu++,
 		       dtap_attach_acc, sizeof(dtap_attach_acc));
 
+	OSMO_ASSERT(expect_gmm_msg(0x1000, 0x1002, GSM48_MT_GMM_ATTACH_ACK));
+
 	dump_peers(stdout, 0, 0, &gbcfg);
 
 	send_llc_ul_ui(nsi, "ATTACH COMPLETE", &bss_peer[0], 0x1002,
@@ -3344,6 +3358,8 @@
 		       GPRS_SAPI_GMM, bss_nu++,
 		       dtap_attach_complete, sizeof(dtap_attach_complete));
 
+	OSMO_ASSERT(expect_gmm_msg(SGSN_NSEI, 0x1002, GSM48_MT_GMM_ATTACH_COMPL));
+
 	dump_peers(stdout, 0, 0, &gbcfg);
 
 	send_llc_dl_ui(nsi, "GMM INFO", &sgsn_peer, 0x1002,
@@ -3351,6 +3367,8 @@
 		       GPRS_SAPI_GMM, sgsn_nu++,
 		       dtap_gmm_information, sizeof(dtap_gmm_information));
 
+	OSMO_ASSERT(expect_gmm_msg(0x1000, 0x1002, GSM48_MT_GMM_INFO));
+
 	dump_peers(stdout, 0, 0, &gbcfg);
 
 	link_info = gbproxy_link_info_by_tlli(peer, local_tlli);
@@ -3362,6 +3380,8 @@
 		       GPRS_SAPI_GMM, bss_nu++,
 		       dtap_detach_req, sizeof(dtap_detach_req));
 
+	OSMO_ASSERT(expect_gmm_msg(SGSN_NSEI, 0x1002, GSM48_MT_GMM_DETACH_REQ));
+
 	link_info = gbproxy_link_info_by_tlli(peer, local_tlli);
 	OSMO_ASSERT(link_info);
 
@@ -3372,6 +3392,8 @@
 		       GPRS_SAPI_GMM, sgsn_nu++,
 		       dtap_detach_acc, sizeof(dtap_detach_acc));
 
+	OSMO_ASSERT(expect_gmm_msg(0x1000, 0x1002, GSM48_MT_GMM_DETACH_ACK));
+
 	dump_peers(stdout, 0, 0, &gbcfg);
 
 	OSMO_ASSERT(!gbproxy_link_info_by_tlli(peer, local_tlli));
@@ -3379,12 +3401,16 @@
 	OSMO_ASSERT(link_info);
 	OSMO_ASSERT(link_info->is_deregistered);
 
+	OSMO_ASSERT(!expect_msg());
+
 	/* Re-Attach */
 	send_llc_ul_ui(nsi, "ATTACH REQUEST", &bss_peer[0], 0x1002,
 		       foreign_tlli, &rai_bss, cell_id,
 		       GPRS_SAPI_GMM, bss_nu++,
 		       dtap_attach_req3, sizeof(dtap_attach_req3));
 
+	OSMO_ASSERT(expect_gmm_msg(SGSN_NSEI, 0x1002, GSM48_MT_GMM_ATTACH_REQ));
+
 	dump_peers(stdout, 0, 0, &gbcfg);
 
 	link_info2 = gbproxy_link_info_by_imsi(peer, imsi, sizeof(imsi));
@@ -3400,6 +3426,8 @@
 		       GPRS_SAPI_GMM, sgsn_nu++,
 		       dtap_attach_acc, sizeof(dtap_attach_acc));
 
+	OSMO_ASSERT(expect_gmm_msg(0x1000, 0x1002, GSM48_MT_GMM_ATTACH_ACK));
+
 	dump_peers(stdout, 0, 0, &gbcfg);
 
 	send_llc_ul_ui(nsi, "ATTACH COMPLETE", &bss_peer[0], 0x1002,
@@ -3407,6 +3435,8 @@
 		       GPRS_SAPI_GMM, bss_nu++,
 		       dtap_attach_complete, sizeof(dtap_attach_complete));
 
+	OSMO_ASSERT(expect_gmm_msg(SGSN_NSEI, 0x1002, GSM48_MT_GMM_ATTACH_COMPL));
+
 	dump_peers(stdout, 0, 0, &gbcfg);
 
 	/* Detach (MT) */
@@ -3415,16 +3445,21 @@
 		       GPRS_SAPI_GMM, sgsn_nu++,
 		       dtap_mt_detach_rea_req, sizeof(dtap_mt_detach_rea_req));
 
+	OSMO_ASSERT(expect_gmm_msg(0x1000, 0x1002, GSM48_MT_GMM_DETACH_REQ));
+
 	dump_peers(stdout, 0, 0, &gbcfg);
 
 	link_info = gbproxy_link_info_by_tlli(peer, local_tlli);
 	OSMO_ASSERT(link_info);
 
-	send_llc_ul_ui(nsi, "DETACH ACC", &sgsn_peer, 0x1002,
+	send_llc_ul_ui(nsi, "DETACH ACC", &bss_peer[0], 0x1002,
 		       local_tlli, &rai_bss, cell_id,
 		       GPRS_SAPI_GMM, bss_nu++,
 		       dtap_mt_detach_acc, sizeof(dtap_mt_detach_acc));
 
+	OSMO_ASSERT(expect_gmm_msg(SGSN_NSEI, 0x1002, GSM48_MT_GMM_DETACH_ACK));
+	OSMO_ASSERT(!expect_msg());
+
 	dump_peers(stdout, 0, 0, &gbcfg);
 
 	OSMO_ASSERT(!gbproxy_link_info_by_tlli(peer, local_tlli));
@@ -3438,6 +3473,8 @@
 		       GPRS_SAPI_GMM, bss_nu++,
 		       dtap_attach_req3, sizeof(dtap_attach_req3));
 
+	OSMO_ASSERT(expect_gmm_msg(SGSN_NSEI, 0x1002, GSM48_MT_GMM_ATTACH_REQ));
+
 	dump_peers(stdout, 0, 0, &gbcfg);
 
 	link_info2 = gbproxy_link_info_by_imsi(peer, imsi, sizeof(imsi));
@@ -3453,6 +3490,8 @@
 		       GPRS_SAPI_GMM, sgsn_nu++,
 		       dtap_attach_acc, sizeof(dtap_attach_acc));
 
+	OSMO_ASSERT(expect_gmm_msg(0x1000, 0x1002, GSM48_MT_GMM_ATTACH_ACK));
+
 	dump_peers(stdout, 0, 0, &gbcfg);
 
 	send_llc_ul_ui(nsi, "ATTACH COMPLETE", &bss_peer[0], 0x1002,
@@ -3460,6 +3499,8 @@
 		       GPRS_SAPI_GMM, bss_nu++,
 		       dtap_attach_complete, sizeof(dtap_attach_complete));
 
+	OSMO_ASSERT(expect_gmm_msg(SGSN_NSEI, 0x1002, GSM48_MT_GMM_ATTACH_COMPL));
+
 	dump_peers(stdout, 0, 0, &gbcfg);
 
 	/* Detach (MT) */
@@ -3468,16 +3509,21 @@
 		       GPRS_SAPI_GMM, sgsn_nu++,
 		       dtap_mt_detach_req, sizeof(dtap_mt_detach_req));
 
+	OSMO_ASSERT(expect_gmm_msg(0x1000, 0x1002, GSM48_MT_GMM_DETACH_REQ));
+
 	dump_peers(stdout, 0, 0, &gbcfg);
 
 	link_info = gbproxy_link_info_by_tlli(peer, local_tlli);
 	OSMO_ASSERT(link_info);
 
-	send_llc_ul_ui(nsi, "DETACH ACC", &sgsn_peer, 0x1002,
+	send_llc_ul_ui(nsi, "DETACH ACC", &bss_peer[0], 0x1002,
 		       local_tlli, &rai_bss, cell_id,
 		       GPRS_SAPI_GMM, bss_nu++,
 		       dtap_mt_detach_acc, sizeof(dtap_mt_detach_acc));
 
+	OSMO_ASSERT(expect_gmm_msg(SGSN_NSEI, 0x1002, GSM48_MT_GMM_DETACH_ACK));
+	OSMO_ASSERT(!expect_msg());
+
 	dump_peers(stdout, 0, 0, &gbcfg);
 
 	OSMO_ASSERT(!gbproxy_link_info_by_tlli(peer, local_tlli));
@@ -3491,6 +3537,8 @@
 		       GPRS_SAPI_GMM, bss_nu++,
 		       dtap_attach_req3, sizeof(dtap_attach_req3));
 
+	OSMO_ASSERT(expect_gmm_msg(SGSN_NSEI, 0x1002, GSM48_MT_GMM_ATTACH_REQ));
+
 	dump_peers(stdout, 0, 0, &gbcfg);
 
 	link_info2 = gbproxy_link_info_by_imsi(peer, imsi, sizeof(imsi));
@@ -3506,6 +3554,8 @@
 		       GPRS_SAPI_GMM, sgsn_nu++,
 		       dtap_attach_acc, sizeof(dtap_attach_acc));
 
+	OSMO_ASSERT(expect_gmm_msg(0x1000, 0x1002, GSM48_MT_GMM_ATTACH_ACK));
+
 	dump_peers(stdout, 0, 0, &gbcfg);
 
 	send_llc_ul_ui(nsi, "ATTACH COMPLETE", &bss_peer[0], 0x1002,
@@ -3513,6 +3563,8 @@
 		       GPRS_SAPI_GMM, bss_nu++,
 		       dtap_attach_complete, sizeof(dtap_attach_complete));
 
+	OSMO_ASSERT(expect_gmm_msg(SGSN_NSEI, 0x1002, GSM48_MT_GMM_ATTACH_COMPL));
+
 	dump_peers(stdout, 0, 0, &gbcfg);
 
 	/* RA update procedure (reject -> Detach) */
@@ -3521,11 +3573,16 @@
 		       GPRS_SAPI_GMM, bss_nu++,
 		       dtap_ra_upd_req, sizeof(dtap_ra_upd_req));
 
+	OSMO_ASSERT(expect_gmm_msg(SGSN_NSEI, 0x1002, GSM48_MT_GMM_RA_UPD_REQ));
+
 	send_llc_dl_ui(nsi, "RA UDP REJ", &sgsn_peer, 0x1002,
 		       local_tlli, 1, imsi, sizeof(imsi),
 		       GPRS_SAPI_GMM, sgsn_nu++,
 		       dtap_ra_upd_rej, sizeof(dtap_ra_upd_rej));
 
+	OSMO_ASSERT(expect_gmm_msg(0x1000, 0x1002, GSM48_MT_GMM_RA_UPD_REJ));
+	OSMO_ASSERT(!expect_msg());
+
 	dump_peers(stdout, 0, 0, &gbcfg);
 
 	OSMO_ASSERT(!gbproxy_link_info_by_tlli(peer, local_tlli));
@@ -3539,6 +3596,8 @@
 		       GPRS_SAPI_GMM, bss_nu++,
 		       dtap_attach_req, sizeof(dtap_attach_req));
 
+	OSMO_ASSERT(expect_gmm_msg(0x1000, 0x1002, GSM48_MT_GMM_ID_REQ));
+
 	dump_peers(stdout, 0, 0, &gbcfg);
 
 	link_info2 = gbproxy_link_info_by_imsi(peer, imsi, sizeof(imsi));
@@ -3554,6 +3613,8 @@
 		       GPRS_SAPI_GMM, bss_nu++,
 		       dtap_identity_resp, sizeof(dtap_identity_resp));
 
+	OSMO_ASSERT(expect_gmm_msg(SGSN_NSEI, 0x1002, GSM48_MT_GMM_ATTACH_REQ));
+
 	dump_peers(stdout, 0, 0, &gbcfg);
 
 	link_info2 = gbproxy_link_info_by_imsi(peer, imsi, sizeof(imsi));
@@ -3569,6 +3630,8 @@
 		       GPRS_SAPI_GMM, sgsn_nu++,
 		       dtap_attach_acc, sizeof(dtap_attach_acc));
 
+	OSMO_ASSERT(expect_gmm_msg(0x1000, 0x1002, GSM48_MT_GMM_ATTACH_ACK));
+
 	dump_peers(stdout, 0, 0, &gbcfg);
 
 	link_info2 = gbproxy_link_info_by_imsi(peer, imsi, sizeof(imsi));
@@ -3582,6 +3645,8 @@
 		       GPRS_SAPI_GMM, bss_nu++,
 		       dtap_attach_complete, sizeof(dtap_attach_complete));
 
+	OSMO_ASSERT(expect_gmm_msg(SGSN_NSEI, 0x1002, GSM48_MT_GMM_ATTACH_COMPL));
+
 	dump_peers(stdout, 0, 0, &gbcfg);
 
 	/* Detach (MT) */
@@ -3590,16 +3655,20 @@
 		       GPRS_SAPI_GMM, sgsn_nu++,
 		       dtap_mt_detach_req, sizeof(dtap_mt_detach_req));
 
+	OSMO_ASSERT(expect_gmm_msg(0x1000, 0x1002, GSM48_MT_GMM_DETACH_REQ));
+
 	dump_peers(stdout, 0, 0, &gbcfg);
 
 	link_info = gbproxy_link_info_by_tlli(peer, local_tlli);
 	OSMO_ASSERT(link_info);
 
-	send_llc_ul_ui(nsi, "DETACH ACC", &sgsn_peer, 0x1002,
+	send_llc_ul_ui(nsi, "DETACH ACC", &bss_peer[0], 0x1002,
 		       local_tlli, &rai_bss, cell_id,
 		       GPRS_SAPI_GMM, bss_nu++,
 		       dtap_mt_detach_acc, sizeof(dtap_mt_detach_acc));
 
+	OSMO_ASSERT(expect_gmm_msg(SGSN_NSEI, 0x1002, GSM48_MT_GMM_DETACH_ACK));
+
 	dump_peers(stdout, 0, 0, &gbcfg);
 
 	OSMO_ASSERT(!gbproxy_link_info_by_tlli(peer, local_tlli));
@@ -3607,6 +3676,8 @@
 	OSMO_ASSERT(link_info);
 	OSMO_ASSERT(link_info->is_deregistered);
 
+	OSMO_ASSERT(!expect_msg());
+
 	/* Attach rejected */
 
 	gbproxy_delete_link_infos(peer);
@@ -3616,6 +3687,8 @@
 		       GPRS_SAPI_GMM, bss_nu++,
 		       dtap_attach_req, sizeof(dtap_attach_req));
 
+	OSMO_ASSERT(expect_gmm_msg(0x1000, 0x1002, GSM48_MT_GMM_ID_REQ));
+
 	dump_peers(stdout, 0, 0, &gbcfg);
 
 	link_info = gbproxy_link_info_by_tlli(peer, foreign_tlli);
@@ -3629,6 +3702,8 @@
 		       GPRS_SAPI_GMM, bss_nu++,
 		       dtap_identity_resp, sizeof(dtap_identity_resp));
 
+	OSMO_ASSERT(expect_gmm_msg(SGSN_NSEI, 0x1002, GSM48_MT_GMM_ATTACH_REQ));
+
 	dump_peers(stdout, 0, 0, &gbcfg);
 
 	link_info2 = gbproxy_link_info_by_imsi(peer, imsi, sizeof(imsi));
@@ -3644,10 +3719,14 @@
 		       GPRS_SAPI_GMM, sgsn_nu++,
 		       dtap_attach_rej7, sizeof(dtap_attach_rej7));
 
+	OSMO_ASSERT(expect_gmm_msg(0x1000, 0x1002, GSM48_MT_GMM_ATTACH_REJ));
+
 	dump_peers(stdout, 0, 0, &gbcfg);
 
 	OSMO_ASSERT(!gbproxy_link_info_by_tlli(peer, foreign_tlli));
 
+	OSMO_ASSERT(!expect_msg());
+
 	/* Attach (incomplete) and Detach (MO) */
 
 	gbproxy_delete_link_infos(peer);
@@ -3657,6 +3736,8 @@
 		       GPRS_SAPI_GMM, bss_nu++,
 		       dtap_attach_req, sizeof(dtap_attach_req));
 
+	OSMO_ASSERT(expect_gmm_msg(0x1000, 0x1002, GSM48_MT_GMM_ID_REQ));
+
 	dump_peers(stdout, 0, 0, &gbcfg);
 
 	link_info = gbproxy_link_info_by_tlli(peer, foreign_tlli);
@@ -3670,8 +3751,12 @@
 		       GPRS_SAPI_GMM, bss_nu++,
 		       dtap_detach_req, sizeof(dtap_detach_req));
 
+	OSMO_ASSERT(expect_gmm_msg(0x1000, 0x1002, GSM48_MT_GMM_DETACH_ACK));
+
 	dump_peers(stdout, 0, 0, &gbcfg);
 
+	OSMO_ASSERT(!expect_msg());
+
 	/* Attach (incomplete) and Detach (MT) */
 
 	gbproxy_delete_link_infos(peer);
@@ -3681,6 +3766,8 @@
 		       GPRS_SAPI_GMM, bss_nu++,
 		       dtap_attach_req, sizeof(dtap_attach_req));
 
+	OSMO_ASSERT(expect_gmm_msg(0x1000, 0x1002, GSM48_MT_GMM_ID_REQ));
+
 	dump_peers(stdout, 0, 0, &gbcfg);
 
 	link_info = gbproxy_link_info_by_tlli(peer, foreign_tlli);
@@ -3694,16 +3781,23 @@
 		       GPRS_SAPI_GMM, sgsn_nu++,
 		       dtap_mt_detach_req, sizeof(dtap_mt_detach_req));
 
+	OSMO_ASSERT(expect_gmm_msg(0x1000, 0x1002, GSM48_MT_GMM_DETACH_REQ));
+
 	dump_peers(stdout, 0, 0, &gbcfg);
 
 	link_info = gbproxy_link_info_by_tlli(peer, foreign_tlli);
 	OSMO_ASSERT(link_info);
 
-	send_llc_ul_ui(nsi, "DETACH ACC", &sgsn_peer, 0x1002,
+	send_llc_ul_ui(nsi, "DETACH ACC", &bss_peer[0], 0x1002,
 		       foreign_tlli, &rai_bss, cell_id,
 		       GPRS_SAPI_GMM, bss_nu++,
 		       dtap_mt_detach_acc, sizeof(dtap_mt_detach_acc));
 
+	/* TODO: The stored messaged should be cleaned when receiving a Detach
+	 * Ack. Remove the first OSMO_ASSERT when this is fixed. */
+	OSMO_ASSERT(expect_gmm_msg(SGSN_NSEI, 0x1002, GSM48_MT_GMM_ATTACH_REQ));
+	OSMO_ASSERT(expect_gmm_msg(SGSN_NSEI, 0x1002, GSM48_MT_GMM_DETACH_ACK));
+
 	dump_peers(stdout, 0, 0, &gbcfg);
 
 	OSMO_ASSERT(!gbproxy_link_info_by_tlli(peer, foreign_tlli));
@@ -3711,6 +3805,9 @@
 	OSMO_ASSERT(link_info);
 	OSMO_ASSERT(link_info->is_deregistered);
 
+	OSMO_ASSERT(!expect_msg());
+	received_messages = NULL;
+
 	dump_global(stdout, 0);
 
 	gbprox_reset(&gbcfg);