ms: Hold a reference during ms_alloc

Make the caller hold a reference to the MS object just allocated, so
that it hs to explicitly unref it and, in turn, if no new references
were added during its use, trigger release of the MS object.
This is useful to avoid leaking MS object if it was allocated and then
no TBF is attached to it because allocation of TBF failed.

Related: OS#6002
Change-Id: I2088a7ddd76fe9157b6626ef96ae4315e88779ea
diff --git a/src/bts.cpp b/src/bts.cpp
index 40541c5..4cbe68e 100644
--- a/src/bts.cpp
+++ b/src/bts.cpp
@@ -1006,9 +1006,13 @@
 		     "SBFn=%u TRX=%u TS=%u\n", sb_fn, pdch->trx->trx_no, pdch->ts_no);
 		bts_do_rate_ctr_inc(bts, CTR_IMMEDIATE_ASSIGN_UL_TBF_TWO_PHASE);
 	} else {
-		GprsMs *ms = ms_alloc(bts);
+		GprsMs *ms = ms_alloc(bts, __func__);
 		ms_set_egprs_ms_class(ms, chan_req.egprs_mslot_class);
 		tbf = ms_new_ul_tbf_assigned_agch(ms);
+		/* Here either tbf was created and it holds a ref to MS, or tbf
+		 * creation failed and MS will end up without references and being
+		 * freed: */
+		ms_unref(ms, __func__);
 		if (!tbf) {
 			/* Send RR Immediate Assignment Reject */
 			rc = -EBUSY;
diff --git a/src/gprs_ms.c b/src/gprs_ms.c
index 6d7018f..7df71e8 100644
--- a/src/gprs_ms.c
+++ b/src/gprs_ms.c
@@ -122,7 +122,7 @@
 }
 
 static int ms_talloc_destructor(struct GprsMs *ms);
-struct GprsMs *ms_alloc(struct gprs_rlcmac_bts *bts)
+struct GprsMs *ms_alloc(struct gprs_rlcmac_bts *bts, const char *use_ref)
 {
 	struct GprsMs *ms = talloc_zero(tall_pcu_ctx, struct GprsMs);
 	OSMO_ASSERT(bts);
@@ -172,6 +172,8 @@
 
 	ms_set_timeout(ms, osmo_tdef_get(bts->pcu->T_defs, -2030, OSMO_TDEF_S, -1));
 
+	if (use_ref)
+		ms_ref(ms, use_ref);
 	return ms;
 free_ret:
 	talloc_free(ms);
diff --git a/src/gprs_ms.h b/src/gprs_ms.h
index cdb23bf..03508ff 100644
--- a/src/gprs_ms.h
+++ b/src/gprs_ms.h
@@ -95,7 +95,7 @@
 	struct nacc_fsm_ctx *nacc;
 };
 
-struct GprsMs *ms_alloc(struct gprs_rlcmac_bts *bts);
+struct GprsMs *ms_alloc(struct gprs_rlcmac_bts *bts, const char *use_ref);
 
 struct gprs_rlcmac_pdch *ms_first_common_ts(const struct GprsMs *ms);
 void ms_set_first_common_ts(struct GprsMs *ms, struct gprs_rlcmac_pdch *pdch);
diff --git a/src/pdch.cpp b/src/pdch.cpp
index 4495e21..a8becca 100644
--- a/src/pdch.cpp
+++ b/src/pdch.cpp
@@ -665,7 +665,9 @@
 		uint32_t tlli = request->ID.u.TLLI;
 		ms = bts_get_ms_by_tlli(bts, tlli, GSM_RESERVED_TMSI);
 		if (!ms) {
-			ms = ms_alloc(bts);
+			/* A reference is already hold immediately below in all cases, no
+			 * need to hold and extra one, pass use_ref=NULL: */
+			ms = ms_alloc(bts, NULL);
 			ms_set_tlli(ms, tlli);
 		}
 	} else if (request->ID.u.Global_TFI.UnionType) { /* ID_TYPE = DL_TFI */
@@ -852,13 +854,16 @@
 	struct gprs_rlcmac_sba *sba;
 	struct pdch_ulc_node *poll;
 	GprsMs *ms;
+	bool ms_allocated = false;
 
 	ms = bts_get_ms_by_tlli(bts(), report->TLLI, GSM_RESERVED_TMSI);
 	if (!ms) {
 		LOGPDCH(this, DRLCMAC, LOGL_NOTICE, "MS send measurement "
 			"but TLLI 0x%08x is unknown\n", report->TLLI);
-		ms = ms_alloc(bts());
+		ms = ms_alloc(bts(), __func__);
 		ms_set_tlli(ms, report->TLLI);
+		/* Track that we need to free ref at the end: */
+		ms_allocated = true;
 	}
 	if ((poll = pdch_ulc_get_node(ulc, fn))) {
 		switch (poll->type) {
@@ -879,6 +884,8 @@
 		}
 	}
 	gprs_rlcmac_meas_rep(ms, report);
+	if (ms_allocated)
+		ms_unref(ms, __func__);
 }
 
 void gprs_rlcmac_pdch::rcv_cell_change_notification(Packet_Cell_Change_Notification_t *notif,
diff --git a/src/tbf_dl.cpp b/src/tbf_dl.cpp
index 628d593..17b6a3a 100644
--- a/src/tbf_dl.cpp
+++ b/src/tbf_dl.cpp
@@ -201,27 +201,31 @@
 {
 	int rc;
 	GprsMs *ms, *ms_old;
+	bool ms_allocated = false;
 
 	/* check for existing TBF */
 	ms = bts_get_ms(bts, tlli, tlli_old, imsi);
 
 	/* If we got MS by TLLI above let's see if we already have another MS
 	 * object identified by IMSI and merge them */
-	if (ms && !ms_imsi_is_valid(ms) && imsi) {
-		ms_old = bts_get_ms_by_imsi(bts, imsi);
-		if (ms_old && ms_old != ms) {
-			/* The TLLI has changed (RAU), so there are two MS
-			 * objects for the same MS */
-			LOGP(DTBF, LOGL_NOTICE,
-			     "There is a new MS object for the same MS: (0x%08x, '%s') -> (0x%08x, '%s')\n",
-			     ms_tlli(ms_old), ms_imsi(ms_old), ms_tlli(ms), ms_imsi(ms));
-			ms_merge_and_clear_ms(ms, ms_old);
-			/* old_ms may no longer be available here */
+	if (ms) {
+		if (!ms_imsi_is_valid(ms) && imsi) {
+			ms_old = bts_get_ms_by_imsi(bts, imsi);
+			if (ms_old && ms_old != ms) {
+				/* The TLLI has changed (RAU), so there are two MS
+				* objects for the same MS */
+				LOGP(DTBF, LOGL_NOTICE,
+				"There is a new MS object for the same MS: (0x%08x, '%s') -> (0x%08x, '%s')\n",
+				ms_tlli(ms_old), ms_imsi(ms_old), ms_tlli(ms), ms_imsi(ms));
+				ms_merge_and_clear_ms(ms, ms_old);
+				/* old_ms may no longer be available here */
+			}
 		}
+	} else {
+		ms = ms_alloc(bts, __func__);
+		/* Remember we have to unref the alloc reference at the end: */
+		ms_allocated = true;
 	}
-
-	if (!ms)
-		ms = ms_alloc(bts);
 	if (imsi)
 		ms_set_imsi(ms, imsi);
 	ms_confirm_tlli(ms, tlli);
@@ -233,9 +237,12 @@
 	}
 
 	rc = ms_append_llc_dl_data(ms, delay_csec, data, len);
-	if (rc < 0)
-		return rc;
-	return 0;
+	if (ms_allocated) {
+		ms_unref(ms, __func__);
+		/* Here "ms" may be freed if ms_append_llc_dl_data() failed to
+		 * allocate a DL TBF and it has no more TBFs attached */
+	}
+	return rc;
 }
 
 bool gprs_rlcmac_dl_tbf::restart_bsn_cycle()
diff --git a/tests/alloc/AllocTest.cpp b/tests/alloc/AllocTest.cpp
index 065a257..8a67152 100644
--- a/tests/alloc/AllocTest.cpp
+++ b/tests/alloc/AllocTest.cpp
@@ -135,8 +135,9 @@
 	 * least this part is working okay.
 	 */
 	for (i = 0; i < (int)ARRAY_SIZE(tbfs); ++i) {
-		ms = ms_alloc(bts);
+		ms = ms_alloc(bts, __func__);
 		tbfs[i] = tbf_alloc(bts, ms, dir, -1, 0);
+		ms_unref(ms, __func__);
 		if (tbfs[i] == NULL)
 			break;
 
@@ -155,7 +156,7 @@
 		if (tbfs[i])
 			tbf_free(tbfs[i]);
 
-	ms = ms_alloc(bts);
+	ms = ms_alloc(bts, NULL);
 	tbfs[0] = tbf_alloc(bts, ms, dir, -1, 0);
 	OSMO_ASSERT(tbfs[0]);
 	tbf_free(tbfs[0]);
@@ -221,13 +222,15 @@
 
 	enable_ts_on_bts(bts, ts0, ts1, ts2, ts3, ts4, ts5, ts6, ts7);
 
-	ms = ms_alloc(bts);
+	ms = ms_alloc(bts, __func__);
 	ms_set_ms_class(ms, ms_class);
 	/* Avoid delaying free to avoid tons of to-be-freed ms objects queuing */
 	ms_set_timeout(ms, 0);
 	ul_tbf = ul_tbf_alloc(bts, ms, -1, true);
-	if (!ul_tbf)
+	if (!ul_tbf) {
+		ms_unref(ms, __func__);
 		return false;
+	}
 
 	OSMO_ASSERT(ul_tbf->ms());
 	OSMO_ASSERT(ms_current_trx(ul_tbf->ms()));
@@ -236,13 +239,16 @@
 
 	/* assume final ack has not been sent */
 	dl_tbf = dl_tbf_alloc(bts, ms, ms_current_trx(ms)->trx_no, false);
-	if (!dl_tbf)
+	if (!dl_tbf) {
+		ms_unref(ms, __func__);
 		return false;
+	}
 
 	dump_assignment(dl_tbf, "DL", verbose);
 
 	check_tfi_usage(bts);
 
+	ms_unref(ms, __func__);
 	tbf_free(dl_tbf);
 	tbf_free(ul_tbf);
 	talloc_free(bts);
@@ -264,13 +270,15 @@
 
 	enable_ts_on_bts(bts, ts0, ts1, ts2, ts3, ts4, ts5, ts6, ts7);
 
-	ms = ms_alloc(bts);
+	ms = ms_alloc(bts, __func__);
 	ms_set_ms_class(ms, ms_class);
 	/* Avoid delaying free to avoid tons of to-be-freed ms objects queuing */
 	ms_set_timeout(ms, 0);
 	dl_tbf = dl_tbf_alloc(bts, ms, -1, true);
-	if (!dl_tbf)
+	if (!dl_tbf) {
+		ms_unref(ms, __func__);
 		return false;
+	}
 
 	ms_confirm_tlli(ms, 0x23);
 	OSMO_ASSERT(dl_tbf->ms() == ms);
@@ -279,8 +287,10 @@
 	dump_assignment(dl_tbf, "DL", verbose);
 
 	ul_tbf = ul_tbf_alloc(bts, ms, ms_current_trx(ms)->trx_no, false);
-	if (!ul_tbf)
+	if (!ul_tbf) {
+		ms_unref(ms, __func__);
 		return false;
+	}
 
 	ms_update_announced_tlli(ms, 0x23);
 	ul_tbf->m_contention_resolution_done = true;
@@ -293,6 +303,7 @@
 
 	check_tfi_usage(bts);
 
+	ms_unref(ms, __func__);
 	tbf_free(dl_tbf);
 	tbf_free(ul_tbf);
 	talloc_free(bts);
@@ -315,13 +326,15 @@
 
 	tfi = bts_tfi_find_free(bts, GPRS_RLCMAC_UL_TBF, &trx_no, -1);
 	OSMO_ASSERT(tfi >= 0);
-	ms = ms_alloc(bts);
+	ms = ms_alloc(bts, __func__);
 	ms_set_ms_class(ms, ms_class);
 	/* Avoid delaying free to avoid tons of to-be-freed ms objects queuing */
 	ms_set_timeout(ms, 0);
 	ul_tbf = ul_tbf_alloc(bts, ms, -1, false);
-	if (!ul_tbf)
+	if (!ul_tbf) {
+		ms_unref(ms, __func__);
 		return false;
+	}
 
 	OSMO_ASSERT(ul_tbf->ms() == ms);
 	OSMO_ASSERT(ms_current_trx(ul_tbf->ms()));
@@ -330,13 +343,16 @@
 
 	/* assume final ack has not been sent */
 	dl_tbf = dl_tbf_alloc(bts, ms, trx_no, false);
-	if (!dl_tbf)
+	if (!dl_tbf) {
+		ms_unref(ms, __func__);
 		return false;
+	}
 
 	dump_assignment(dl_tbf, "DL", true);
 
 	check_tfi_usage(bts);
 
+	ms_unref(ms, __func__);
 	tbf_free(dl_tbf);
 	tbf_free(ul_tbf);
 	talloc_free(bts);
@@ -561,7 +577,7 @@
 
 		ms = bts_get_ms_by_tlli(bts, tlli, GSM_RESERVED_TMSI);
 		if (!ms)
-			ms = ms_alloc(bts);
+			ms = ms_alloc(bts, NULL);
 		ms_set_ms_class(ms, ms_class);
 		ms = alloc_tbfs(bts, ms, mode);
 		if (!ms)
@@ -770,7 +786,7 @@
 	trx->pdch[6].enable();
 	trx->pdch[7].enable();
 
-	ms = ms_alloc(bts);
+	ms = ms_alloc(bts, NULL);
 	ms_set_ms_class(ms, ms_class);
 	ms_set_egprs_ms_class(ms, egprs_ms_class);
 	dl_tbf1 = dl_tbf_alloc(bts, ms, 0, false);
@@ -783,7 +799,7 @@
 	OSMO_ASSERT(numTs1 == 4);
 	printf("TBF1: numTs(%d)\n", numTs1);
 
-	ms = ms_alloc(bts);
+	ms = ms_alloc(bts, NULL);
 	ms_set_ms_class(ms, ms_class);
 	ms_set_egprs_ms_class(ms, egprs_ms_class);
 	dl_tbf2 = dl_tbf_alloc(bts, ms, 0, false);
diff --git a/tests/app_info/AppInfoTest.cpp b/tests/app_info/AppInfoTest.cpp
index ea84b20..cb11d0f 100644
--- a/tests/app_info/AppInfoTest.cpp
+++ b/tests/app_info/AppInfoTest.cpp
@@ -90,11 +90,11 @@
 	trx->pdch[6].enable();
 	trx->pdch[7].enable();
 
-	ms1 = ms_alloc(bts);
+	ms1 = ms_alloc(bts, NULL);
 	ms_set_ms_class(ms1, 10);
 	ms_set_egprs_ms_class(ms1, 11);
 	tbf1 = dl_tbf_alloc(bts, ms1, 0, false);
-	ms2 = ms_alloc(bts);
+	ms2 = ms_alloc(bts, NULL);
 	ms_set_ms_class(ms2, 12);
 	ms_set_egprs_ms_class(ms2, 13);
 	tbf2 = dl_tbf_alloc(bts, ms2, 0, false);
diff --git a/tests/llc/LlcTest.cpp b/tests/llc/LlcTest.cpp
index ee227f9..3ceb17b 100644
--- a/tests/llc/LlcTest.cpp
+++ b/tests/llc/LlcTest.cpp
@@ -52,7 +52,7 @@
 	the_pcu = gprs_pcu_alloc(tall_pcu_ctx);
 	the_pcu->vty.llc_codel_interval_msec = LLC_CODEL_DISABLE;
 	struct gprs_rlcmac_bts *bts = bts_alloc(the_pcu, 0);
-	struct GprsMs *ms = ms_alloc(bts);
+	struct GprsMs *ms = ms_alloc(bts, NULL);
 	return ms_llc_queue(ms);
 }
 
@@ -235,7 +235,7 @@
 	/* DEFAULT should be resolved to GPRS_CODEL_SLOW_INTERVAL_MS 4000 */
 	#define GPRS_CODEL_SLOW_INTERVAL_MS 4000
 	struct gprs_rlcmac_bts *bts = bts_alloc(the_pcu, 0);
-	struct GprsMs *ms = ms_alloc(bts);
+	struct GprsMs *ms = ms_alloc(bts, NULL);
 	gprs_llc_queue *queue = ms_llc_queue(ms);
 	unsigned int i;
 
@@ -297,7 +297,7 @@
 static void test_llc_merge()
 {
 	gprs_llc_queue *queue1 = prepare_queue();
-	struct GprsMs *ms = ms_alloc(queue1->ms->bts);
+	struct GprsMs *ms = ms_alloc(queue1->ms->bts, NULL);
 	gprs_llc_queue *queue2 = ms_llc_queue(ms);
 	struct timespec expire_time = {0};
 
diff --git a/tests/ms/MsTest.cpp b/tests/ms/MsTest.cpp
index bc68c3d..7b7d59a 100644
--- a/tests/ms/MsTest.cpp
+++ b/tests/ms/MsTest.cpp
@@ -85,7 +85,7 @@
 
 	printf("=== start %s ===\n", __func__);
 
-	ms = ms_alloc(bts);
+	ms = ms_alloc(bts, __func__);
 	ms_set_tlli(ms, tlli);
 	OSMO_ASSERT(ms_is_idle(ms));
 
@@ -105,6 +105,9 @@
 	OSMO_ASSERT(ms_tbf(ms, GPRS_RLCMAC_UL_TBF) == ul_tbf);
 	OSMO_ASSERT(ms_tbf(ms, GPRS_RLCMAC_DL_TBF) == dl_tbf);
 
+	/* The MS is kept alive references by the TBFs: */
+	ms_unref(ms, __func__);
+
 	ms_detach_tbf(ms, ul_tbf);
 	OSMO_ASSERT(!ms_is_idle(ms));
 	OSMO_ASSERT(ms_ul_tbf(ms) == NULL);
@@ -130,7 +133,7 @@
 
 	printf("=== start %s ===\n", __func__);
 
-	ms = ms_alloc(bts);
+	ms = ms_alloc(bts, __func__);
 	ms_confirm_tlli(ms, tlli);
 
 	OSMO_ASSERT(ms_is_idle(ms));
@@ -157,6 +160,8 @@
 	OSMO_ASSERT(ms_dl_tbf(ms) == dl_tbf[1]);
 	OSMO_ASSERT(!llist_empty(&ms->old_tbfs));
 
+	ms_unref(ms, __func__);
+
 	ms_detach_tbf(ms, ul_tbf);
 	OSMO_ASSERT(!ms_is_idle(ms));
 	OSMO_ASSERT(ms_ul_tbf(ms) == NULL);
@@ -190,7 +195,7 @@
 
 	printf("=== start %s ===\n", __func__);
 
-	ms = ms_alloc(bts);
+	ms = ms_alloc(bts, __func__);
 
 	OSMO_ASSERT(ms_is_idle(ms));
 
@@ -267,7 +272,9 @@
 	OSMO_ASSERT(ms_check_tlli(ms, new_ms_tlli));
 	OSMO_ASSERT(!ms_check_tlli(ms, start_tlli));
 
-	talloc_free(ms);
+	/* This frees the MS: */
+	ms_unref(ms, __func__);
+
 	talloc_free(bts);
 	printf("=== end %s ===\n", __func__);
 }
@@ -278,7 +285,7 @@
 	if (ms)
 		return ms;
 
-	ms = ms_alloc(bts);
+	ms = ms_alloc(bts, NULL);
 
 	if (dir == GPRS_RLCMAC_UL_TBF)
 		ms_set_tlli(ms, tlli);
@@ -371,7 +378,7 @@
 
 	printf("=== start %s ===\n", __func__);
 
-	ms = ms_alloc(bts);
+	ms = ms_alloc(bts, __func__);
 	ms_set_tlli(ms, tlli);
 	ms_set_timeout(ms, 1);
 
@@ -386,6 +393,9 @@
 	ms_attach_tbf(ms, dl_tbf);
 	OSMO_ASSERT(!ms_is_idle(ms));
 
+	/* MS is kept alive by TBFs referencing it: */
+	ms_unref(ms, __func__);
+
 	ms_detach_tbf(ms, ul_tbf);
 	OSMO_ASSERT(!ms_is_idle(ms));
 
@@ -422,7 +432,7 @@
 	the_pcu->vty.cs_downgrade_threshold = 0;
 	the_pcu->vty.cs_adj_lower_limit = 0;
 
-	ms = ms_alloc(bts);
+	ms = ms_alloc(bts, __func__);
 	ms_confirm_tlli(ms, tlli);
 
 	OSMO_ASSERT(ms_is_idle(ms));
@@ -430,6 +440,8 @@
 	dl_tbf = alloc_dl_tbf(bts, ms);
 	ms_attach_tbf(ms, dl_tbf);
 
+	ms_unref(ms, __func__);
+
 	OSMO_ASSERT(!ms_is_idle(ms));
 
 	OSMO_ASSERT(mcs_chan_code(ms_current_cs_dl(ms, ms_mode(ms))) == 3);
@@ -463,7 +475,7 @@
 
 	printf("=== start %s ===\n", __func__);
 
-	ms1 = ms_alloc(bts);
+	ms1 = ms_alloc(bts, __func__);
 	ms_confirm_tlli(ms1, tlli);
 	dump_ms(ms1, "1: no BTS defaults  ");
 
@@ -471,7 +483,7 @@
 	bts->initial_cs_ul = 1;
 	the_pcu->vty.cs_downgrade_threshold = 0;
 
-	ms2 = ms_alloc(bts);
+	ms2 = ms_alloc(bts,__func__);
 	ms_confirm_tlli(ms2, tlli + 1);
 	dump_ms(ms2, "2: with BTS defaults");
 
diff --git a/tests/ms/MsTest.err b/tests/ms/MsTest.err
index 0cc351b..84a948e 100644
--- a/tests/ms/MsTest.err
+++ b/tests/ms/MsTest.err
@@ -1,16 +1,16 @@
 Creating MS object
+MS(TA-220:MSCLS-0-0): + test_ms_state: now used by 1 (test_ms_state)
 Modifying MS object, UL TLLI: 0xffffffff -> 0xffeeddbb, not yet confirmed
 MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0) Attaching UL TBF: TBF(UL:STATE-NEW:GPRS:TLLI-0xffeeddbb)
-MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0:UL): + tbf: now used by 1 (tbf)
 MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0:UL) Attaching DL TBF: TBF(DL:STATE-NEW:GPRS:TLLI-0xffeeddbb)
 MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0:UL:DL) Detaching TBF: TBF(UL:STATE-NEW:GPRS:TLLI-0xffeeddbb)
 MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0:DL) Detaching TBF: TBF(DL:STATE-NEW:GPRS:TLLI-0xffeeddbb)
 MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0): - tbf: now used by 0 (-)
 MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0) Destroying MS object
 Creating MS object
+MS(TA-220:MSCLS-0-0): + test_ms_replace_tbf: now used by 1 (test_ms_replace_tbf)
 The MS object cannot fully confirm an unexpected TLLI: 0xffeeddbb, partly confirmed
 MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0) Attaching DL TBF: TBF(DL:STATE-NEW:GPRS:TLLI-0xffeeddbb)
-MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0:DL): + tbf: now used by 1 (tbf)
 MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0:DL) Attaching DL TBF: TBF(DL:STATE-NEW:GPRS:TLLI-0xffeeddbb)
 MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0:DL) Attaching UL TBF: TBF(UL:STATE-NEW:GPRS:TLLI-0xffeeddbb)
 MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0:UL:DL) Detaching TBF: TBF(UL:STATE-NEW:GPRS:TLLI-0xffeeddbb)
@@ -19,6 +19,7 @@
 MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0): - tbf: now used by 0 (-)
 MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0) Destroying MS object
 Creating MS object
+MS(TA-220:MSCLS-0-0): + test_ms_change_tlli: now used by 1 (test_ms_change_tlli)
 Modifying MS object, UL TLLI: 0xffffffff -> 0xff001111, not yet confirmed
 Modifying MS object, TLLI: 0xff001111 confirmed
 Modifying MS object, UL TLLI: 0xff001111 -> 0xaa000000, not yet confirmed
@@ -34,6 +35,7 @@
 Modifying MS object, TLLI: 0xaa000000 confirmed
 The MS object cannot fully confirm an unexpected TLLI: 0xff001111, partly confirmed
 Modifying MS object, TLLI: 0xaa000000 -> 0xff001111, already confirmed partly
+MS(TLLI-0xff001111:TA-220:MSCLS-0-0): - test_ms_change_tlli: now used by 0 (-)
 MS(TLLI-0xff001111:TA-220:MSCLS-0-0) Destroying MS object
 Creating MS object
 Modifying MS object, UL TLLI: 0xffffffff -> 0xffeeddbb, not yet confirmed
@@ -52,9 +54,9 @@
 MS(IMSI-001001987654322:TLLI-0xffeeddbc:TA-220:MSCLS-0-0): - tbf: now used by 0 (-)
 MS(IMSI-001001987654322:TLLI-0xffeeddbc:TA-220:MSCLS-0-0) Destroying MS object
 Creating MS object
+MS(TA-220:MSCLS-0-0): + test_ms_timeout: now used by 1 (test_ms_timeout)
 Modifying MS object, UL TLLI: 0xffffffff -> 0xffeeddbb, not yet confirmed
 MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0) Attaching UL TBF: TBF(UL:STATE-NEW:GPRS:TLLI-0xffeeddbb)
-MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0:UL): + tbf: now used by 1 (tbf)
 MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0:UL) Attaching DL TBF: TBF(DL:STATE-NEW:GPRS:TLLI-0xffeeddbb)
 MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0:UL:DL) Detaching TBF: TBF(UL:STATE-NEW:GPRS:TLLI-0xffeeddbb)
 MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0:DL) Detaching TBF: TBF(DL:STATE-NEW:GPRS:TLLI-0xffeeddbb)
@@ -62,19 +64,19 @@
 MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0) Release timer expired
 MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0) Destroying MS object
 Creating MS object
+MS(TA-220:MSCLS-0-0): + test_ms_cs_selection: now used by 1 (test_ms_cs_selection)
 The MS object cannot fully confirm an unexpected TLLI: 0xffeeddbb, partly confirmed
 MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0) Attaching DL TBF: TBF(DL:STATE-NEW:GPRS:TLLI-0xffeeddbb)
-MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0:DL): + tbf: now used by 1 (tbf)
 MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0:DL) Destroying MS object
 MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0:DL) Detaching TBF: TBF(DL:STATE-NEW:GPRS:TLLI-0xffeeddbb)
 MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0): - tbf: now used by 0 (-)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + test_ms_mcs_mode: now used by 1 (test_ms_mcs_mode)
 The MS object cannot fully confirm an unexpected TLLI: 0xdeadbeef, partly confirmed
 Creating MS object
+MS(TA-220:MSCLS-0-0): + test_ms_mcs_mode: now used by 1 (test_ms_mcs_mode)
 The MS object cannot fully confirm an unexpected TLLI: 0xdeadbef0, partly confirmed
 MS(TLLI-0xdeadbef0:TA-220:MSCLS-0-0) Attaching DL TBF: TBF(DL:STATE-NEW:GPRS:TLLI-0xdeadbef0)
-MS(TLLI-0xdeadbef0:TA-220:MSCLS-0-0:DL): + tbf: now used by 1 (tbf)
 MS(TLLI-0xdeadbeef:TA-220:MSCLS-0-0) Destroying MS object
 MS(TLLI-0xdeadbef0:TA-220:MSCLS-0-0:DL) Destroying MS object
 MS(TLLI-0xdeadbef0:TA-220:MSCLS-0-0:DL) Detaching TBF: TBF(DL:STATE-NEW:GPRS:TLLI-0xdeadbef0)
-MS(TLLI-0xdeadbef0:TA-220:MSCLS-0-0): - tbf: now used by 0 (-)
diff --git a/tests/tbf/TbfTest.cpp b/tests/tbf/TbfTest.cpp
index e67bd17..4adbaf8 100644
--- a/tests/tbf/TbfTest.cpp
+++ b/tests/tbf/TbfTest.cpp
@@ -122,7 +122,7 @@
 	/*
 	 * Make a uplink and downlink allocation
 	 */
-	ms = ms_alloc(bts);
+	ms = ms_alloc(bts, NULL);
 	gprs_rlcmac_tbf *dl_tbf = dl_tbf_alloc(bts,
 						ms, 0, false);
 	OSMO_ASSERT(dl_tbf != NULL);
@@ -205,7 +205,7 @@
 	GprsMs *ms;
 	gprs_rlcmac_dl_tbf *dl_tbf;
 
-	ms = ms_alloc(bts);
+	ms = ms_alloc(bts, NULL);
 	ms_set_ms_class(ms, ms_class);
 	ms_set_egprs_ms_class(ms, egprs_ms_class);
 
@@ -2346,7 +2346,7 @@
 	gprs_bssgp_init(bts, 4234, 4234, 1, 1, false, 0, 0, 0);
 
 	/* Does no support EGPRS */
-	ms = ms_alloc(bts);
+	ms = ms_alloc(bts, NULL);
 	ms_set_ms_class(ms, ms_class);
 	dl_tbf = dl_tbf_alloc(bts, ms, 0, false);
 
@@ -2355,7 +2355,7 @@
 	/* EGPRS-only */
 
 	/* Does support EGPRS */
-	ms = ms_alloc(bts);
+	ms = ms_alloc(bts, NULL);
 	ms_set_ms_class(ms, ms_class);
 	ms_set_egprs_ms_class(ms, ms_class);
 	dl_tbf = dl_tbf_alloc(bts, ms, 0, false);
@@ -2397,7 +2397,7 @@
 	/* EGPRS-only */
 
 	/* Does support EGPRS */
-	ms = ms_alloc(bts);
+	ms = ms_alloc(bts, NULL);
 	ms_set_ms_class(ms, ms_class);
 	ms_set_egprs_ms_class(ms, ms_class);
 	dl_tbf = dl_tbf_alloc(bts, ms, 0, true);
@@ -2476,7 +2476,7 @@
 	trx0->pdch[2].enable();
 	trx0->pdch[3].enable();
 
-	second_ms = ms_alloc(bts);
+	second_ms = ms_alloc(bts, NULL);
 	ms_set_tlli(second_ms, new_tlli);
 	ul_tbf = ul_tbf_alloc(bts, second_ms, 0, true);
 	OSMO_ASSERT(ul_tbf != NULL);
@@ -3335,7 +3335,7 @@
 
 	int rc = 0;
 
-	ms = ms_alloc(bts);
+	ms = ms_alloc(bts, NULL);
 	ms_set_tlli(ms, tlli);
 	ul_tbf = ms_new_ul_tbf_rejected_pacch(ms, pdch);
 
diff --git a/tests/tbf/TbfTest.err b/tests/tbf/TbfTest.err
index e17a6a8..657db59 100644
--- a/tests/tbf/TbfTest.err
+++ b/tests/tbf/TbfTest.err
@@ -670,6 +670,7 @@
 === start test_tbf_exhaustion ===
 PDCH(bts=0,trx=0,ts=4) PDCH state: disabled => enabled
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000000'
 The MS object cannot fully confirm an unexpected TLLI: 0xc0000000, partly confirmed
 Modifying MS object, TLLI = 0xc0000000, MS class 0 -> 45
@@ -692,7 +693,7 @@
 TBF(DL:TFI-0-0-0:STATE-NEW:GPRS:IMSI-001001000000000:TLLI-0xc0000000) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-0:STATE-NEW:GPRS:IMSI-001001000000000:TLLI-0xc0000000) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000000:TLLI-0xc0000000:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-0:STATE-NEW:GPRS:IMSI-001001000000000:TLLI-0xc0000000)
-MS(IMSI-001001000000000:TLLI-0xc0000000:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000000:TLLI-0xc0000000:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-0:STATE-NEW:GPRS:IMSI-001001000000000:TLLI-0xc0000000) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-0:STATE-NEW:GPRS:IMSI-001001000000000:TLLI-0xc0000000) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000000)
 DL_TBF(DL:TFI-0-0-0:STATE-NEW:GPRS:IMSI-001001000000000:TLLI-0xc0000000){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -700,7 +701,9 @@
 DL_TBF(DL:TFI-0-0-0:STATE-NEW:GPRS:IMSI-001001000000000:TLLI-0xc0000000){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-0:STATE-ASSIGN:GPRS:IMSI-001001000000000:TLLI-0xc0000000) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000000:TLLI-0xc0000000:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000001'
 The MS object cannot fully confirm an unexpected TLLI: 0xc0000001, partly confirmed
 Modifying MS object, TLLI = 0xc0000001, MS class 0 -> 45
@@ -723,7 +726,7 @@
 TBF(DL:TFI-0-0-1:STATE-NEW:GPRS:IMSI-001001000000001:TLLI-0xc0000001) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-1:STATE-NEW:GPRS:IMSI-001001000000001:TLLI-0xc0000001) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000001:TLLI-0xc0000001:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-1:STATE-NEW:GPRS:IMSI-001001000000001:TLLI-0xc0000001)
-MS(IMSI-001001000000001:TLLI-0xc0000001:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000001:TLLI-0xc0000001:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-1:STATE-NEW:GPRS:IMSI-001001000000001:TLLI-0xc0000001) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-1:STATE-NEW:GPRS:IMSI-001001000000001:TLLI-0xc0000001) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000001)
 DL_TBF(DL:TFI-0-0-1:STATE-NEW:GPRS:IMSI-001001000000001:TLLI-0xc0000001){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -731,7 +734,9 @@
 DL_TBF(DL:TFI-0-0-1:STATE-NEW:GPRS:IMSI-001001000000001:TLLI-0xc0000001){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-1:STATE-ASSIGN:GPRS:IMSI-001001000000001:TLLI-0xc0000001) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000001:TLLI-0xc0000001:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000002'
 The MS object cannot fully confirm an unexpected TLLI: 0xc0000002, partly confirmed
 Modifying MS object, TLLI = 0xc0000002, MS class 0 -> 45
@@ -754,7 +759,7 @@
 TBF(DL:TFI-0-0-2:STATE-NEW:GPRS:IMSI-001001000000002:TLLI-0xc0000002) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-2:STATE-NEW:GPRS:IMSI-001001000000002:TLLI-0xc0000002) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000002:TLLI-0xc0000002:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-2:STATE-NEW:GPRS:IMSI-001001000000002:TLLI-0xc0000002)
-MS(IMSI-001001000000002:TLLI-0xc0000002:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000002:TLLI-0xc0000002:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-2:STATE-NEW:GPRS:IMSI-001001000000002:TLLI-0xc0000002) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-2:STATE-NEW:GPRS:IMSI-001001000000002:TLLI-0xc0000002) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000002)
 DL_TBF(DL:TFI-0-0-2:STATE-NEW:GPRS:IMSI-001001000000002:TLLI-0xc0000002){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -762,7 +767,9 @@
 DL_TBF(DL:TFI-0-0-2:STATE-NEW:GPRS:IMSI-001001000000002:TLLI-0xc0000002){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-2:STATE-ASSIGN:GPRS:IMSI-001001000000002:TLLI-0xc0000002) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000002:TLLI-0xc0000002:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000003'
 The MS object cannot fully confirm an unexpected TLLI: 0xc0000003, partly confirmed
 Modifying MS object, TLLI = 0xc0000003, MS class 0 -> 45
@@ -785,7 +792,7 @@
 TBF(DL:TFI-0-0-3:STATE-NEW:GPRS:IMSI-001001000000003:TLLI-0xc0000003) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-3:STATE-NEW:GPRS:IMSI-001001000000003:TLLI-0xc0000003) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000003:TLLI-0xc0000003:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-3:STATE-NEW:GPRS:IMSI-001001000000003:TLLI-0xc0000003)
-MS(IMSI-001001000000003:TLLI-0xc0000003:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000003:TLLI-0xc0000003:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-3:STATE-NEW:GPRS:IMSI-001001000000003:TLLI-0xc0000003) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-3:STATE-NEW:GPRS:IMSI-001001000000003:TLLI-0xc0000003) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000003)
 DL_TBF(DL:TFI-0-0-3:STATE-NEW:GPRS:IMSI-001001000000003:TLLI-0xc0000003){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -793,7 +800,9 @@
 DL_TBF(DL:TFI-0-0-3:STATE-NEW:GPRS:IMSI-001001000000003:TLLI-0xc0000003){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-3:STATE-ASSIGN:GPRS:IMSI-001001000000003:TLLI-0xc0000003) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000003:TLLI-0xc0000003:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000004'
 The MS object cannot fully confirm an unexpected TLLI: 0xc0000004, partly confirmed
 Modifying MS object, TLLI = 0xc0000004, MS class 0 -> 45
@@ -816,7 +825,7 @@
 TBF(DL:TFI-0-0-4:STATE-NEW:GPRS:IMSI-001001000000004:TLLI-0xc0000004) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-4:STATE-NEW:GPRS:IMSI-001001000000004:TLLI-0xc0000004) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000004:TLLI-0xc0000004:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-4:STATE-NEW:GPRS:IMSI-001001000000004:TLLI-0xc0000004)
-MS(IMSI-001001000000004:TLLI-0xc0000004:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000004:TLLI-0xc0000004:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-4:STATE-NEW:GPRS:IMSI-001001000000004:TLLI-0xc0000004) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-4:STATE-NEW:GPRS:IMSI-001001000000004:TLLI-0xc0000004) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000004)
 DL_TBF(DL:TFI-0-0-4:STATE-NEW:GPRS:IMSI-001001000000004:TLLI-0xc0000004){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -824,7 +833,9 @@
 DL_TBF(DL:TFI-0-0-4:STATE-NEW:GPRS:IMSI-001001000000004:TLLI-0xc0000004){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-4:STATE-ASSIGN:GPRS:IMSI-001001000000004:TLLI-0xc0000004) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000004:TLLI-0xc0000004:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000005'
 The MS object cannot fully confirm an unexpected TLLI: 0xc0000005, partly confirmed
 Modifying MS object, TLLI = 0xc0000005, MS class 0 -> 45
@@ -847,7 +858,7 @@
 TBF(DL:TFI-0-0-5:STATE-NEW:GPRS:IMSI-001001000000005:TLLI-0xc0000005) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-5:STATE-NEW:GPRS:IMSI-001001000000005:TLLI-0xc0000005) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000005:TLLI-0xc0000005:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-5:STATE-NEW:GPRS:IMSI-001001000000005:TLLI-0xc0000005)
-MS(IMSI-001001000000005:TLLI-0xc0000005:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000005:TLLI-0xc0000005:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-5:STATE-NEW:GPRS:IMSI-001001000000005:TLLI-0xc0000005) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-5:STATE-NEW:GPRS:IMSI-001001000000005:TLLI-0xc0000005) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000005)
 DL_TBF(DL:TFI-0-0-5:STATE-NEW:GPRS:IMSI-001001000000005:TLLI-0xc0000005){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -855,7 +866,9 @@
 DL_TBF(DL:TFI-0-0-5:STATE-NEW:GPRS:IMSI-001001000000005:TLLI-0xc0000005){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-5:STATE-ASSIGN:GPRS:IMSI-001001000000005:TLLI-0xc0000005) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000005:TLLI-0xc0000005:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000006'
 The MS object cannot fully confirm an unexpected TLLI: 0xc0000006, partly confirmed
 Modifying MS object, TLLI = 0xc0000006, MS class 0 -> 45
@@ -878,7 +891,7 @@
 TBF(DL:TFI-0-0-6:STATE-NEW:GPRS:IMSI-001001000000006:TLLI-0xc0000006) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-6:STATE-NEW:GPRS:IMSI-001001000000006:TLLI-0xc0000006) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000006:TLLI-0xc0000006:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-6:STATE-NEW:GPRS:IMSI-001001000000006:TLLI-0xc0000006)
-MS(IMSI-001001000000006:TLLI-0xc0000006:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000006:TLLI-0xc0000006:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-6:STATE-NEW:GPRS:IMSI-001001000000006:TLLI-0xc0000006) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-6:STATE-NEW:GPRS:IMSI-001001000000006:TLLI-0xc0000006) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000006)
 DL_TBF(DL:TFI-0-0-6:STATE-NEW:GPRS:IMSI-001001000000006:TLLI-0xc0000006){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -886,7 +899,9 @@
 DL_TBF(DL:TFI-0-0-6:STATE-NEW:GPRS:IMSI-001001000000006:TLLI-0xc0000006){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-6:STATE-ASSIGN:GPRS:IMSI-001001000000006:TLLI-0xc0000006) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000006:TLLI-0xc0000006:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000007'
 The MS object cannot fully confirm an unexpected TLLI: 0xc0000007, partly confirmed
 Modifying MS object, TLLI = 0xc0000007, MS class 0 -> 45
@@ -909,7 +924,7 @@
 TBF(DL:TFI-0-0-7:STATE-NEW:GPRS:IMSI-001001000000007:TLLI-0xc0000007) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-7:STATE-NEW:GPRS:IMSI-001001000000007:TLLI-0xc0000007) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000007:TLLI-0xc0000007:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-7:STATE-NEW:GPRS:IMSI-001001000000007:TLLI-0xc0000007)
-MS(IMSI-001001000000007:TLLI-0xc0000007:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000007:TLLI-0xc0000007:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-7:STATE-NEW:GPRS:IMSI-001001000000007:TLLI-0xc0000007) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-7:STATE-NEW:GPRS:IMSI-001001000000007:TLLI-0xc0000007) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000007)
 DL_TBF(DL:TFI-0-0-7:STATE-NEW:GPRS:IMSI-001001000000007:TLLI-0xc0000007){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -917,7 +932,9 @@
 DL_TBF(DL:TFI-0-0-7:STATE-NEW:GPRS:IMSI-001001000000007:TLLI-0xc0000007){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-7:STATE-ASSIGN:GPRS:IMSI-001001000000007:TLLI-0xc0000007) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000007:TLLI-0xc0000007:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000008'
 The MS object cannot fully confirm an unexpected TLLI: 0xc0000008, partly confirmed
 Modifying MS object, TLLI = 0xc0000008, MS class 0 -> 45
@@ -940,7 +957,7 @@
 TBF(DL:TFI-0-0-8:STATE-NEW:GPRS:IMSI-001001000000008:TLLI-0xc0000008) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-8:STATE-NEW:GPRS:IMSI-001001000000008:TLLI-0xc0000008) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000008:TLLI-0xc0000008:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-8:STATE-NEW:GPRS:IMSI-001001000000008:TLLI-0xc0000008)
-MS(IMSI-001001000000008:TLLI-0xc0000008:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000008:TLLI-0xc0000008:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-8:STATE-NEW:GPRS:IMSI-001001000000008:TLLI-0xc0000008) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-8:STATE-NEW:GPRS:IMSI-001001000000008:TLLI-0xc0000008) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000008)
 DL_TBF(DL:TFI-0-0-8:STATE-NEW:GPRS:IMSI-001001000000008:TLLI-0xc0000008){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -948,7 +965,9 @@
 DL_TBF(DL:TFI-0-0-8:STATE-NEW:GPRS:IMSI-001001000000008:TLLI-0xc0000008){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-8:STATE-ASSIGN:GPRS:IMSI-001001000000008:TLLI-0xc0000008) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000008:TLLI-0xc0000008:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000009'
 The MS object cannot fully confirm an unexpected TLLI: 0xc0000009, partly confirmed
 Modifying MS object, TLLI = 0xc0000009, MS class 0 -> 45
@@ -971,7 +990,7 @@
 TBF(DL:TFI-0-0-9:STATE-NEW:GPRS:IMSI-001001000000009:TLLI-0xc0000009) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-9:STATE-NEW:GPRS:IMSI-001001000000009:TLLI-0xc0000009) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000009:TLLI-0xc0000009:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-9:STATE-NEW:GPRS:IMSI-001001000000009:TLLI-0xc0000009)
-MS(IMSI-001001000000009:TLLI-0xc0000009:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000009:TLLI-0xc0000009:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-9:STATE-NEW:GPRS:IMSI-001001000000009:TLLI-0xc0000009) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-9:STATE-NEW:GPRS:IMSI-001001000000009:TLLI-0xc0000009) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000009)
 DL_TBF(DL:TFI-0-0-9:STATE-NEW:GPRS:IMSI-001001000000009:TLLI-0xc0000009){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -979,7 +998,9 @@
 DL_TBF(DL:TFI-0-0-9:STATE-NEW:GPRS:IMSI-001001000000009:TLLI-0xc0000009){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-9:STATE-ASSIGN:GPRS:IMSI-001001000000009:TLLI-0xc0000009) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000009:TLLI-0xc0000009:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000010'
 The MS object cannot fully confirm an unexpected TLLI: 0xc000000a, partly confirmed
 Modifying MS object, TLLI = 0xc000000a, MS class 0 -> 45
@@ -1002,7 +1023,7 @@
 TBF(DL:TFI-0-0-10:STATE-NEW:GPRS:IMSI-001001000000010:TLLI-0xc000000a) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-10:STATE-NEW:GPRS:IMSI-001001000000010:TLLI-0xc000000a) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000010:TLLI-0xc000000a:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-10:STATE-NEW:GPRS:IMSI-001001000000010:TLLI-0xc000000a)
-MS(IMSI-001001000000010:TLLI-0xc000000a:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000010:TLLI-0xc000000a:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-10:STATE-NEW:GPRS:IMSI-001001000000010:TLLI-0xc000000a) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-10:STATE-NEW:GPRS:IMSI-001001000000010:TLLI-0xc000000a) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000010)
 DL_TBF(DL:TFI-0-0-10:STATE-NEW:GPRS:IMSI-001001000000010:TLLI-0xc000000a){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -1010,7 +1031,9 @@
 DL_TBF(DL:TFI-0-0-10:STATE-NEW:GPRS:IMSI-001001000000010:TLLI-0xc000000a){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-10:STATE-ASSIGN:GPRS:IMSI-001001000000010:TLLI-0xc000000a) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000010:TLLI-0xc000000a:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000011'
 The MS object cannot fully confirm an unexpected TLLI: 0xc000000b, partly confirmed
 Modifying MS object, TLLI = 0xc000000b, MS class 0 -> 45
@@ -1033,7 +1056,7 @@
 TBF(DL:TFI-0-0-11:STATE-NEW:GPRS:IMSI-001001000000011:TLLI-0xc000000b) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-11:STATE-NEW:GPRS:IMSI-001001000000011:TLLI-0xc000000b) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000011:TLLI-0xc000000b:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-11:STATE-NEW:GPRS:IMSI-001001000000011:TLLI-0xc000000b)
-MS(IMSI-001001000000011:TLLI-0xc000000b:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000011:TLLI-0xc000000b:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-11:STATE-NEW:GPRS:IMSI-001001000000011:TLLI-0xc000000b) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-11:STATE-NEW:GPRS:IMSI-001001000000011:TLLI-0xc000000b) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000011)
 DL_TBF(DL:TFI-0-0-11:STATE-NEW:GPRS:IMSI-001001000000011:TLLI-0xc000000b){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -1041,7 +1064,9 @@
 DL_TBF(DL:TFI-0-0-11:STATE-NEW:GPRS:IMSI-001001000000011:TLLI-0xc000000b){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-11:STATE-ASSIGN:GPRS:IMSI-001001000000011:TLLI-0xc000000b) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000011:TLLI-0xc000000b:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000012'
 The MS object cannot fully confirm an unexpected TLLI: 0xc000000c, partly confirmed
 Modifying MS object, TLLI = 0xc000000c, MS class 0 -> 45
@@ -1064,7 +1089,7 @@
 TBF(DL:TFI-0-0-12:STATE-NEW:GPRS:IMSI-001001000000012:TLLI-0xc000000c) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-12:STATE-NEW:GPRS:IMSI-001001000000012:TLLI-0xc000000c) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000012:TLLI-0xc000000c:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-12:STATE-NEW:GPRS:IMSI-001001000000012:TLLI-0xc000000c)
-MS(IMSI-001001000000012:TLLI-0xc000000c:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000012:TLLI-0xc000000c:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-12:STATE-NEW:GPRS:IMSI-001001000000012:TLLI-0xc000000c) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-12:STATE-NEW:GPRS:IMSI-001001000000012:TLLI-0xc000000c) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000012)
 DL_TBF(DL:TFI-0-0-12:STATE-NEW:GPRS:IMSI-001001000000012:TLLI-0xc000000c){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -1072,7 +1097,9 @@
 DL_TBF(DL:TFI-0-0-12:STATE-NEW:GPRS:IMSI-001001000000012:TLLI-0xc000000c){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-12:STATE-ASSIGN:GPRS:IMSI-001001000000012:TLLI-0xc000000c) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000012:TLLI-0xc000000c:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000013'
 The MS object cannot fully confirm an unexpected TLLI: 0xc000000d, partly confirmed
 Modifying MS object, TLLI = 0xc000000d, MS class 0 -> 45
@@ -1095,7 +1122,7 @@
 TBF(DL:TFI-0-0-13:STATE-NEW:GPRS:IMSI-001001000000013:TLLI-0xc000000d) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-13:STATE-NEW:GPRS:IMSI-001001000000013:TLLI-0xc000000d) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000013:TLLI-0xc000000d:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-13:STATE-NEW:GPRS:IMSI-001001000000013:TLLI-0xc000000d)
-MS(IMSI-001001000000013:TLLI-0xc000000d:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000013:TLLI-0xc000000d:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-13:STATE-NEW:GPRS:IMSI-001001000000013:TLLI-0xc000000d) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-13:STATE-NEW:GPRS:IMSI-001001000000013:TLLI-0xc000000d) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000013)
 DL_TBF(DL:TFI-0-0-13:STATE-NEW:GPRS:IMSI-001001000000013:TLLI-0xc000000d){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -1103,7 +1130,9 @@
 DL_TBF(DL:TFI-0-0-13:STATE-NEW:GPRS:IMSI-001001000000013:TLLI-0xc000000d){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-13:STATE-ASSIGN:GPRS:IMSI-001001000000013:TLLI-0xc000000d) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000013:TLLI-0xc000000d:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000014'
 The MS object cannot fully confirm an unexpected TLLI: 0xc000000e, partly confirmed
 Modifying MS object, TLLI = 0xc000000e, MS class 0 -> 45
@@ -1126,7 +1155,7 @@
 TBF(DL:TFI-0-0-14:STATE-NEW:GPRS:IMSI-001001000000014:TLLI-0xc000000e) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-14:STATE-NEW:GPRS:IMSI-001001000000014:TLLI-0xc000000e) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000014:TLLI-0xc000000e:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-14:STATE-NEW:GPRS:IMSI-001001000000014:TLLI-0xc000000e)
-MS(IMSI-001001000000014:TLLI-0xc000000e:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000014:TLLI-0xc000000e:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-14:STATE-NEW:GPRS:IMSI-001001000000014:TLLI-0xc000000e) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-14:STATE-NEW:GPRS:IMSI-001001000000014:TLLI-0xc000000e) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000014)
 DL_TBF(DL:TFI-0-0-14:STATE-NEW:GPRS:IMSI-001001000000014:TLLI-0xc000000e){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -1134,7 +1163,9 @@
 DL_TBF(DL:TFI-0-0-14:STATE-NEW:GPRS:IMSI-001001000000014:TLLI-0xc000000e){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-14:STATE-ASSIGN:GPRS:IMSI-001001000000014:TLLI-0xc000000e) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000014:TLLI-0xc000000e:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000015'
 The MS object cannot fully confirm an unexpected TLLI: 0xc000000f, partly confirmed
 Modifying MS object, TLLI = 0xc000000f, MS class 0 -> 45
@@ -1157,7 +1188,7 @@
 TBF(DL:TFI-0-0-15:STATE-NEW:GPRS:IMSI-001001000000015:TLLI-0xc000000f) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-15:STATE-NEW:GPRS:IMSI-001001000000015:TLLI-0xc000000f) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000015:TLLI-0xc000000f:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-15:STATE-NEW:GPRS:IMSI-001001000000015:TLLI-0xc000000f)
-MS(IMSI-001001000000015:TLLI-0xc000000f:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000015:TLLI-0xc000000f:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-15:STATE-NEW:GPRS:IMSI-001001000000015:TLLI-0xc000000f) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-15:STATE-NEW:GPRS:IMSI-001001000000015:TLLI-0xc000000f) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000015)
 DL_TBF(DL:TFI-0-0-15:STATE-NEW:GPRS:IMSI-001001000000015:TLLI-0xc000000f){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -1165,7 +1196,9 @@
 DL_TBF(DL:TFI-0-0-15:STATE-NEW:GPRS:IMSI-001001000000015:TLLI-0xc000000f){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-15:STATE-ASSIGN:GPRS:IMSI-001001000000015:TLLI-0xc000000f) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000015:TLLI-0xc000000f:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000016'
 The MS object cannot fully confirm an unexpected TLLI: 0xc0000010, partly confirmed
 Modifying MS object, TLLI = 0xc0000010, MS class 0 -> 45
@@ -1188,7 +1221,7 @@
 TBF(DL:TFI-0-0-16:STATE-NEW:GPRS:IMSI-001001000000016:TLLI-0xc0000010) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-16:STATE-NEW:GPRS:IMSI-001001000000016:TLLI-0xc0000010) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000016:TLLI-0xc0000010:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-16:STATE-NEW:GPRS:IMSI-001001000000016:TLLI-0xc0000010)
-MS(IMSI-001001000000016:TLLI-0xc0000010:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000016:TLLI-0xc0000010:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-16:STATE-NEW:GPRS:IMSI-001001000000016:TLLI-0xc0000010) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-16:STATE-NEW:GPRS:IMSI-001001000000016:TLLI-0xc0000010) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000016)
 DL_TBF(DL:TFI-0-0-16:STATE-NEW:GPRS:IMSI-001001000000016:TLLI-0xc0000010){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -1196,7 +1229,9 @@
 DL_TBF(DL:TFI-0-0-16:STATE-NEW:GPRS:IMSI-001001000000016:TLLI-0xc0000010){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-16:STATE-ASSIGN:GPRS:IMSI-001001000000016:TLLI-0xc0000010) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000016:TLLI-0xc0000010:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000017'
 The MS object cannot fully confirm an unexpected TLLI: 0xc0000011, partly confirmed
 Modifying MS object, TLLI = 0xc0000011, MS class 0 -> 45
@@ -1219,7 +1254,7 @@
 TBF(DL:TFI-0-0-17:STATE-NEW:GPRS:IMSI-001001000000017:TLLI-0xc0000011) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-17:STATE-NEW:GPRS:IMSI-001001000000017:TLLI-0xc0000011) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000017:TLLI-0xc0000011:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-17:STATE-NEW:GPRS:IMSI-001001000000017:TLLI-0xc0000011)
-MS(IMSI-001001000000017:TLLI-0xc0000011:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000017:TLLI-0xc0000011:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-17:STATE-NEW:GPRS:IMSI-001001000000017:TLLI-0xc0000011) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-17:STATE-NEW:GPRS:IMSI-001001000000017:TLLI-0xc0000011) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000017)
 DL_TBF(DL:TFI-0-0-17:STATE-NEW:GPRS:IMSI-001001000000017:TLLI-0xc0000011){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -1227,7 +1262,9 @@
 DL_TBF(DL:TFI-0-0-17:STATE-NEW:GPRS:IMSI-001001000000017:TLLI-0xc0000011){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-17:STATE-ASSIGN:GPRS:IMSI-001001000000017:TLLI-0xc0000011) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000017:TLLI-0xc0000011:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000018'
 The MS object cannot fully confirm an unexpected TLLI: 0xc0000012, partly confirmed
 Modifying MS object, TLLI = 0xc0000012, MS class 0 -> 45
@@ -1250,7 +1287,7 @@
 TBF(DL:TFI-0-0-18:STATE-NEW:GPRS:IMSI-001001000000018:TLLI-0xc0000012) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-18:STATE-NEW:GPRS:IMSI-001001000000018:TLLI-0xc0000012) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000018:TLLI-0xc0000012:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-18:STATE-NEW:GPRS:IMSI-001001000000018:TLLI-0xc0000012)
-MS(IMSI-001001000000018:TLLI-0xc0000012:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000018:TLLI-0xc0000012:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-18:STATE-NEW:GPRS:IMSI-001001000000018:TLLI-0xc0000012) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-18:STATE-NEW:GPRS:IMSI-001001000000018:TLLI-0xc0000012) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000018)
 DL_TBF(DL:TFI-0-0-18:STATE-NEW:GPRS:IMSI-001001000000018:TLLI-0xc0000012){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -1258,7 +1295,9 @@
 DL_TBF(DL:TFI-0-0-18:STATE-NEW:GPRS:IMSI-001001000000018:TLLI-0xc0000012){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-18:STATE-ASSIGN:GPRS:IMSI-001001000000018:TLLI-0xc0000012) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000018:TLLI-0xc0000012:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000019'
 The MS object cannot fully confirm an unexpected TLLI: 0xc0000013, partly confirmed
 Modifying MS object, TLLI = 0xc0000013, MS class 0 -> 45
@@ -1281,7 +1320,7 @@
 TBF(DL:TFI-0-0-19:STATE-NEW:GPRS:IMSI-001001000000019:TLLI-0xc0000013) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-19:STATE-NEW:GPRS:IMSI-001001000000019:TLLI-0xc0000013) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000019:TLLI-0xc0000013:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-19:STATE-NEW:GPRS:IMSI-001001000000019:TLLI-0xc0000013)
-MS(IMSI-001001000000019:TLLI-0xc0000013:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000019:TLLI-0xc0000013:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-19:STATE-NEW:GPRS:IMSI-001001000000019:TLLI-0xc0000013) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-19:STATE-NEW:GPRS:IMSI-001001000000019:TLLI-0xc0000013) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000019)
 DL_TBF(DL:TFI-0-0-19:STATE-NEW:GPRS:IMSI-001001000000019:TLLI-0xc0000013){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -1289,7 +1328,9 @@
 DL_TBF(DL:TFI-0-0-19:STATE-NEW:GPRS:IMSI-001001000000019:TLLI-0xc0000013){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-19:STATE-ASSIGN:GPRS:IMSI-001001000000019:TLLI-0xc0000013) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000019:TLLI-0xc0000013:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000020'
 The MS object cannot fully confirm an unexpected TLLI: 0xc0000014, partly confirmed
 Modifying MS object, TLLI = 0xc0000014, MS class 0 -> 45
@@ -1312,7 +1353,7 @@
 TBF(DL:TFI-0-0-20:STATE-NEW:GPRS:IMSI-001001000000020:TLLI-0xc0000014) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-20:STATE-NEW:GPRS:IMSI-001001000000020:TLLI-0xc0000014) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000020:TLLI-0xc0000014:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-20:STATE-NEW:GPRS:IMSI-001001000000020:TLLI-0xc0000014)
-MS(IMSI-001001000000020:TLLI-0xc0000014:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000020:TLLI-0xc0000014:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-20:STATE-NEW:GPRS:IMSI-001001000000020:TLLI-0xc0000014) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-20:STATE-NEW:GPRS:IMSI-001001000000020:TLLI-0xc0000014) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000020)
 DL_TBF(DL:TFI-0-0-20:STATE-NEW:GPRS:IMSI-001001000000020:TLLI-0xc0000014){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -1320,7 +1361,9 @@
 DL_TBF(DL:TFI-0-0-20:STATE-NEW:GPRS:IMSI-001001000000020:TLLI-0xc0000014){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-20:STATE-ASSIGN:GPRS:IMSI-001001000000020:TLLI-0xc0000014) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000020:TLLI-0xc0000014:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000021'
 The MS object cannot fully confirm an unexpected TLLI: 0xc0000015, partly confirmed
 Modifying MS object, TLLI = 0xc0000015, MS class 0 -> 45
@@ -1343,7 +1386,7 @@
 TBF(DL:TFI-0-0-21:STATE-NEW:GPRS:IMSI-001001000000021:TLLI-0xc0000015) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-21:STATE-NEW:GPRS:IMSI-001001000000021:TLLI-0xc0000015) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000021:TLLI-0xc0000015:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-21:STATE-NEW:GPRS:IMSI-001001000000021:TLLI-0xc0000015)
-MS(IMSI-001001000000021:TLLI-0xc0000015:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000021:TLLI-0xc0000015:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-21:STATE-NEW:GPRS:IMSI-001001000000021:TLLI-0xc0000015) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-21:STATE-NEW:GPRS:IMSI-001001000000021:TLLI-0xc0000015) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000021)
 DL_TBF(DL:TFI-0-0-21:STATE-NEW:GPRS:IMSI-001001000000021:TLLI-0xc0000015){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -1351,7 +1394,9 @@
 DL_TBF(DL:TFI-0-0-21:STATE-NEW:GPRS:IMSI-001001000000021:TLLI-0xc0000015){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-21:STATE-ASSIGN:GPRS:IMSI-001001000000021:TLLI-0xc0000015) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000021:TLLI-0xc0000015:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000022'
 The MS object cannot fully confirm an unexpected TLLI: 0xc0000016, partly confirmed
 Modifying MS object, TLLI = 0xc0000016, MS class 0 -> 45
@@ -1374,7 +1419,7 @@
 TBF(DL:TFI-0-0-22:STATE-NEW:GPRS:IMSI-001001000000022:TLLI-0xc0000016) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-22:STATE-NEW:GPRS:IMSI-001001000000022:TLLI-0xc0000016) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000022:TLLI-0xc0000016:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-22:STATE-NEW:GPRS:IMSI-001001000000022:TLLI-0xc0000016)
-MS(IMSI-001001000000022:TLLI-0xc0000016:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000022:TLLI-0xc0000016:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-22:STATE-NEW:GPRS:IMSI-001001000000022:TLLI-0xc0000016) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-22:STATE-NEW:GPRS:IMSI-001001000000022:TLLI-0xc0000016) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000022)
 DL_TBF(DL:TFI-0-0-22:STATE-NEW:GPRS:IMSI-001001000000022:TLLI-0xc0000016){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -1382,7 +1427,9 @@
 DL_TBF(DL:TFI-0-0-22:STATE-NEW:GPRS:IMSI-001001000000022:TLLI-0xc0000016){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-22:STATE-ASSIGN:GPRS:IMSI-001001000000022:TLLI-0xc0000016) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000022:TLLI-0xc0000016:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000023'
 The MS object cannot fully confirm an unexpected TLLI: 0xc0000017, partly confirmed
 Modifying MS object, TLLI = 0xc0000017, MS class 0 -> 45
@@ -1405,7 +1452,7 @@
 TBF(DL:TFI-0-0-23:STATE-NEW:GPRS:IMSI-001001000000023:TLLI-0xc0000017) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-23:STATE-NEW:GPRS:IMSI-001001000000023:TLLI-0xc0000017) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000023:TLLI-0xc0000017:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-23:STATE-NEW:GPRS:IMSI-001001000000023:TLLI-0xc0000017)
-MS(IMSI-001001000000023:TLLI-0xc0000017:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000023:TLLI-0xc0000017:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-23:STATE-NEW:GPRS:IMSI-001001000000023:TLLI-0xc0000017) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-23:STATE-NEW:GPRS:IMSI-001001000000023:TLLI-0xc0000017) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000023)
 DL_TBF(DL:TFI-0-0-23:STATE-NEW:GPRS:IMSI-001001000000023:TLLI-0xc0000017){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -1413,7 +1460,9 @@
 DL_TBF(DL:TFI-0-0-23:STATE-NEW:GPRS:IMSI-001001000000023:TLLI-0xc0000017){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-23:STATE-ASSIGN:GPRS:IMSI-001001000000023:TLLI-0xc0000017) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000023:TLLI-0xc0000017:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000024'
 The MS object cannot fully confirm an unexpected TLLI: 0xc0000018, partly confirmed
 Modifying MS object, TLLI = 0xc0000018, MS class 0 -> 45
@@ -1436,7 +1485,7 @@
 TBF(DL:TFI-0-0-24:STATE-NEW:GPRS:IMSI-001001000000024:TLLI-0xc0000018) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-24:STATE-NEW:GPRS:IMSI-001001000000024:TLLI-0xc0000018) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000024:TLLI-0xc0000018:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-24:STATE-NEW:GPRS:IMSI-001001000000024:TLLI-0xc0000018)
-MS(IMSI-001001000000024:TLLI-0xc0000018:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000024:TLLI-0xc0000018:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-24:STATE-NEW:GPRS:IMSI-001001000000024:TLLI-0xc0000018) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-24:STATE-NEW:GPRS:IMSI-001001000000024:TLLI-0xc0000018) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000024)
 DL_TBF(DL:TFI-0-0-24:STATE-NEW:GPRS:IMSI-001001000000024:TLLI-0xc0000018){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -1444,7 +1493,9 @@
 DL_TBF(DL:TFI-0-0-24:STATE-NEW:GPRS:IMSI-001001000000024:TLLI-0xc0000018){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-24:STATE-ASSIGN:GPRS:IMSI-001001000000024:TLLI-0xc0000018) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000024:TLLI-0xc0000018:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000025'
 The MS object cannot fully confirm an unexpected TLLI: 0xc0000019, partly confirmed
 Modifying MS object, TLLI = 0xc0000019, MS class 0 -> 45
@@ -1467,7 +1518,7 @@
 TBF(DL:TFI-0-0-25:STATE-NEW:GPRS:IMSI-001001000000025:TLLI-0xc0000019) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-25:STATE-NEW:GPRS:IMSI-001001000000025:TLLI-0xc0000019) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000025:TLLI-0xc0000019:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-25:STATE-NEW:GPRS:IMSI-001001000000025:TLLI-0xc0000019)
-MS(IMSI-001001000000025:TLLI-0xc0000019:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000025:TLLI-0xc0000019:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-25:STATE-NEW:GPRS:IMSI-001001000000025:TLLI-0xc0000019) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-25:STATE-NEW:GPRS:IMSI-001001000000025:TLLI-0xc0000019) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000025)
 DL_TBF(DL:TFI-0-0-25:STATE-NEW:GPRS:IMSI-001001000000025:TLLI-0xc0000019){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -1475,7 +1526,9 @@
 DL_TBF(DL:TFI-0-0-25:STATE-NEW:GPRS:IMSI-001001000000025:TLLI-0xc0000019){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-25:STATE-ASSIGN:GPRS:IMSI-001001000000025:TLLI-0xc0000019) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000025:TLLI-0xc0000019:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000026'
 The MS object cannot fully confirm an unexpected TLLI: 0xc000001a, partly confirmed
 Modifying MS object, TLLI = 0xc000001a, MS class 0 -> 45
@@ -1498,7 +1551,7 @@
 TBF(DL:TFI-0-0-26:STATE-NEW:GPRS:IMSI-001001000000026:TLLI-0xc000001a) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-26:STATE-NEW:GPRS:IMSI-001001000000026:TLLI-0xc000001a) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000026:TLLI-0xc000001a:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-26:STATE-NEW:GPRS:IMSI-001001000000026:TLLI-0xc000001a)
-MS(IMSI-001001000000026:TLLI-0xc000001a:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000026:TLLI-0xc000001a:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-26:STATE-NEW:GPRS:IMSI-001001000000026:TLLI-0xc000001a) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-26:STATE-NEW:GPRS:IMSI-001001000000026:TLLI-0xc000001a) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000026)
 DL_TBF(DL:TFI-0-0-26:STATE-NEW:GPRS:IMSI-001001000000026:TLLI-0xc000001a){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -1506,7 +1559,9 @@
 DL_TBF(DL:TFI-0-0-26:STATE-NEW:GPRS:IMSI-001001000000026:TLLI-0xc000001a){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-26:STATE-ASSIGN:GPRS:IMSI-001001000000026:TLLI-0xc000001a) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000026:TLLI-0xc000001a:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000027'
 The MS object cannot fully confirm an unexpected TLLI: 0xc000001b, partly confirmed
 Modifying MS object, TLLI = 0xc000001b, MS class 0 -> 45
@@ -1529,7 +1584,7 @@
 TBF(DL:TFI-0-0-27:STATE-NEW:GPRS:IMSI-001001000000027:TLLI-0xc000001b) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-27:STATE-NEW:GPRS:IMSI-001001000000027:TLLI-0xc000001b) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000027:TLLI-0xc000001b:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-27:STATE-NEW:GPRS:IMSI-001001000000027:TLLI-0xc000001b)
-MS(IMSI-001001000000027:TLLI-0xc000001b:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000027:TLLI-0xc000001b:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-27:STATE-NEW:GPRS:IMSI-001001000000027:TLLI-0xc000001b) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-27:STATE-NEW:GPRS:IMSI-001001000000027:TLLI-0xc000001b) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000027)
 DL_TBF(DL:TFI-0-0-27:STATE-NEW:GPRS:IMSI-001001000000027:TLLI-0xc000001b){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -1537,7 +1592,9 @@
 DL_TBF(DL:TFI-0-0-27:STATE-NEW:GPRS:IMSI-001001000000027:TLLI-0xc000001b){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-27:STATE-ASSIGN:GPRS:IMSI-001001000000027:TLLI-0xc000001b) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000027:TLLI-0xc000001b:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000028'
 The MS object cannot fully confirm an unexpected TLLI: 0xc000001c, partly confirmed
 Modifying MS object, TLLI = 0xc000001c, MS class 0 -> 45
@@ -1560,7 +1617,7 @@
 TBF(DL:TFI-0-0-28:STATE-NEW:GPRS:IMSI-001001000000028:TLLI-0xc000001c) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-28:STATE-NEW:GPRS:IMSI-001001000000028:TLLI-0xc000001c) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000028:TLLI-0xc000001c:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-28:STATE-NEW:GPRS:IMSI-001001000000028:TLLI-0xc000001c)
-MS(IMSI-001001000000028:TLLI-0xc000001c:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000028:TLLI-0xc000001c:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-28:STATE-NEW:GPRS:IMSI-001001000000028:TLLI-0xc000001c) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-28:STATE-NEW:GPRS:IMSI-001001000000028:TLLI-0xc000001c) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000028)
 DL_TBF(DL:TFI-0-0-28:STATE-NEW:GPRS:IMSI-001001000000028:TLLI-0xc000001c){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -1568,7 +1625,9 @@
 DL_TBF(DL:TFI-0-0-28:STATE-NEW:GPRS:IMSI-001001000000028:TLLI-0xc000001c){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-28:STATE-ASSIGN:GPRS:IMSI-001001000000028:TLLI-0xc000001c) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000028:TLLI-0xc000001c:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000029'
 The MS object cannot fully confirm an unexpected TLLI: 0xc000001d, partly confirmed
 Modifying MS object, TLLI = 0xc000001d, MS class 0 -> 45
@@ -1591,7 +1650,7 @@
 TBF(DL:TFI-0-0-29:STATE-NEW:GPRS:IMSI-001001000000029:TLLI-0xc000001d) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-29:STATE-NEW:GPRS:IMSI-001001000000029:TLLI-0xc000001d) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000029:TLLI-0xc000001d:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-29:STATE-NEW:GPRS:IMSI-001001000000029:TLLI-0xc000001d)
-MS(IMSI-001001000000029:TLLI-0xc000001d:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000029:TLLI-0xc000001d:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-29:STATE-NEW:GPRS:IMSI-001001000000029:TLLI-0xc000001d) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-29:STATE-NEW:GPRS:IMSI-001001000000029:TLLI-0xc000001d) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000029)
 DL_TBF(DL:TFI-0-0-29:STATE-NEW:GPRS:IMSI-001001000000029:TLLI-0xc000001d){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -1599,7 +1658,9 @@
 DL_TBF(DL:TFI-0-0-29:STATE-NEW:GPRS:IMSI-001001000000029:TLLI-0xc000001d){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-29:STATE-ASSIGN:GPRS:IMSI-001001000000029:TLLI-0xc000001d) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000029:TLLI-0xc000001d:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000030'
 The MS object cannot fully confirm an unexpected TLLI: 0xc000001e, partly confirmed
 Modifying MS object, TLLI = 0xc000001e, MS class 0 -> 45
@@ -1622,7 +1683,7 @@
 TBF(DL:TFI-0-0-30:STATE-NEW:GPRS:IMSI-001001000000030:TLLI-0xc000001e) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-30:STATE-NEW:GPRS:IMSI-001001000000030:TLLI-0xc000001e) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000030:TLLI-0xc000001e:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-30:STATE-NEW:GPRS:IMSI-001001000000030:TLLI-0xc000001e)
-MS(IMSI-001001000000030:TLLI-0xc000001e:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000030:TLLI-0xc000001e:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-30:STATE-NEW:GPRS:IMSI-001001000000030:TLLI-0xc000001e) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-30:STATE-NEW:GPRS:IMSI-001001000000030:TLLI-0xc000001e) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000030)
 DL_TBF(DL:TFI-0-0-30:STATE-NEW:GPRS:IMSI-001001000000030:TLLI-0xc000001e){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -1630,7 +1691,9 @@
 DL_TBF(DL:TFI-0-0-30:STATE-NEW:GPRS:IMSI-001001000000030:TLLI-0xc000001e){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-30:STATE-ASSIGN:GPRS:IMSI-001001000000030:TLLI-0xc000001e) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000030:TLLI-0xc000001e:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000031'
 The MS object cannot fully confirm an unexpected TLLI: 0xc000001f, partly confirmed
 Modifying MS object, TLLI = 0xc000001f, MS class 0 -> 45
@@ -1653,7 +1716,7 @@
 TBF(DL:TFI-0-0-31:STATE-NEW:GPRS:IMSI-001001000000031:TLLI-0xc000001f) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-31:STATE-NEW:GPRS:IMSI-001001000000031:TLLI-0xc000001f) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000031:TLLI-0xc000001f:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-31:STATE-NEW:GPRS:IMSI-001001000000031:TLLI-0xc000001f)
-MS(IMSI-001001000000031:TLLI-0xc000001f:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000031:TLLI-0xc000001f:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-31:STATE-NEW:GPRS:IMSI-001001000000031:TLLI-0xc000001f) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-31:STATE-NEW:GPRS:IMSI-001001000000031:TLLI-0xc000001f) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000031)
 DL_TBF(DL:TFI-0-0-31:STATE-NEW:GPRS:IMSI-001001000000031:TLLI-0xc000001f){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -1661,7 +1724,9 @@
 DL_TBF(DL:TFI-0-0-31:STATE-NEW:GPRS:IMSI-001001000000031:TLLI-0xc000001f){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-31:STATE-ASSIGN:GPRS:IMSI-001001000000031:TLLI-0xc000001f) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000031:TLLI-0xc000001f:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000032'
 The MS object cannot fully confirm an unexpected TLLI: 0xc0000020, partly confirmed
 Modifying MS object, TLLI = 0xc0000020, MS class 0 -> 45
@@ -1678,8 +1743,9 @@
 UL_ASS_TBF{NONE}: Deallocated
 DL_ASS_TBF{NONE}: Deallocated
 MS(IMSI-001001000000032:TLLI-0xc0000020:TA-220:MSCLS-45-0) No PDCH resource
-=== end test_tbf_exhaustion ===
+MS(IMSI-001001000000032:TLLI-0xc0000020:TA-220:MSCLS-45-0): - dl_tbf_handle: now used by 0 (-)
 MS(IMSI-001001000000032:TLLI-0xc0000020:TA-220:MSCLS-45-0) Destroying MS object
+=== end test_tbf_exhaustion ===
 MS(IMSI-001001000000031:TLLI-0xc000001f:TA-220:MSCLS-45-0:DL) Destroying MS object
 MS(IMSI-001001000000031:TLLI-0xc000001f:TA-220:MSCLS-45-0:DL) Detaching TBF: TBF(DL:TFI-0-0-31:STATE-ASSIGN:GPRS:IMSI-001001000000031:TLLI-0xc000001f)
 MS(IMSI-001001000000031:TLLI-0xc000001f:TA-220:MSCLS-45-0): - tbf: now used by 0 (-)
@@ -1779,6 +1845,7 @@
 === start test_tbf_dl_llc_loss ===
 PDCH(bts=0,trx=0,ts=4) PDCH state: disabled => enabled
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000123456'
 The MS object cannot fully confirm an unexpected TLLI: 0xc0123456, partly confirmed
 Modifying MS object, TLLI = 0xc0123456, MS class 0 -> 45
@@ -1801,7 +1868,7 @@
 TBF(DL:TFI-0-0-0:STATE-NEW:GPRS:IMSI-001001000123456:TLLI-0xc0123456) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-0:STATE-NEW:GPRS:IMSI-001001000123456:TLLI-0xc0123456) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000123456:TLLI-0xc0123456:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-0:STATE-NEW:GPRS:IMSI-001001000123456:TLLI-0xc0123456)
-MS(IMSI-001001000123456:TLLI-0xc0123456:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000123456:TLLI-0xc0123456:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-0:STATE-NEW:GPRS:IMSI-001001000123456:TLLI-0xc0123456) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-0:STATE-NEW:GPRS:IMSI-001001000123456:TLLI-0xc0123456) Send downlink assignment on PCH, no TBF exist (IMSI=001001000123456)
 DL_TBF(DL:TFI-0-0-0:STATE-NEW:GPRS:IMSI-001001000123456:TLLI-0xc0123456){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -1809,6 +1876,7 @@
 DL_TBF(DL:TFI-0-0-0:STATE-NEW:GPRS:IMSI-001001000123456:TLLI-0xc0123456){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-0:STATE-ASSIGN:GPRS:IMSI-001001000123456:TLLI-0xc0123456) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000123456:TLLI-0xc0123456:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Modifying MS object, TLLI = 0xc0123456, TA 220 -> 0
 MS(IMSI-001001000123456:TLLI-0xc0123456:TA-0:MSCLS-45-0:DL) appending 19 bytes to DL LLC queue
 TBF(DL:TFI-0-0-0:STATE-ASSIGN:GPRS:IMSI-001001000123456:TLLI-0xc0123456) free
@@ -1901,6 +1969,7 @@
 MS requests Uplink resource on CCCH/RACH: ra=0x03 (8 bit) Fn=2654167 qta=31
 MS requests single TS uplink transmission (one phase packet access)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + bts_rcv_rach: now used by 1 (bts_rcv_rach)
 MS(TA-220:MSCLS-0-0) ********** UL-TBF starts here **********
 MS(TA-220:MSCLS-0-0) Allocating UL TBF
 UL_ASS_TBF{NONE}: Allocated
@@ -1920,11 +1989,12 @@
 TBF(UL:TFI-0-0-0:STATE-NEW:GPRS) Setting Control TS PDCH(bts=0,trx=0,ts=7)
 TBF(UL:TFI-0-0-0:STATE-NEW:GPRS) Allocated: trx = 0, ul_slots = 80, dl_slots = 00
 MS(TA-220:MSCLS-0-0) Attaching UL TBF: TBF(UL:TFI-0-0-0:STATE-NEW:GPRS)
-MS(TA-220:MSCLS-0-0:UL): + tbf: now used by 1 (tbf)
+MS(TA-220:MSCLS-0-0:UL): + tbf: now used by 2 (bts_rcv_rach,tbf)
 UL_TBF(UL:TFI-0-0-0:STATE-NEW:GPRS){NEW}: Received Event ASSIGN_ADD_CCCH
 TBF(UL:TFI-0-0-0:STATE-NEW:GPRS) set ass. type CCCH [prev CCCH:0, PACCH:0]
 UL_TBF(UL:TFI-0-0-0:STATE-NEW:GPRS){NEW}: state_chg to FLOW
 TBF(UL:TFI-0-0-0:STATE-FLOW:GPRS) starting timer T3141 [Contention resolution (UL-TBF, CCCH)] with 10 sec. 0 microsec, cur_fn=2654167
+MS(TA-220:MSCLS-0-0:UL): - bts_rcv_rach: now used by 1 (tbf)
 Modifying MS object, TLLI = 0xffffffff, TA 220 -> 7
 Tx Immediate Assignment on AGCH: TRX=0 (ARFCN 0) TS=7 TA=7 TSC=0 TFI=0 USF=0
 PDCH(bts=0,trx=0,ts=7) Got CS-1 RLC block: R=0, SI=0, TFI=0, CPS=0, RSB=0, rc=184
@@ -1965,6 +2035,7 @@
 MS requests Uplink resource on CCCH/RACH: ra=0x03 (8 bit) Fn=2654167 qta=31
 MS requests single TS uplink transmission (one phase packet access)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + bts_rcv_rach: now used by 1 (bts_rcv_rach)
 MS(TA-220:MSCLS-0-0) ********** UL-TBF starts here **********
 MS(TA-220:MSCLS-0-0) Allocating UL TBF
 UL_ASS_TBF{NONE}: Allocated
@@ -1984,11 +2055,12 @@
 TBF(UL:TFI-0-0-0:STATE-NEW:GPRS) Setting Control TS PDCH(bts=0,trx=0,ts=7)
 TBF(UL:TFI-0-0-0:STATE-NEW:GPRS) Allocated: trx = 0, ul_slots = 80, dl_slots = 00
 MS(TA-220:MSCLS-0-0) Attaching UL TBF: TBF(UL:TFI-0-0-0:STATE-NEW:GPRS)
-MS(TA-220:MSCLS-0-0:UL): + tbf: now used by 1 (tbf)
+MS(TA-220:MSCLS-0-0:UL): + tbf: now used by 2 (bts_rcv_rach,tbf)
 UL_TBF(UL:TFI-0-0-0:STATE-NEW:GPRS){NEW}: Received Event ASSIGN_ADD_CCCH
 TBF(UL:TFI-0-0-0:STATE-NEW:GPRS) set ass. type CCCH [prev CCCH:0, PACCH:0]
 UL_TBF(UL:TFI-0-0-0:STATE-NEW:GPRS){NEW}: state_chg to FLOW
 TBF(UL:TFI-0-0-0:STATE-FLOW:GPRS) starting timer T3141 [Contention resolution (UL-TBF, CCCH)] with 10 sec. 0 microsec, cur_fn=2654167
+MS(TA-220:MSCLS-0-0:UL): - bts_rcv_rach: now used by 1 (tbf)
 Modifying MS object, TLLI = 0xffffffff, TA 220 -> 7
 Tx Immediate Assignment on AGCH: TRX=0 (ARFCN 0) TS=7 TA=7 TSC=0 TFI=0 USF=0
 PDCH(bts=0,trx=0,ts=7) Got CS-1 RLC block: R=0, SI=0, TFI=0, CPS=0, RSB=0, rc=184
@@ -2853,6 +2925,7 @@
 MS requests Uplink resource on CCCH/RACH: ra=0x03 (8 bit) Fn=2654275 qta=31
 MS requests single TS uplink transmission (one phase packet access)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + bts_rcv_rach: now used by 1 (bts_rcv_rach)
 MS(TA-220:MSCLS-0-0) ********** UL-TBF starts here **********
 MS(TA-220:MSCLS-0-0) Allocating UL TBF
 UL_ASS_TBF{NONE}: Allocated
@@ -2872,11 +2945,12 @@
 TBF(UL:TFI-0-0-0:STATE-NEW:GPRS) Setting Control TS PDCH(bts=0,trx=0,ts=7)
 TBF(UL:TFI-0-0-0:STATE-NEW:GPRS) Allocated: trx = 0, ul_slots = 80, dl_slots = 00
 MS(TA-220:MSCLS-0-0) Attaching UL TBF: TBF(UL:TFI-0-0-0:STATE-NEW:GPRS)
-MS(TA-220:MSCLS-0-0:UL): + tbf: now used by 1 (tbf)
+MS(TA-220:MSCLS-0-0:UL): + tbf: now used by 2 (bts_rcv_rach,tbf)
 UL_TBF(UL:TFI-0-0-0:STATE-NEW:GPRS){NEW}: Received Event ASSIGN_ADD_CCCH
 TBF(UL:TFI-0-0-0:STATE-NEW:GPRS) set ass. type CCCH [prev CCCH:0, PACCH:0]
 UL_TBF(UL:TFI-0-0-0:STATE-NEW:GPRS){NEW}: state_chg to FLOW
 TBF(UL:TFI-0-0-0:STATE-FLOW:GPRS) starting timer T3141 [Contention resolution (UL-TBF, CCCH)] with 10 sec. 0 microsec, cur_fn=2654275
+MS(TA-220:MSCLS-0-0:UL): - bts_rcv_rach: now used by 1 (tbf)
 Modifying MS object, TLLI = 0xffffffff, TA 220 -> 7
 Tx Immediate Assignment on AGCH: TRX=0 (ARFCN 0) TS=7 TA=7 TSC=0 TFI=0 USF=0
 PDCH(bts=0,trx=0,ts=7) Got CS-1 RLC block: R=0, SI=0, TFI=0, CPS=0, RSB=0, rc=184
@@ -4026,6 +4100,7 @@
 === start test_tbf_gprs_egprs ===
 PDCH(bts=0,trx=0,ts=4) PDCH state: disabled => enabled
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001123456789'
 The MS object cannot fully confirm an unexpected TLLI: 0xc0006789, partly confirmed
 Modifying MS object, TLLI = 0xc0006789, MS class 0 -> 45
@@ -4048,7 +4123,7 @@
 TBF(DL:TFI-0-0-0:STATE-NEW:GPRS:IMSI-001001123456789:TLLI-0xc0006789) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-0:STATE-NEW:GPRS:IMSI-001001123456789:TLLI-0xc0006789) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001123456789:TLLI-0xc0006789:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-0:STATE-NEW:GPRS:IMSI-001001123456789:TLLI-0xc0006789)
-MS(IMSI-001001123456789:TLLI-0xc0006789:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001123456789:TLLI-0xc0006789:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-0:STATE-NEW:GPRS:IMSI-001001123456789:TLLI-0xc0006789) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-0:STATE-NEW:GPRS:IMSI-001001123456789:TLLI-0xc0006789) Send downlink assignment on PCH, no TBF exist (IMSI=001001123456789)
 DL_TBF(DL:TFI-0-0-0:STATE-NEW:GPRS:IMSI-001001123456789:TLLI-0xc0006789){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -4056,6 +4131,7 @@
 DL_TBF(DL:TFI-0-0-0:STATE-NEW:GPRS:IMSI-001001123456789:TLLI-0xc0006789){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-0:STATE-ASSIGN:GPRS:IMSI-001001123456789:TLLI-0xc0006789) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001123456789:TLLI-0xc0006789:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 === end test_tbf_gprs_egprs ===
 MS(IMSI-001001123456789:TLLI-0xc0006789:TA-220:MSCLS-45-0:DL) Destroying MS object
 MS(IMSI-001001123456789:TLLI-0xc0006789:TA-220:MSCLS-45-0:DL) Detaching TBF: TBF(DL:TFI-0-0-0:STATE-ASSIGN:GPRS:IMSI-001001123456789:TLLI-0xc0006789)
@@ -7713,6 +7789,7 @@
 MS requests Uplink resource on CCCH/RACH: ra=0x78 (8 bit) Fn=2654167 qta=31
 MS requests single TS uplink transmission (one phase packet access)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + bts_rcv_rach: now used by 1 (bts_rcv_rach)
 MS(TA-220:MSCLS-0-0) ********** UL-TBF starts here **********
 MS(TA-220:MSCLS-0-0) Allocating UL TBF
 UL_ASS_TBF{NONE}: Allocated
@@ -7732,16 +7809,18 @@
 TBF(UL:TFI-0-0-0:STATE-NEW:GPRS) Setting Control TS PDCH(bts=0,trx=0,ts=7)
 TBF(UL:TFI-0-0-0:STATE-NEW:GPRS) Allocated: trx = 0, ul_slots = 80, dl_slots = 00
 MS(TA-220:MSCLS-0-0) Attaching UL TBF: TBF(UL:TFI-0-0-0:STATE-NEW:GPRS)
-MS(TA-220:MSCLS-0-0:UL): + tbf: now used by 1 (tbf)
+MS(TA-220:MSCLS-0-0:UL): + tbf: now used by 2 (bts_rcv_rach,tbf)
 UL_TBF(UL:TFI-0-0-0:STATE-NEW:GPRS){NEW}: Received Event ASSIGN_ADD_CCCH
 TBF(UL:TFI-0-0-0:STATE-NEW:GPRS) set ass. type CCCH [prev CCCH:0, PACCH:0]
 UL_TBF(UL:TFI-0-0-0:STATE-NEW:GPRS){NEW}: state_chg to FLOW
 TBF(UL:TFI-0-0-0:STATE-FLOW:GPRS) starting timer T3141 [Contention resolution (UL-TBF, CCCH)] with 10 sec. 0 microsec, cur_fn=2654167
+MS(TA-220:MSCLS-0-0:UL): - bts_rcv_rach: now used by 1 (tbf)
 Modifying MS object, TLLI = 0xffffffff, TA 220 -> 7
 Tx Immediate Assignment on AGCH: TRX=0 (ARFCN 0) TS=7 TA=7 TSC=0 TFI=0 USF=0
 MS requests Uplink resource on CCCH/RACH: ra=0x79 (8 bit) Fn=2654167 qta=31
 MS requests single TS uplink transmission (one phase packet access)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + bts_rcv_rach: now used by 1 (bts_rcv_rach)
 MS(TA-220:MSCLS-0-0) ********** UL-TBF starts here **********
 MS(TA-220:MSCLS-0-0) Allocating UL TBF
 UL_ASS_TBF{NONE}: Allocated
@@ -7761,16 +7840,18 @@
 TBF(UL:TFI-0-0-1:STATE-NEW:GPRS) Setting Control TS PDCH(bts=0,trx=0,ts=7)
 TBF(UL:TFI-0-0-1:STATE-NEW:GPRS) Allocated: trx = 0, ul_slots = 80, dl_slots = 00
 MS(TA-220:MSCLS-0-0) Attaching UL TBF: TBF(UL:TFI-0-0-1:STATE-NEW:GPRS)
-MS(TA-220:MSCLS-0-0:UL): + tbf: now used by 1 (tbf)
+MS(TA-220:MSCLS-0-0:UL): + tbf: now used by 2 (bts_rcv_rach,tbf)
 UL_TBF(UL:TFI-0-0-1:STATE-NEW:GPRS){NEW}: Received Event ASSIGN_ADD_CCCH
 TBF(UL:TFI-0-0-1:STATE-NEW:GPRS) set ass. type CCCH [prev CCCH:0, PACCH:0]
 UL_TBF(UL:TFI-0-0-1:STATE-NEW:GPRS){NEW}: state_chg to FLOW
 TBF(UL:TFI-0-0-1:STATE-FLOW:GPRS) starting timer T3141 [Contention resolution (UL-TBF, CCCH)] with 10 sec. 0 microsec, cur_fn=2654167
+MS(TA-220:MSCLS-0-0:UL): - bts_rcv_rach: now used by 1 (tbf)
 Modifying MS object, TLLI = 0xffffffff, TA 220 -> 7
 Tx Immediate Assignment on AGCH: TRX=0 (ARFCN 0) TS=7 TA=7 TSC=0 TFI=1 USF=1
 MS requests Uplink resource on CCCH/RACH: ra=0x7a (8 bit) Fn=2654167 qta=31
 MS requests single TS uplink transmission (one phase packet access)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + bts_rcv_rach: now used by 1 (bts_rcv_rach)
 MS(TA-220:MSCLS-0-0) ********** UL-TBF starts here **********
 MS(TA-220:MSCLS-0-0) Allocating UL TBF
 UL_ASS_TBF{NONE}: Allocated
@@ -7790,16 +7871,18 @@
 TBF(UL:TFI-0-0-2:STATE-NEW:GPRS) Setting Control TS PDCH(bts=0,trx=0,ts=7)
 TBF(UL:TFI-0-0-2:STATE-NEW:GPRS) Allocated: trx = 0, ul_slots = 80, dl_slots = 00
 MS(TA-220:MSCLS-0-0) Attaching UL TBF: TBF(UL:TFI-0-0-2:STATE-NEW:GPRS)
-MS(TA-220:MSCLS-0-0:UL): + tbf: now used by 1 (tbf)
+MS(TA-220:MSCLS-0-0:UL): + tbf: now used by 2 (bts_rcv_rach,tbf)
 UL_TBF(UL:TFI-0-0-2:STATE-NEW:GPRS){NEW}: Received Event ASSIGN_ADD_CCCH
 TBF(UL:TFI-0-0-2:STATE-NEW:GPRS) set ass. type CCCH [prev CCCH:0, PACCH:0]
 UL_TBF(UL:TFI-0-0-2:STATE-NEW:GPRS){NEW}: state_chg to FLOW
 TBF(UL:TFI-0-0-2:STATE-FLOW:GPRS) starting timer T3141 [Contention resolution (UL-TBF, CCCH)] with 10 sec. 0 microsec, cur_fn=2654167
+MS(TA-220:MSCLS-0-0:UL): - bts_rcv_rach: now used by 1 (tbf)
 Modifying MS object, TLLI = 0xffffffff, TA 220 -> 7
 Tx Immediate Assignment on AGCH: TRX=0 (ARFCN 0) TS=7 TA=7 TSC=0 TFI=2 USF=2
 MS requests Uplink resource on CCCH/RACH: ra=0x7b (8 bit) Fn=2654167 qta=31
 MS requests single TS uplink transmission (one phase packet access)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + bts_rcv_rach: now used by 1 (bts_rcv_rach)
 MS(TA-220:MSCLS-0-0) ********** UL-TBF starts here **********
 MS(TA-220:MSCLS-0-0) Allocating UL TBF
 UL_ASS_TBF{NONE}: Allocated
@@ -7819,16 +7902,18 @@
 TBF(UL:TFI-0-0-3:STATE-NEW:GPRS) Setting Control TS PDCH(bts=0,trx=0,ts=7)
 TBF(UL:TFI-0-0-3:STATE-NEW:GPRS) Allocated: trx = 0, ul_slots = 80, dl_slots = 00
 MS(TA-220:MSCLS-0-0) Attaching UL TBF: TBF(UL:TFI-0-0-3:STATE-NEW:GPRS)
-MS(TA-220:MSCLS-0-0:UL): + tbf: now used by 1 (tbf)
+MS(TA-220:MSCLS-0-0:UL): + tbf: now used by 2 (bts_rcv_rach,tbf)
 UL_TBF(UL:TFI-0-0-3:STATE-NEW:GPRS){NEW}: Received Event ASSIGN_ADD_CCCH
 TBF(UL:TFI-0-0-3:STATE-NEW:GPRS) set ass. type CCCH [prev CCCH:0, PACCH:0]
 UL_TBF(UL:TFI-0-0-3:STATE-NEW:GPRS){NEW}: state_chg to FLOW
 TBF(UL:TFI-0-0-3:STATE-FLOW:GPRS) starting timer T3141 [Contention resolution (UL-TBF, CCCH)] with 10 sec. 0 microsec, cur_fn=2654167
+MS(TA-220:MSCLS-0-0:UL): - bts_rcv_rach: now used by 1 (tbf)
 Modifying MS object, TLLI = 0xffffffff, TA 220 -> 7
 Tx Immediate Assignment on AGCH: TRX=0 (ARFCN 0) TS=7 TA=7 TSC=0 TFI=3 USF=3
 MS requests Uplink resource on CCCH/RACH: ra=0x7c (8 bit) Fn=2654167 qta=31
 MS requests single TS uplink transmission (one phase packet access)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + bts_rcv_rach: now used by 1 (bts_rcv_rach)
 MS(TA-220:MSCLS-0-0) ********** UL-TBF starts here **********
 MS(TA-220:MSCLS-0-0) Allocating UL TBF
 UL_ASS_TBF{NONE}: Allocated
@@ -7848,16 +7933,18 @@
 TBF(UL:TFI-0-0-4:STATE-NEW:GPRS) Setting Control TS PDCH(bts=0,trx=0,ts=7)
 TBF(UL:TFI-0-0-4:STATE-NEW:GPRS) Allocated: trx = 0, ul_slots = 80, dl_slots = 00
 MS(TA-220:MSCLS-0-0) Attaching UL TBF: TBF(UL:TFI-0-0-4:STATE-NEW:GPRS)
-MS(TA-220:MSCLS-0-0:UL): + tbf: now used by 1 (tbf)
+MS(TA-220:MSCLS-0-0:UL): + tbf: now used by 2 (bts_rcv_rach,tbf)
 UL_TBF(UL:TFI-0-0-4:STATE-NEW:GPRS){NEW}: Received Event ASSIGN_ADD_CCCH
 TBF(UL:TFI-0-0-4:STATE-NEW:GPRS) set ass. type CCCH [prev CCCH:0, PACCH:0]
 UL_TBF(UL:TFI-0-0-4:STATE-NEW:GPRS){NEW}: state_chg to FLOW
 TBF(UL:TFI-0-0-4:STATE-FLOW:GPRS) starting timer T3141 [Contention resolution (UL-TBF, CCCH)] with 10 sec. 0 microsec, cur_fn=2654167
+MS(TA-220:MSCLS-0-0:UL): - bts_rcv_rach: now used by 1 (tbf)
 Modifying MS object, TLLI = 0xffffffff, TA 220 -> 7
 Tx Immediate Assignment on AGCH: TRX=0 (ARFCN 0) TS=7 TA=7 TSC=0 TFI=4 USF=4
 MS requests Uplink resource on CCCH/RACH: ra=0x7d (8 bit) Fn=2654167 qta=31
 MS requests single TS uplink transmission (one phase packet access)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + bts_rcv_rach: now used by 1 (bts_rcv_rach)
 MS(TA-220:MSCLS-0-0) ********** UL-TBF starts here **********
 MS(TA-220:MSCLS-0-0) Allocating UL TBF
 UL_ASS_TBF{NONE}: Allocated
@@ -7877,16 +7964,18 @@
 TBF(UL:TFI-0-0-5:STATE-NEW:GPRS) Setting Control TS PDCH(bts=0,trx=0,ts=7)
 TBF(UL:TFI-0-0-5:STATE-NEW:GPRS) Allocated: trx = 0, ul_slots = 80, dl_slots = 00
 MS(TA-220:MSCLS-0-0) Attaching UL TBF: TBF(UL:TFI-0-0-5:STATE-NEW:GPRS)
-MS(TA-220:MSCLS-0-0:UL): + tbf: now used by 1 (tbf)
+MS(TA-220:MSCLS-0-0:UL): + tbf: now used by 2 (bts_rcv_rach,tbf)
 UL_TBF(UL:TFI-0-0-5:STATE-NEW:GPRS){NEW}: Received Event ASSIGN_ADD_CCCH
 TBF(UL:TFI-0-0-5:STATE-NEW:GPRS) set ass. type CCCH [prev CCCH:0, PACCH:0]
 UL_TBF(UL:TFI-0-0-5:STATE-NEW:GPRS){NEW}: state_chg to FLOW
 TBF(UL:TFI-0-0-5:STATE-FLOW:GPRS) starting timer T3141 [Contention resolution (UL-TBF, CCCH)] with 10 sec. 0 microsec, cur_fn=2654167
+MS(TA-220:MSCLS-0-0:UL): - bts_rcv_rach: now used by 1 (tbf)
 Modifying MS object, TLLI = 0xffffffff, TA 220 -> 7
 Tx Immediate Assignment on AGCH: TRX=0 (ARFCN 0) TS=7 TA=7 TSC=0 TFI=5 USF=5
 MS requests Uplink resource on CCCH/RACH: ra=0x7e (8 bit) Fn=2654167 qta=31
 MS requests single TS uplink transmission (one phase packet access)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + bts_rcv_rach: now used by 1 (bts_rcv_rach)
 MS(TA-220:MSCLS-0-0) ********** UL-TBF starts here **********
 MS(TA-220:MSCLS-0-0) Allocating UL TBF
 UL_ASS_TBF{NONE}: Allocated
@@ -7906,16 +7995,18 @@
 TBF(UL:TFI-0-0-6:STATE-NEW:GPRS) Setting Control TS PDCH(bts=0,trx=0,ts=7)
 TBF(UL:TFI-0-0-6:STATE-NEW:GPRS) Allocated: trx = 0, ul_slots = 80, dl_slots = 00
 MS(TA-220:MSCLS-0-0) Attaching UL TBF: TBF(UL:TFI-0-0-6:STATE-NEW:GPRS)
-MS(TA-220:MSCLS-0-0:UL): + tbf: now used by 1 (tbf)
+MS(TA-220:MSCLS-0-0:UL): + tbf: now used by 2 (bts_rcv_rach,tbf)
 UL_TBF(UL:TFI-0-0-6:STATE-NEW:GPRS){NEW}: Received Event ASSIGN_ADD_CCCH
 TBF(UL:TFI-0-0-6:STATE-NEW:GPRS) set ass. type CCCH [prev CCCH:0, PACCH:0]
 UL_TBF(UL:TFI-0-0-6:STATE-NEW:GPRS){NEW}: state_chg to FLOW
 TBF(UL:TFI-0-0-6:STATE-FLOW:GPRS) starting timer T3141 [Contention resolution (UL-TBF, CCCH)] with 10 sec. 0 microsec, cur_fn=2654167
+MS(TA-220:MSCLS-0-0:UL): - bts_rcv_rach: now used by 1 (tbf)
 Modifying MS object, TLLI = 0xffffffff, TA 220 -> 7
 Tx Immediate Assignment on AGCH: TRX=0 (ARFCN 0) TS=7 TA=7 TSC=0 TFI=6 USF=6
 MS requests Uplink resource on CCCH/RACH: ra=0x7f (8 bit) Fn=2654167 qta=31
 MS requests single TS uplink transmission (one phase packet access)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + bts_rcv_rach: now used by 1 (bts_rcv_rach)
 MS(TA-220:MSCLS-0-0) ********** UL-TBF starts here **********
 MS(TA-220:MSCLS-0-0) Allocating UL TBF
 UL_ASS_TBF{NONE}: Allocated
@@ -7938,8 +8029,9 @@
 UL_ASS_TBF{NONE}: Deallocated
 DL_ASS_TBF{NONE}: Deallocated
 No PDCH resource for Uplink TBF
-Tx Immediate Assignment Reject on AGCH
+MS(TA-220:MSCLS-0-0): - bts_rcv_rach: now used by 0 (-)
 MS(TA-220:MSCLS-0-0) Destroying MS object
+Tx Immediate Assignment Reject on AGCH
 MS(TA-7:MSCLS-0-0:UL) Destroying MS object
 MS(TA-7:MSCLS-0-0:UL) Detaching TBF: TBF(UL:TFI-0-0-6:STATE-FLOW:GPRS)
 MS(TA-7:MSCLS-0-0): - tbf: now used by 0 (-)
@@ -9861,6 +9953,7 @@
 PDCH(bts=0,trx=1,ts=5) PDCH state: disabled => enabled
 PDCH(bts=0,trx=1,ts=6) PDCH state: disabled => enabled
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000001'
 The MS object cannot fully confirm an unexpected TLLI: 0xa3c2f953, partly confirmed
 Modifying MS object, TLLI = 0xa3c2f953, MS class 0 -> 11
@@ -9889,7 +9982,7 @@
 TBF(DL:TFI-0-1-0:STATE-NEW:GPRS:IMSI-001001000000001:TLLI-0xa3c2f953) Setting Control TS PDCH(bts=0,trx=1,ts=5)
 TBF(DL:TFI-0-1-0:STATE-NEW:GPRS:IMSI-001001000000001:TLLI-0xa3c2f953) Allocated: trx = 1, ul_slots = 20, dl_slots = 20
 MS(IMSI-001001000000001:TLLI-0xa3c2f953:TA-220:MSCLS-11-0) Attaching DL TBF: TBF(DL:TFI-0-1-0:STATE-NEW:GPRS:IMSI-001001000000001:TLLI-0xa3c2f953)
-MS(IMSI-001001000000001:TLLI-0xa3c2f953:TA-220:MSCLS-11-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000001:TLLI-0xa3c2f953:TA-220:MSCLS-11-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-1-0:STATE-NEW:GPRS:IMSI-001001000000001:TLLI-0xa3c2f953) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-1-0:STATE-NEW:GPRS:IMSI-001001000000001:TLLI-0xa3c2f953) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000001)
 DL_TBF(DL:TFI-0-1-0:STATE-NEW:GPRS:IMSI-001001000000001:TLLI-0xa3c2f953){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -9897,6 +9990,7 @@
 DL_TBF(DL:TFI-0-1-0:STATE-NEW:GPRS:IMSI-001001000000001:TLLI-0xa3c2f953){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-1-0:STATE-ASSIGN:GPRS:IMSI-001001000000001:TLLI-0xa3c2f953) TX: START Immediate Assignment Downlink (PCH)
  - TRX=1 (0) TS=5 TA=220
+MS(IMSI-001001000000001:TLLI-0xa3c2f953:TA-220:MSCLS-11-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 PDCH(bts=0,trx=0,ts=1) PDCH state: disabled => enabled
 PDCH(bts=0,trx=0,ts=2) PDCH state: disabled => enabled
 PDCH(bts=0,trx=0,ts=3) PDCH state: disabled => enabled
diff --git a/tests/types/TypesTest.cpp b/tests/types/TypesTest.cpp
index 91b7ce4..44e4e28 100644
--- a/tests/types/TypesTest.cpp
+++ b/tests/types/TypesTest.cpp
@@ -688,7 +688,7 @@
 	the_pcu->alloc_algorithm = alloc_algorithm_a;
 	bts->trx[0].pdch[4].enable();
 
-	GprsMs *ms = ms_alloc(bts);
+	GprsMs *ms = ms_alloc(bts, NULL);
 	ms_set_ms_class(ms, 1);
 	ms_set_egprs_ms_class(ms, 1);
 	struct gprs_rlcmac_ul_tbf *tbf = ul_tbf_alloc(bts, ms, 0, true);
@@ -781,7 +781,7 @@
 	the_pcu->alloc_algorithm = alloc_algorithm_a;
 	bts->trx[0].pdch[2].enable();
 	bts->trx[0].pdch[3].enable();
-	GprsMs *ms = ms_alloc(bts);
+	GprsMs *ms = ms_alloc(bts, NULL);
 	ms_set_ms_class(ms, 1);
 
 	struct gprs_rlcmac_tbf *tbf = dl_tbf_alloc(bts, ms, 0, false);
@@ -808,7 +808,7 @@
 	bts->trx[0].pdch[4].enable();
 	bts->trx[0].pdch[5].enable();
 
-	GprsMs *ms = ms_alloc(bts);
+	GprsMs *ms = ms_alloc(bts, NULL);
 	ms_set_ms_class(ms, 1);
 	struct gprs_rlcmac_tbf *tbf = ul_tbf_alloc(bts, ms, 0, false);
 	static uint8_t res[] = { 0x06,
@@ -851,7 +851,7 @@
 	bts->trx[0].pdch[1].enable();
 	bts->trx[0].pdch[2].enable();
 
-	GprsMs *ms = ms_alloc(bts);
+	GprsMs *ms = ms_alloc(bts, NULL);
 	ms_set_ms_class(ms, 1);
 	ms_set_egprs_ms_class(ms, 1);
 	struct gprs_rlcmac_tbf *tbf = ul_tbf_alloc(bts, ms, 0, false);
diff --git a/tests/ulc/PdchUlcTest.cpp b/tests/ulc/PdchUlcTest.cpp
index b77f1d4..3756b9d 100644
--- a/tests/ulc/PdchUlcTest.cpp
+++ b/tests/ulc/PdchUlcTest.cpp
@@ -182,7 +182,7 @@
 	the_pcu->alloc_algorithm = _alloc_algorithm_dummy;
 
 	struct gprs_rlcmac_bts *bts = setup_new_bts();
-	struct GprsMs *ms = ms_alloc(bts);
+	struct GprsMs *ms = ms_alloc(bts, NULL);
 	ms_confirm_tlli(ms, 0x12345678);
 	struct gprs_rlcmac_tbf *tbf1 = dl_tbf_alloc(bts, ms, 0, true);
 	struct gprs_rlcmac_pdch *pdch = &tbf1->trx->pdch[0];