diff --git a/src/bts.cpp b/src/bts.cpp
index 3b27676..07ea77c 100644
--- a/src/bts.cpp
+++ b/src/bts.cpp
@@ -1007,7 +1007,7 @@
 		     "SBFn=%u TRX=%u TS=%u\n", sb_fn, pdch->trx->trx_no, pdch->ts_no);
 		bts_do_rate_ctr_inc(bts, CTR_IMMEDIATE_ASSIGN_UL_TBF_TWO_PHASE);
 	} else {
-		GprsMs *ms = bts_alloc_ms(bts);
+		GprsMs *ms = ms_alloc(bts);
 		ms_set_egprs_ms_class(ms, chan_req.egprs_mslot_class);
 		tbf = ms_new_ul_tbf_assigned_agch(ms);
 		if (!tbf) {
@@ -1198,36 +1198,6 @@
 	}
 }
 
-static void bts_ms_idle_cb(struct GprsMs *ms)
-{
-	bts_stat_item_dec(ms->bts, STAT_MS_PRESENT);
-	if (ms_is_idle(ms))
-		talloc_free(ms);
-}
-
-static void bts_ms_active_cb(struct GprsMs *ms)
-{
-	/* Nothing to do */
-}
-
-GprsMs *bts_alloc_ms(struct gprs_rlcmac_bts* bts)
-{
-	struct GprsMs *ms;
-
-	static struct gpr_ms_callback bts_ms_cb = {
-		.ms_idle = bts_ms_idle_cb,
-		.ms_active = bts_ms_active_cb,
-	};
-
-	ms = ms_alloc(bts);
-
-	ms_set_callback(ms, &bts_ms_cb);
-	ms_set_timeout(ms, osmo_tdef_get(bts->pcu->T_defs, -2030, OSMO_TDEF_S, -1));
-
-	bts_stat_item_inc(bts, STAT_MS_PRESENT);
-	return ms;
-}
-
 struct GprsMs *bts_get_ms(const struct gprs_rlcmac_bts *bts, uint32_t tlli, uint32_t old_tlli,
 			  const char *imsi)
 {
diff --git a/src/bts.h b/src/bts.h
index 5644b44..7dd8547 100644
--- a/src/bts.h
+++ b/src/bts.h
@@ -285,7 +285,6 @@
 	struct osmo_mobile_identity mi_imsi;
 };
 
-struct GprsMs *bts_alloc_ms(struct gprs_rlcmac_bts *bts);
 int bts_add_paging(struct gprs_rlcmac_bts *bts, const struct paging_req_cs *req, struct GprsMs *ms);
 
 uint32_t bts_rfn_to_fn(const struct gprs_rlcmac_bts *bts, uint32_t rfn);
diff --git a/src/gprs_ms.c b/src/gprs_ms.c
index 3e95103..b9a1b76 100644
--- a/src/gprs_ms.c
+++ b/src/gprs_ms.c
@@ -63,7 +63,8 @@
 
 void gprs_default_cb_ms_idle(struct GprsMs *ms)
 {
-	talloc_free(ms);
+	if (ms_is_idle(ms))
+		talloc_free(ms);
 }
 
 void gprs_default_cb_ms_active(struct GprsMs *ms)
@@ -111,6 +112,7 @@
 	talloc_set_destructor(ms, ms_talloc_destructor);
 
 	llist_add(&ms->list, &bts->ms_list);
+	bts_stat_item_inc(bts, STAT_MS_PRESENT);
 
 	ms->bts = bts;
 	ms->cb = gprs_default_cb;
@@ -147,6 +149,8 @@
 	if (!ms->ctrs)
 		goto free_ret;
 
+	ms_set_timeout(ms, osmo_tdef_get(bts->pcu->T_defs, -2030, OSMO_TDEF_S, -1));
+
 	return ms;
 free_ret:
 	talloc_free(ms);
@@ -159,6 +163,7 @@
 
 	LOGPMS(ms, DRLCMAC, LOGL_INFO, "Destroying MS object\n");
 
+	bts_stat_item_dec(ms->bts, STAT_MS_PRESENT);
 	llist_del(&ms->list);
 
 	ms_set_reserved_slots(ms, NULL, 0, 0);
diff --git a/src/pdch.cpp b/src/pdch.cpp
index 43b3936..1c39ceb 100644
--- a/src/pdch.cpp
+++ b/src/pdch.cpp
@@ -665,7 +665,7 @@
 		uint32_t tlli = request->ID.u.TLLI;
 		ms = bts_get_ms_by_tlli(bts, tlli, GSM_RESERVED_TMSI);
 		if (!ms) {
-			ms = bts_alloc_ms(bts);
+			ms = ms_alloc(bts);
 			ms_set_tlli(ms, tlli);
 		}
 	} else if (request->ID.u.Global_TFI.UnionType) { /* ID_TYPE = DL_TFI */
@@ -857,7 +857,7 @@
 	if (!ms) {
 		LOGPDCH(this, DRLCMAC, LOGL_NOTICE, "MS send measurement "
 			"but TLLI 0x%08x is unknown\n", report->TLLI);
-		ms = bts_alloc_ms(bts());
+		ms = ms_alloc(bts());
 		ms_set_tlli(ms, report->TLLI);
 	}
 	if ((poll = pdch_ulc_get_node(ulc, fn))) {
diff --git a/src/tbf_dl.cpp b/src/tbf_dl.cpp
index cca059a..cdd703c 100644
--- a/src/tbf_dl.cpp
+++ b/src/tbf_dl.cpp
@@ -216,7 +216,7 @@
 	}
 
 	if (!ms)
-		ms = bts_alloc_ms(bts);
+		ms = ms_alloc(bts);
 	if (imsi)
 		ms_set_imsi(ms, imsi);
 	ms_confirm_tlli(ms, tlli);