diff --git a/src/bts.cpp b/src/bts.cpp
index 40541c5..4cbe68e 100644
--- a/src/bts.cpp
+++ b/src/bts.cpp
@@ -1006,9 +1006,13 @@
 		     "SBFn=%u TRX=%u TS=%u\n", sb_fn, pdch->trx->trx_no, pdch->ts_no);
 		bts_do_rate_ctr_inc(bts, CTR_IMMEDIATE_ASSIGN_UL_TBF_TWO_PHASE);
 	} else {
-		GprsMs *ms = ms_alloc(bts);
+		GprsMs *ms = ms_alloc(bts, __func__);
 		ms_set_egprs_ms_class(ms, chan_req.egprs_mslot_class);
 		tbf = ms_new_ul_tbf_assigned_agch(ms);
+		/* Here either tbf was created and it holds a ref to MS, or tbf
+		 * creation failed and MS will end up without references and being
+		 * freed: */
+		ms_unref(ms, __func__);
 		if (!tbf) {
 			/* Send RR Immediate Assignment Reject */
 			rc = -EBUSY;
diff --git a/src/gprs_ms.c b/src/gprs_ms.c
index 6d7018f..7df71e8 100644
--- a/src/gprs_ms.c
+++ b/src/gprs_ms.c
@@ -122,7 +122,7 @@
 }
 
 static int ms_talloc_destructor(struct GprsMs *ms);
-struct GprsMs *ms_alloc(struct gprs_rlcmac_bts *bts)
+struct GprsMs *ms_alloc(struct gprs_rlcmac_bts *bts, const char *use_ref)
 {
 	struct GprsMs *ms = talloc_zero(tall_pcu_ctx, struct GprsMs);
 	OSMO_ASSERT(bts);
@@ -172,6 +172,8 @@
 
 	ms_set_timeout(ms, osmo_tdef_get(bts->pcu->T_defs, -2030, OSMO_TDEF_S, -1));
 
+	if (use_ref)
+		ms_ref(ms, use_ref);
 	return ms;
 free_ret:
 	talloc_free(ms);
diff --git a/src/gprs_ms.h b/src/gprs_ms.h
index cdb23bf..03508ff 100644
--- a/src/gprs_ms.h
+++ b/src/gprs_ms.h
@@ -95,7 +95,7 @@
 	struct nacc_fsm_ctx *nacc;
 };
 
-struct GprsMs *ms_alloc(struct gprs_rlcmac_bts *bts);
+struct GprsMs *ms_alloc(struct gprs_rlcmac_bts *bts, const char *use_ref);
 
 struct gprs_rlcmac_pdch *ms_first_common_ts(const struct GprsMs *ms);
 void ms_set_first_common_ts(struct GprsMs *ms, struct gprs_rlcmac_pdch *pdch);
diff --git a/src/pdch.cpp b/src/pdch.cpp
index 4495e21..a8becca 100644
--- a/src/pdch.cpp
+++ b/src/pdch.cpp
@@ -665,7 +665,9 @@
 		uint32_t tlli = request->ID.u.TLLI;
 		ms = bts_get_ms_by_tlli(bts, tlli, GSM_RESERVED_TMSI);
 		if (!ms) {
-			ms = ms_alloc(bts);
+			/* A reference is already hold immediately below in all cases, no
+			 * need to hold and extra one, pass use_ref=NULL: */
+			ms = ms_alloc(bts, NULL);
 			ms_set_tlli(ms, tlli);
 		}
 	} else if (request->ID.u.Global_TFI.UnionType) { /* ID_TYPE = DL_TFI */
@@ -852,13 +854,16 @@
 	struct gprs_rlcmac_sba *sba;
 	struct pdch_ulc_node *poll;
 	GprsMs *ms;
+	bool ms_allocated = false;
 
 	ms = bts_get_ms_by_tlli(bts(), report->TLLI, GSM_RESERVED_TMSI);
 	if (!ms) {
 		LOGPDCH(this, DRLCMAC, LOGL_NOTICE, "MS send measurement "
 			"but TLLI 0x%08x is unknown\n", report->TLLI);
-		ms = ms_alloc(bts());
+		ms = ms_alloc(bts(), __func__);
 		ms_set_tlli(ms, report->TLLI);
+		/* Track that we need to free ref at the end: */
+		ms_allocated = true;
 	}
 	if ((poll = pdch_ulc_get_node(ulc, fn))) {
 		switch (poll->type) {
@@ -879,6 +884,8 @@
 		}
 	}
 	gprs_rlcmac_meas_rep(ms, report);
+	if (ms_allocated)
+		ms_unref(ms, __func__);
 }
 
 void gprs_rlcmac_pdch::rcv_cell_change_notification(Packet_Cell_Change_Notification_t *notif,
diff --git a/src/tbf_dl.cpp b/src/tbf_dl.cpp
index 628d593..17b6a3a 100644
--- a/src/tbf_dl.cpp
+++ b/src/tbf_dl.cpp
@@ -201,27 +201,31 @@
 {
 	int rc;
 	GprsMs *ms, *ms_old;
+	bool ms_allocated = false;
 
 	/* check for existing TBF */
 	ms = bts_get_ms(bts, tlli, tlli_old, imsi);
 
 	/* If we got MS by TLLI above let's see if we already have another MS
 	 * object identified by IMSI and merge them */
-	if (ms && !ms_imsi_is_valid(ms) && imsi) {
-		ms_old = bts_get_ms_by_imsi(bts, imsi);
-		if (ms_old && ms_old != ms) {
-			/* The TLLI has changed (RAU), so there are two MS
-			 * objects for the same MS */
-			LOGP(DTBF, LOGL_NOTICE,
-			     "There is a new MS object for the same MS: (0x%08x, '%s') -> (0x%08x, '%s')\n",
-			     ms_tlli(ms_old), ms_imsi(ms_old), ms_tlli(ms), ms_imsi(ms));
-			ms_merge_and_clear_ms(ms, ms_old);
-			/* old_ms may no longer be available here */
+	if (ms) {
+		if (!ms_imsi_is_valid(ms) && imsi) {
+			ms_old = bts_get_ms_by_imsi(bts, imsi);
+			if (ms_old && ms_old != ms) {
+				/* The TLLI has changed (RAU), so there are two MS
+				* objects for the same MS */
+				LOGP(DTBF, LOGL_NOTICE,
+				"There is a new MS object for the same MS: (0x%08x, '%s') -> (0x%08x, '%s')\n",
+				ms_tlli(ms_old), ms_imsi(ms_old), ms_tlli(ms), ms_imsi(ms));
+				ms_merge_and_clear_ms(ms, ms_old);
+				/* old_ms may no longer be available here */
+			}
 		}
+	} else {
+		ms = ms_alloc(bts, __func__);
+		/* Remember we have to unref the alloc reference at the end: */
+		ms_allocated = true;
 	}
-
-	if (!ms)
-		ms = ms_alloc(bts);
 	if (imsi)
 		ms_set_imsi(ms, imsi);
 	ms_confirm_tlli(ms, tlli);
@@ -233,9 +237,12 @@
 	}
 
 	rc = ms_append_llc_dl_data(ms, delay_csec, data, len);
-	if (rc < 0)
-		return rc;
-	return 0;
+	if (ms_allocated) {
+		ms_unref(ms, __func__);
+		/* Here "ms" may be freed if ms_append_llc_dl_data() failed to
+		 * allocate a DL TBF and it has no more TBFs attached */
+	}
+	return rc;
 }
 
 bool gprs_rlcmac_dl_tbf::restart_bsn_cycle()
diff --git a/tests/alloc/AllocTest.cpp b/tests/alloc/AllocTest.cpp
index 065a257..8a67152 100644
--- a/tests/alloc/AllocTest.cpp
+++ b/tests/alloc/AllocTest.cpp
@@ -135,8 +135,9 @@
 	 * least this part is working okay.
 	 */
 	for (i = 0; i < (int)ARRAY_SIZE(tbfs); ++i) {
-		ms = ms_alloc(bts);
+		ms = ms_alloc(bts, __func__);
 		tbfs[i] = tbf_alloc(bts, ms, dir, -1, 0);
+		ms_unref(ms, __func__);
 		if (tbfs[i] == NULL)
 			break;
 
@@ -155,7 +156,7 @@
 		if (tbfs[i])
 			tbf_free(tbfs[i]);
 
-	ms = ms_alloc(bts);
+	ms = ms_alloc(bts, NULL);
 	tbfs[0] = tbf_alloc(bts, ms, dir, -1, 0);
 	OSMO_ASSERT(tbfs[0]);
 	tbf_free(tbfs[0]);
@@ -221,13 +222,15 @@
 
 	enable_ts_on_bts(bts, ts0, ts1, ts2, ts3, ts4, ts5, ts6, ts7);
 
-	ms = ms_alloc(bts);
+	ms = ms_alloc(bts, __func__);
 	ms_set_ms_class(ms, ms_class);
 	/* Avoid delaying free to avoid tons of to-be-freed ms objects queuing */
 	ms_set_timeout(ms, 0);
 	ul_tbf = ul_tbf_alloc(bts, ms, -1, true);
-	if (!ul_tbf)
+	if (!ul_tbf) {
+		ms_unref(ms, __func__);
 		return false;
+	}
 
 	OSMO_ASSERT(ul_tbf->ms());
 	OSMO_ASSERT(ms_current_trx(ul_tbf->ms()));
@@ -236,13 +239,16 @@
 
 	/* assume final ack has not been sent */
 	dl_tbf = dl_tbf_alloc(bts, ms, ms_current_trx(ms)->trx_no, false);
-	if (!dl_tbf)
+	if (!dl_tbf) {
+		ms_unref(ms, __func__);
 		return false;
+	}
 
 	dump_assignment(dl_tbf, "DL", verbose);
 
 	check_tfi_usage(bts);
 
+	ms_unref(ms, __func__);
 	tbf_free(dl_tbf);
 	tbf_free(ul_tbf);
 	talloc_free(bts);
@@ -264,13 +270,15 @@
 
 	enable_ts_on_bts(bts, ts0, ts1, ts2, ts3, ts4, ts5, ts6, ts7);
 
-	ms = ms_alloc(bts);
+	ms = ms_alloc(bts, __func__);
 	ms_set_ms_class(ms, ms_class);
 	/* Avoid delaying free to avoid tons of to-be-freed ms objects queuing */
 	ms_set_timeout(ms, 0);
 	dl_tbf = dl_tbf_alloc(bts, ms, -1, true);
-	if (!dl_tbf)
+	if (!dl_tbf) {
+		ms_unref(ms, __func__);
 		return false;
+	}
 
 	ms_confirm_tlli(ms, 0x23);
 	OSMO_ASSERT(dl_tbf->ms() == ms);
@@ -279,8 +287,10 @@
 	dump_assignment(dl_tbf, "DL", verbose);
 
 	ul_tbf = ul_tbf_alloc(bts, ms, ms_current_trx(ms)->trx_no, false);
-	if (!ul_tbf)
+	if (!ul_tbf) {
+		ms_unref(ms, __func__);
 		return false;
+	}
 
 	ms_update_announced_tlli(ms, 0x23);
 	ul_tbf->m_contention_resolution_done = true;
@@ -293,6 +303,7 @@
 
 	check_tfi_usage(bts);
 
+	ms_unref(ms, __func__);
 	tbf_free(dl_tbf);
 	tbf_free(ul_tbf);
 	talloc_free(bts);
@@ -315,13 +326,15 @@
 
 	tfi = bts_tfi_find_free(bts, GPRS_RLCMAC_UL_TBF, &trx_no, -1);
 	OSMO_ASSERT(tfi >= 0);
-	ms = ms_alloc(bts);
+	ms = ms_alloc(bts, __func__);
 	ms_set_ms_class(ms, ms_class);
 	/* Avoid delaying free to avoid tons of to-be-freed ms objects queuing */
 	ms_set_timeout(ms, 0);
 	ul_tbf = ul_tbf_alloc(bts, ms, -1, false);
-	if (!ul_tbf)
+	if (!ul_tbf) {
+		ms_unref(ms, __func__);
 		return false;
+	}
 
 	OSMO_ASSERT(ul_tbf->ms() == ms);
 	OSMO_ASSERT(ms_current_trx(ul_tbf->ms()));
@@ -330,13 +343,16 @@
 
 	/* assume final ack has not been sent */
 	dl_tbf = dl_tbf_alloc(bts, ms, trx_no, false);
-	if (!dl_tbf)
+	if (!dl_tbf) {
+		ms_unref(ms, __func__);
 		return false;
+	}
 
 	dump_assignment(dl_tbf, "DL", true);
 
 	check_tfi_usage(bts);
 
+	ms_unref(ms, __func__);
 	tbf_free(dl_tbf);
 	tbf_free(ul_tbf);
 	talloc_free(bts);
@@ -561,7 +577,7 @@
 
 		ms = bts_get_ms_by_tlli(bts, tlli, GSM_RESERVED_TMSI);
 		if (!ms)
-			ms = ms_alloc(bts);
+			ms = ms_alloc(bts, NULL);
 		ms_set_ms_class(ms, ms_class);
 		ms = alloc_tbfs(bts, ms, mode);
 		if (!ms)
@@ -770,7 +786,7 @@
 	trx->pdch[6].enable();
 	trx->pdch[7].enable();
 
-	ms = ms_alloc(bts);
+	ms = ms_alloc(bts, NULL);
 	ms_set_ms_class(ms, ms_class);
 	ms_set_egprs_ms_class(ms, egprs_ms_class);
 	dl_tbf1 = dl_tbf_alloc(bts, ms, 0, false);
@@ -783,7 +799,7 @@
 	OSMO_ASSERT(numTs1 == 4);
 	printf("TBF1: numTs(%d)\n", numTs1);
 
-	ms = ms_alloc(bts);
+	ms = ms_alloc(bts, NULL);
 	ms_set_ms_class(ms, ms_class);
 	ms_set_egprs_ms_class(ms, egprs_ms_class);
 	dl_tbf2 = dl_tbf_alloc(bts, ms, 0, false);
diff --git a/tests/app_info/AppInfoTest.cpp b/tests/app_info/AppInfoTest.cpp
index ea84b20..cb11d0f 100644
--- a/tests/app_info/AppInfoTest.cpp
+++ b/tests/app_info/AppInfoTest.cpp
@@ -90,11 +90,11 @@
 	trx->pdch[6].enable();
 	trx->pdch[7].enable();
 
-	ms1 = ms_alloc(bts);
+	ms1 = ms_alloc(bts, NULL);
 	ms_set_ms_class(ms1, 10);
 	ms_set_egprs_ms_class(ms1, 11);
 	tbf1 = dl_tbf_alloc(bts, ms1, 0, false);
-	ms2 = ms_alloc(bts);
+	ms2 = ms_alloc(bts, NULL);
 	ms_set_ms_class(ms2, 12);
 	ms_set_egprs_ms_class(ms2, 13);
 	tbf2 = dl_tbf_alloc(bts, ms2, 0, false);
diff --git a/tests/llc/LlcTest.cpp b/tests/llc/LlcTest.cpp
index ee227f9..3ceb17b 100644
--- a/tests/llc/LlcTest.cpp
+++ b/tests/llc/LlcTest.cpp
@@ -52,7 +52,7 @@
 	the_pcu = gprs_pcu_alloc(tall_pcu_ctx);
 	the_pcu->vty.llc_codel_interval_msec = LLC_CODEL_DISABLE;
 	struct gprs_rlcmac_bts *bts = bts_alloc(the_pcu, 0);
-	struct GprsMs *ms = ms_alloc(bts);
+	struct GprsMs *ms = ms_alloc(bts, NULL);
 	return ms_llc_queue(ms);
 }
 
@@ -235,7 +235,7 @@
 	/* DEFAULT should be resolved to GPRS_CODEL_SLOW_INTERVAL_MS 4000 */
 	#define GPRS_CODEL_SLOW_INTERVAL_MS 4000
 	struct gprs_rlcmac_bts *bts = bts_alloc(the_pcu, 0);
-	struct GprsMs *ms = ms_alloc(bts);
+	struct GprsMs *ms = ms_alloc(bts, NULL);
 	gprs_llc_queue *queue = ms_llc_queue(ms);
 	unsigned int i;
 
@@ -297,7 +297,7 @@
 static void test_llc_merge()
 {
 	gprs_llc_queue *queue1 = prepare_queue();
-	struct GprsMs *ms = ms_alloc(queue1->ms->bts);
+	struct GprsMs *ms = ms_alloc(queue1->ms->bts, NULL);
 	gprs_llc_queue *queue2 = ms_llc_queue(ms);
 	struct timespec expire_time = {0};
 
diff --git a/tests/ms/MsTest.cpp b/tests/ms/MsTest.cpp
index bc68c3d..7b7d59a 100644
--- a/tests/ms/MsTest.cpp
+++ b/tests/ms/MsTest.cpp
@@ -85,7 +85,7 @@
 
 	printf("=== start %s ===\n", __func__);
 
-	ms = ms_alloc(bts);
+	ms = ms_alloc(bts, __func__);
 	ms_set_tlli(ms, tlli);
 	OSMO_ASSERT(ms_is_idle(ms));
 
@@ -105,6 +105,9 @@
 	OSMO_ASSERT(ms_tbf(ms, GPRS_RLCMAC_UL_TBF) == ul_tbf);
 	OSMO_ASSERT(ms_tbf(ms, GPRS_RLCMAC_DL_TBF) == dl_tbf);
 
+	/* The MS is kept alive references by the TBFs: */
+	ms_unref(ms, __func__);
+
 	ms_detach_tbf(ms, ul_tbf);
 	OSMO_ASSERT(!ms_is_idle(ms));
 	OSMO_ASSERT(ms_ul_tbf(ms) == NULL);
@@ -130,7 +133,7 @@
 
 	printf("=== start %s ===\n", __func__);
 
-	ms = ms_alloc(bts);
+	ms = ms_alloc(bts, __func__);
 	ms_confirm_tlli(ms, tlli);
 
 	OSMO_ASSERT(ms_is_idle(ms));
@@ -157,6 +160,8 @@
 	OSMO_ASSERT(ms_dl_tbf(ms) == dl_tbf[1]);
 	OSMO_ASSERT(!llist_empty(&ms->old_tbfs));
 
+	ms_unref(ms, __func__);
+
 	ms_detach_tbf(ms, ul_tbf);
 	OSMO_ASSERT(!ms_is_idle(ms));
 	OSMO_ASSERT(ms_ul_tbf(ms) == NULL);
@@ -190,7 +195,7 @@
 
 	printf("=== start %s ===\n", __func__);
 
-	ms = ms_alloc(bts);
+	ms = ms_alloc(bts, __func__);
 
 	OSMO_ASSERT(ms_is_idle(ms));
 
@@ -267,7 +272,9 @@
 	OSMO_ASSERT(ms_check_tlli(ms, new_ms_tlli));
 	OSMO_ASSERT(!ms_check_tlli(ms, start_tlli));
 
-	talloc_free(ms);
+	/* This frees the MS: */
+	ms_unref(ms, __func__);
+
 	talloc_free(bts);
 	printf("=== end %s ===\n", __func__);
 }
@@ -278,7 +285,7 @@
 	if (ms)
 		return ms;
 
-	ms = ms_alloc(bts);
+	ms = ms_alloc(bts, NULL);
 
 	if (dir == GPRS_RLCMAC_UL_TBF)
 		ms_set_tlli(ms, tlli);
@@ -371,7 +378,7 @@
 
 	printf("=== start %s ===\n", __func__);
 
-	ms = ms_alloc(bts);
+	ms = ms_alloc(bts, __func__);
 	ms_set_tlli(ms, tlli);
 	ms_set_timeout(ms, 1);
 
@@ -386,6 +393,9 @@
 	ms_attach_tbf(ms, dl_tbf);
 	OSMO_ASSERT(!ms_is_idle(ms));
 
+	/* MS is kept alive by TBFs referencing it: */
+	ms_unref(ms, __func__);
+
 	ms_detach_tbf(ms, ul_tbf);
 	OSMO_ASSERT(!ms_is_idle(ms));
 
@@ -422,7 +432,7 @@
 	the_pcu->vty.cs_downgrade_threshold = 0;
 	the_pcu->vty.cs_adj_lower_limit = 0;
 
-	ms = ms_alloc(bts);
+	ms = ms_alloc(bts, __func__);
 	ms_confirm_tlli(ms, tlli);
 
 	OSMO_ASSERT(ms_is_idle(ms));
@@ -430,6 +440,8 @@
 	dl_tbf = alloc_dl_tbf(bts, ms);
 	ms_attach_tbf(ms, dl_tbf);
 
+	ms_unref(ms, __func__);
+
 	OSMO_ASSERT(!ms_is_idle(ms));
 
 	OSMO_ASSERT(mcs_chan_code(ms_current_cs_dl(ms, ms_mode(ms))) == 3);
@@ -463,7 +475,7 @@
 
 	printf("=== start %s ===\n", __func__);
 
-	ms1 = ms_alloc(bts);
+	ms1 = ms_alloc(bts, __func__);
 	ms_confirm_tlli(ms1, tlli);
 	dump_ms(ms1, "1: no BTS defaults  ");
 
@@ -471,7 +483,7 @@
 	bts->initial_cs_ul = 1;
 	the_pcu->vty.cs_downgrade_threshold = 0;
 
-	ms2 = ms_alloc(bts);
+	ms2 = ms_alloc(bts,__func__);
 	ms_confirm_tlli(ms2, tlli + 1);
 	dump_ms(ms2, "2: with BTS defaults");
 
diff --git a/tests/ms/MsTest.err b/tests/ms/MsTest.err
index 0cc351b..84a948e 100644
--- a/tests/ms/MsTest.err
+++ b/tests/ms/MsTest.err
@@ -1,16 +1,16 @@
 Creating MS object
+MS(TA-220:MSCLS-0-0): + test_ms_state: now used by 1 (test_ms_state)
 Modifying MS object, UL TLLI: 0xffffffff -> 0xffeeddbb, not yet confirmed
 MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0) Attaching UL TBF: TBF(UL:STATE-NEW:GPRS:TLLI-0xffeeddbb)
-MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0:UL): + tbf: now used by 1 (tbf)
 MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0:UL) Attaching DL TBF: TBF(DL:STATE-NEW:GPRS:TLLI-0xffeeddbb)
 MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0:UL:DL) Detaching TBF: TBF(UL:STATE-NEW:GPRS:TLLI-0xffeeddbb)
 MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0:DL) Detaching TBF: TBF(DL:STATE-NEW:GPRS:TLLI-0xffeeddbb)
 MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0): - tbf: now used by 0 (-)
 MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0) Destroying MS object
 Creating MS object
+MS(TA-220:MSCLS-0-0): + test_ms_replace_tbf: now used by 1 (test_ms_replace_tbf)
 The MS object cannot fully confirm an unexpected TLLI: 0xffeeddbb, partly confirmed
 MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0) Attaching DL TBF: TBF(DL:STATE-NEW:GPRS:TLLI-0xffeeddbb)
-MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0:DL): + tbf: now used by 1 (tbf)
 MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0:DL) Attaching DL TBF: TBF(DL:STATE-NEW:GPRS:TLLI-0xffeeddbb)
 MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0:DL) Attaching UL TBF: TBF(UL:STATE-NEW:GPRS:TLLI-0xffeeddbb)
 MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0:UL:DL) Detaching TBF: TBF(UL:STATE-NEW:GPRS:TLLI-0xffeeddbb)
@@ -19,6 +19,7 @@
 MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0): - tbf: now used by 0 (-)
 MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0) Destroying MS object
 Creating MS object
+MS(TA-220:MSCLS-0-0): + test_ms_change_tlli: now used by 1 (test_ms_change_tlli)
 Modifying MS object, UL TLLI: 0xffffffff -> 0xff001111, not yet confirmed
 Modifying MS object, TLLI: 0xff001111 confirmed
 Modifying MS object, UL TLLI: 0xff001111 -> 0xaa000000, not yet confirmed
@@ -34,6 +35,7 @@
 Modifying MS object, TLLI: 0xaa000000 confirmed
 The MS object cannot fully confirm an unexpected TLLI: 0xff001111, partly confirmed
 Modifying MS object, TLLI: 0xaa000000 -> 0xff001111, already confirmed partly
+MS(TLLI-0xff001111:TA-220:MSCLS-0-0): - test_ms_change_tlli: now used by 0 (-)
 MS(TLLI-0xff001111:TA-220:MSCLS-0-0) Destroying MS object
 Creating MS object
 Modifying MS object, UL TLLI: 0xffffffff -> 0xffeeddbb, not yet confirmed
@@ -52,9 +54,9 @@
 MS(IMSI-001001987654322:TLLI-0xffeeddbc:TA-220:MSCLS-0-0): - tbf: now used by 0 (-)
 MS(IMSI-001001987654322:TLLI-0xffeeddbc:TA-220:MSCLS-0-0) Destroying MS object
 Creating MS object
+MS(TA-220:MSCLS-0-0): + test_ms_timeout: now used by 1 (test_ms_timeout)
 Modifying MS object, UL TLLI: 0xffffffff -> 0xffeeddbb, not yet confirmed
 MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0) Attaching UL TBF: TBF(UL:STATE-NEW:GPRS:TLLI-0xffeeddbb)
-MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0:UL): + tbf: now used by 1 (tbf)
 MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0:UL) Attaching DL TBF: TBF(DL:STATE-NEW:GPRS:TLLI-0xffeeddbb)
 MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0:UL:DL) Detaching TBF: TBF(UL:STATE-NEW:GPRS:TLLI-0xffeeddbb)
 MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0:DL) Detaching TBF: TBF(DL:STATE-NEW:GPRS:TLLI-0xffeeddbb)
@@ -62,19 +64,19 @@
 MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0) Release timer expired
 MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0) Destroying MS object
 Creating MS object
+MS(TA-220:MSCLS-0-0): + test_ms_cs_selection: now used by 1 (test_ms_cs_selection)
 The MS object cannot fully confirm an unexpected TLLI: 0xffeeddbb, partly confirmed
 MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0) Attaching DL TBF: TBF(DL:STATE-NEW:GPRS:TLLI-0xffeeddbb)
-MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0:DL): + tbf: now used by 1 (tbf)
 MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0:DL) Destroying MS object
 MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0:DL) Detaching TBF: TBF(DL:STATE-NEW:GPRS:TLLI-0xffeeddbb)
 MS(TLLI-0xffeeddbb:TA-220:MSCLS-0-0): - tbf: now used by 0 (-)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + test_ms_mcs_mode: now used by 1 (test_ms_mcs_mode)
 The MS object cannot fully confirm an unexpected TLLI: 0xdeadbeef, partly confirmed
 Creating MS object
+MS(TA-220:MSCLS-0-0): + test_ms_mcs_mode: now used by 1 (test_ms_mcs_mode)
 The MS object cannot fully confirm an unexpected TLLI: 0xdeadbef0, partly confirmed
 MS(TLLI-0xdeadbef0:TA-220:MSCLS-0-0) Attaching DL TBF: TBF(DL:STATE-NEW:GPRS:TLLI-0xdeadbef0)
-MS(TLLI-0xdeadbef0:TA-220:MSCLS-0-0:DL): + tbf: now used by 1 (tbf)
 MS(TLLI-0xdeadbeef:TA-220:MSCLS-0-0) Destroying MS object
 MS(TLLI-0xdeadbef0:TA-220:MSCLS-0-0:DL) Destroying MS object
 MS(TLLI-0xdeadbef0:TA-220:MSCLS-0-0:DL) Detaching TBF: TBF(DL:STATE-NEW:GPRS:TLLI-0xdeadbef0)
-MS(TLLI-0xdeadbef0:TA-220:MSCLS-0-0): - tbf: now used by 0 (-)
diff --git a/tests/tbf/TbfTest.cpp b/tests/tbf/TbfTest.cpp
index e67bd17..4adbaf8 100644
--- a/tests/tbf/TbfTest.cpp
+++ b/tests/tbf/TbfTest.cpp
@@ -122,7 +122,7 @@
 	/*
 	 * Make a uplink and downlink allocation
 	 */
-	ms = ms_alloc(bts);
+	ms = ms_alloc(bts, NULL);
 	gprs_rlcmac_tbf *dl_tbf = dl_tbf_alloc(bts,
 						ms, 0, false);
 	OSMO_ASSERT(dl_tbf != NULL);
@@ -205,7 +205,7 @@
 	GprsMs *ms;
 	gprs_rlcmac_dl_tbf *dl_tbf;
 
-	ms = ms_alloc(bts);
+	ms = ms_alloc(bts, NULL);
 	ms_set_ms_class(ms, ms_class);
 	ms_set_egprs_ms_class(ms, egprs_ms_class);
 
@@ -2346,7 +2346,7 @@
 	gprs_bssgp_init(bts, 4234, 4234, 1, 1, false, 0, 0, 0);
 
 	/* Does no support EGPRS */
-	ms = ms_alloc(bts);
+	ms = ms_alloc(bts, NULL);
 	ms_set_ms_class(ms, ms_class);
 	dl_tbf = dl_tbf_alloc(bts, ms, 0, false);
 
@@ -2355,7 +2355,7 @@
 	/* EGPRS-only */
 
 	/* Does support EGPRS */
-	ms = ms_alloc(bts);
+	ms = ms_alloc(bts, NULL);
 	ms_set_ms_class(ms, ms_class);
 	ms_set_egprs_ms_class(ms, ms_class);
 	dl_tbf = dl_tbf_alloc(bts, ms, 0, false);
@@ -2397,7 +2397,7 @@
 	/* EGPRS-only */
 
 	/* Does support EGPRS */
-	ms = ms_alloc(bts);
+	ms = ms_alloc(bts, NULL);
 	ms_set_ms_class(ms, ms_class);
 	ms_set_egprs_ms_class(ms, ms_class);
 	dl_tbf = dl_tbf_alloc(bts, ms, 0, true);
@@ -2476,7 +2476,7 @@
 	trx0->pdch[2].enable();
 	trx0->pdch[3].enable();
 
-	second_ms = ms_alloc(bts);
+	second_ms = ms_alloc(bts, NULL);
 	ms_set_tlli(second_ms, new_tlli);
 	ul_tbf = ul_tbf_alloc(bts, second_ms, 0, true);
 	OSMO_ASSERT(ul_tbf != NULL);
@@ -3335,7 +3335,7 @@
 
 	int rc = 0;
 
-	ms = ms_alloc(bts);
+	ms = ms_alloc(bts, NULL);
 	ms_set_tlli(ms, tlli);
 	ul_tbf = ms_new_ul_tbf_rejected_pacch(ms, pdch);
 
diff --git a/tests/tbf/TbfTest.err b/tests/tbf/TbfTest.err
index e17a6a8..657db59 100644
--- a/tests/tbf/TbfTest.err
+++ b/tests/tbf/TbfTest.err
@@ -670,6 +670,7 @@
 === start test_tbf_exhaustion ===
 PDCH(bts=0,trx=0,ts=4) PDCH state: disabled => enabled
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000000'
 The MS object cannot fully confirm an unexpected TLLI: 0xc0000000, partly confirmed
 Modifying MS object, TLLI = 0xc0000000, MS class 0 -> 45
@@ -692,7 +693,7 @@
 TBF(DL:TFI-0-0-0:STATE-NEW:GPRS:IMSI-001001000000000:TLLI-0xc0000000) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-0:STATE-NEW:GPRS:IMSI-001001000000000:TLLI-0xc0000000) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000000:TLLI-0xc0000000:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-0:STATE-NEW:GPRS:IMSI-001001000000000:TLLI-0xc0000000)
-MS(IMSI-001001000000000:TLLI-0xc0000000:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000000:TLLI-0xc0000000:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-0:STATE-NEW:GPRS:IMSI-001001000000000:TLLI-0xc0000000) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-0:STATE-NEW:GPRS:IMSI-001001000000000:TLLI-0xc0000000) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000000)
 DL_TBF(DL:TFI-0-0-0:STATE-NEW:GPRS:IMSI-001001000000000:TLLI-0xc0000000){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -700,7 +701,9 @@
 DL_TBF(DL:TFI-0-0-0:STATE-NEW:GPRS:IMSI-001001000000000:TLLI-0xc0000000){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-0:STATE-ASSIGN:GPRS:IMSI-001001000000000:TLLI-0xc0000000) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000000:TLLI-0xc0000000:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000001'
 The MS object cannot fully confirm an unexpected TLLI: 0xc0000001, partly confirmed
 Modifying MS object, TLLI = 0xc0000001, MS class 0 -> 45
@@ -723,7 +726,7 @@
 TBF(DL:TFI-0-0-1:STATE-NEW:GPRS:IMSI-001001000000001:TLLI-0xc0000001) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-1:STATE-NEW:GPRS:IMSI-001001000000001:TLLI-0xc0000001) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000001:TLLI-0xc0000001:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-1:STATE-NEW:GPRS:IMSI-001001000000001:TLLI-0xc0000001)
-MS(IMSI-001001000000001:TLLI-0xc0000001:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000001:TLLI-0xc0000001:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-1:STATE-NEW:GPRS:IMSI-001001000000001:TLLI-0xc0000001) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-1:STATE-NEW:GPRS:IMSI-001001000000001:TLLI-0xc0000001) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000001)
 DL_TBF(DL:TFI-0-0-1:STATE-NEW:GPRS:IMSI-001001000000001:TLLI-0xc0000001){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -731,7 +734,9 @@
 DL_TBF(DL:TFI-0-0-1:STATE-NEW:GPRS:IMSI-001001000000001:TLLI-0xc0000001){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-1:STATE-ASSIGN:GPRS:IMSI-001001000000001:TLLI-0xc0000001) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000001:TLLI-0xc0000001:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000002'
 The MS object cannot fully confirm an unexpected TLLI: 0xc0000002, partly confirmed
 Modifying MS object, TLLI = 0xc0000002, MS class 0 -> 45
@@ -754,7 +759,7 @@
 TBF(DL:TFI-0-0-2:STATE-NEW:GPRS:IMSI-001001000000002:TLLI-0xc0000002) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-2:STATE-NEW:GPRS:IMSI-001001000000002:TLLI-0xc0000002) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000002:TLLI-0xc0000002:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-2:STATE-NEW:GPRS:IMSI-001001000000002:TLLI-0xc0000002)
-MS(IMSI-001001000000002:TLLI-0xc0000002:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000002:TLLI-0xc0000002:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-2:STATE-NEW:GPRS:IMSI-001001000000002:TLLI-0xc0000002) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-2:STATE-NEW:GPRS:IMSI-001001000000002:TLLI-0xc0000002) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000002)
 DL_TBF(DL:TFI-0-0-2:STATE-NEW:GPRS:IMSI-001001000000002:TLLI-0xc0000002){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -762,7 +767,9 @@
 DL_TBF(DL:TFI-0-0-2:STATE-NEW:GPRS:IMSI-001001000000002:TLLI-0xc0000002){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-2:STATE-ASSIGN:GPRS:IMSI-001001000000002:TLLI-0xc0000002) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000002:TLLI-0xc0000002:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000003'
 The MS object cannot fully confirm an unexpected TLLI: 0xc0000003, partly confirmed
 Modifying MS object, TLLI = 0xc0000003, MS class 0 -> 45
@@ -785,7 +792,7 @@
 TBF(DL:TFI-0-0-3:STATE-NEW:GPRS:IMSI-001001000000003:TLLI-0xc0000003) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-3:STATE-NEW:GPRS:IMSI-001001000000003:TLLI-0xc0000003) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000003:TLLI-0xc0000003:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-3:STATE-NEW:GPRS:IMSI-001001000000003:TLLI-0xc0000003)
-MS(IMSI-001001000000003:TLLI-0xc0000003:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000003:TLLI-0xc0000003:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-3:STATE-NEW:GPRS:IMSI-001001000000003:TLLI-0xc0000003) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-3:STATE-NEW:GPRS:IMSI-001001000000003:TLLI-0xc0000003) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000003)
 DL_TBF(DL:TFI-0-0-3:STATE-NEW:GPRS:IMSI-001001000000003:TLLI-0xc0000003){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -793,7 +800,9 @@
 DL_TBF(DL:TFI-0-0-3:STATE-NEW:GPRS:IMSI-001001000000003:TLLI-0xc0000003){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-3:STATE-ASSIGN:GPRS:IMSI-001001000000003:TLLI-0xc0000003) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000003:TLLI-0xc0000003:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000004'
 The MS object cannot fully confirm an unexpected TLLI: 0xc0000004, partly confirmed
 Modifying MS object, TLLI = 0xc0000004, MS class 0 -> 45
@@ -816,7 +825,7 @@
 TBF(DL:TFI-0-0-4:STATE-NEW:GPRS:IMSI-001001000000004:TLLI-0xc0000004) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-4:STATE-NEW:GPRS:IMSI-001001000000004:TLLI-0xc0000004) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000004:TLLI-0xc0000004:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-4:STATE-NEW:GPRS:IMSI-001001000000004:TLLI-0xc0000004)
-MS(IMSI-001001000000004:TLLI-0xc0000004:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000004:TLLI-0xc0000004:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-4:STATE-NEW:GPRS:IMSI-001001000000004:TLLI-0xc0000004) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-4:STATE-NEW:GPRS:IMSI-001001000000004:TLLI-0xc0000004) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000004)
 DL_TBF(DL:TFI-0-0-4:STATE-NEW:GPRS:IMSI-001001000000004:TLLI-0xc0000004){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -824,7 +833,9 @@
 DL_TBF(DL:TFI-0-0-4:STATE-NEW:GPRS:IMSI-001001000000004:TLLI-0xc0000004){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-4:STATE-ASSIGN:GPRS:IMSI-001001000000004:TLLI-0xc0000004) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000004:TLLI-0xc0000004:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000005'
 The MS object cannot fully confirm an unexpected TLLI: 0xc0000005, partly confirmed
 Modifying MS object, TLLI = 0xc0000005, MS class 0 -> 45
@@ -847,7 +858,7 @@
 TBF(DL:TFI-0-0-5:STATE-NEW:GPRS:IMSI-001001000000005:TLLI-0xc0000005) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-5:STATE-NEW:GPRS:IMSI-001001000000005:TLLI-0xc0000005) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000005:TLLI-0xc0000005:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-5:STATE-NEW:GPRS:IMSI-001001000000005:TLLI-0xc0000005)
-MS(IMSI-001001000000005:TLLI-0xc0000005:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000005:TLLI-0xc0000005:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-5:STATE-NEW:GPRS:IMSI-001001000000005:TLLI-0xc0000005) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-5:STATE-NEW:GPRS:IMSI-001001000000005:TLLI-0xc0000005) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000005)
 DL_TBF(DL:TFI-0-0-5:STATE-NEW:GPRS:IMSI-001001000000005:TLLI-0xc0000005){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -855,7 +866,9 @@
 DL_TBF(DL:TFI-0-0-5:STATE-NEW:GPRS:IMSI-001001000000005:TLLI-0xc0000005){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-5:STATE-ASSIGN:GPRS:IMSI-001001000000005:TLLI-0xc0000005) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000005:TLLI-0xc0000005:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000006'
 The MS object cannot fully confirm an unexpected TLLI: 0xc0000006, partly confirmed
 Modifying MS object, TLLI = 0xc0000006, MS class 0 -> 45
@@ -878,7 +891,7 @@
 TBF(DL:TFI-0-0-6:STATE-NEW:GPRS:IMSI-001001000000006:TLLI-0xc0000006) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-6:STATE-NEW:GPRS:IMSI-001001000000006:TLLI-0xc0000006) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000006:TLLI-0xc0000006:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-6:STATE-NEW:GPRS:IMSI-001001000000006:TLLI-0xc0000006)
-MS(IMSI-001001000000006:TLLI-0xc0000006:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000006:TLLI-0xc0000006:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-6:STATE-NEW:GPRS:IMSI-001001000000006:TLLI-0xc0000006) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-6:STATE-NEW:GPRS:IMSI-001001000000006:TLLI-0xc0000006) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000006)
 DL_TBF(DL:TFI-0-0-6:STATE-NEW:GPRS:IMSI-001001000000006:TLLI-0xc0000006){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -886,7 +899,9 @@
 DL_TBF(DL:TFI-0-0-6:STATE-NEW:GPRS:IMSI-001001000000006:TLLI-0xc0000006){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-6:STATE-ASSIGN:GPRS:IMSI-001001000000006:TLLI-0xc0000006) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000006:TLLI-0xc0000006:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000007'
 The MS object cannot fully confirm an unexpected TLLI: 0xc0000007, partly confirmed
 Modifying MS object, TLLI = 0xc0000007, MS class 0 -> 45
@@ -909,7 +924,7 @@
 TBF(DL:TFI-0-0-7:STATE-NEW:GPRS:IMSI-001001000000007:TLLI-0xc0000007) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-7:STATE-NEW:GPRS:IMSI-001001000000007:TLLI-0xc0000007) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000007:TLLI-0xc0000007:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-7:STATE-NEW:GPRS:IMSI-001001000000007:TLLI-0xc0000007)
-MS(IMSI-001001000000007:TLLI-0xc0000007:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000007:TLLI-0xc0000007:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-7:STATE-NEW:GPRS:IMSI-001001000000007:TLLI-0xc0000007) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-7:STATE-NEW:GPRS:IMSI-001001000000007:TLLI-0xc0000007) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000007)
 DL_TBF(DL:TFI-0-0-7:STATE-NEW:GPRS:IMSI-001001000000007:TLLI-0xc0000007){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -917,7 +932,9 @@
 DL_TBF(DL:TFI-0-0-7:STATE-NEW:GPRS:IMSI-001001000000007:TLLI-0xc0000007){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-7:STATE-ASSIGN:GPRS:IMSI-001001000000007:TLLI-0xc0000007) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000007:TLLI-0xc0000007:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000008'
 The MS object cannot fully confirm an unexpected TLLI: 0xc0000008, partly confirmed
 Modifying MS object, TLLI = 0xc0000008, MS class 0 -> 45
@@ -940,7 +957,7 @@
 TBF(DL:TFI-0-0-8:STATE-NEW:GPRS:IMSI-001001000000008:TLLI-0xc0000008) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-8:STATE-NEW:GPRS:IMSI-001001000000008:TLLI-0xc0000008) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000008:TLLI-0xc0000008:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-8:STATE-NEW:GPRS:IMSI-001001000000008:TLLI-0xc0000008)
-MS(IMSI-001001000000008:TLLI-0xc0000008:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000008:TLLI-0xc0000008:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-8:STATE-NEW:GPRS:IMSI-001001000000008:TLLI-0xc0000008) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-8:STATE-NEW:GPRS:IMSI-001001000000008:TLLI-0xc0000008) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000008)
 DL_TBF(DL:TFI-0-0-8:STATE-NEW:GPRS:IMSI-001001000000008:TLLI-0xc0000008){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -948,7 +965,9 @@
 DL_TBF(DL:TFI-0-0-8:STATE-NEW:GPRS:IMSI-001001000000008:TLLI-0xc0000008){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-8:STATE-ASSIGN:GPRS:IMSI-001001000000008:TLLI-0xc0000008) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000008:TLLI-0xc0000008:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000009'
 The MS object cannot fully confirm an unexpected TLLI: 0xc0000009, partly confirmed
 Modifying MS object, TLLI = 0xc0000009, MS class 0 -> 45
@@ -971,7 +990,7 @@
 TBF(DL:TFI-0-0-9:STATE-NEW:GPRS:IMSI-001001000000009:TLLI-0xc0000009) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-9:STATE-NEW:GPRS:IMSI-001001000000009:TLLI-0xc0000009) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000009:TLLI-0xc0000009:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-9:STATE-NEW:GPRS:IMSI-001001000000009:TLLI-0xc0000009)
-MS(IMSI-001001000000009:TLLI-0xc0000009:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000009:TLLI-0xc0000009:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-9:STATE-NEW:GPRS:IMSI-001001000000009:TLLI-0xc0000009) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-9:STATE-NEW:GPRS:IMSI-001001000000009:TLLI-0xc0000009) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000009)
 DL_TBF(DL:TFI-0-0-9:STATE-NEW:GPRS:IMSI-001001000000009:TLLI-0xc0000009){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -979,7 +998,9 @@
 DL_TBF(DL:TFI-0-0-9:STATE-NEW:GPRS:IMSI-001001000000009:TLLI-0xc0000009){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-9:STATE-ASSIGN:GPRS:IMSI-001001000000009:TLLI-0xc0000009) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000009:TLLI-0xc0000009:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000010'
 The MS object cannot fully confirm an unexpected TLLI: 0xc000000a, partly confirmed
 Modifying MS object, TLLI = 0xc000000a, MS class 0 -> 45
@@ -1002,7 +1023,7 @@
 TBF(DL:TFI-0-0-10:STATE-NEW:GPRS:IMSI-001001000000010:TLLI-0xc000000a) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-10:STATE-NEW:GPRS:IMSI-001001000000010:TLLI-0xc000000a) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000010:TLLI-0xc000000a:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-10:STATE-NEW:GPRS:IMSI-001001000000010:TLLI-0xc000000a)
-MS(IMSI-001001000000010:TLLI-0xc000000a:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000010:TLLI-0xc000000a:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-10:STATE-NEW:GPRS:IMSI-001001000000010:TLLI-0xc000000a) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-10:STATE-NEW:GPRS:IMSI-001001000000010:TLLI-0xc000000a) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000010)
 DL_TBF(DL:TFI-0-0-10:STATE-NEW:GPRS:IMSI-001001000000010:TLLI-0xc000000a){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -1010,7 +1031,9 @@
 DL_TBF(DL:TFI-0-0-10:STATE-NEW:GPRS:IMSI-001001000000010:TLLI-0xc000000a){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-10:STATE-ASSIGN:GPRS:IMSI-001001000000010:TLLI-0xc000000a) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000010:TLLI-0xc000000a:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000011'
 The MS object cannot fully confirm an unexpected TLLI: 0xc000000b, partly confirmed
 Modifying MS object, TLLI = 0xc000000b, MS class 0 -> 45
@@ -1033,7 +1056,7 @@
 TBF(DL:TFI-0-0-11:STATE-NEW:GPRS:IMSI-001001000000011:TLLI-0xc000000b) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-11:STATE-NEW:GPRS:IMSI-001001000000011:TLLI-0xc000000b) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000011:TLLI-0xc000000b:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-11:STATE-NEW:GPRS:IMSI-001001000000011:TLLI-0xc000000b)
-MS(IMSI-001001000000011:TLLI-0xc000000b:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000011:TLLI-0xc000000b:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-11:STATE-NEW:GPRS:IMSI-001001000000011:TLLI-0xc000000b) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-11:STATE-NEW:GPRS:IMSI-001001000000011:TLLI-0xc000000b) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000011)
 DL_TBF(DL:TFI-0-0-11:STATE-NEW:GPRS:IMSI-001001000000011:TLLI-0xc000000b){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -1041,7 +1064,9 @@
 DL_TBF(DL:TFI-0-0-11:STATE-NEW:GPRS:IMSI-001001000000011:TLLI-0xc000000b){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-11:STATE-ASSIGN:GPRS:IMSI-001001000000011:TLLI-0xc000000b) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000011:TLLI-0xc000000b:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000012'
 The MS object cannot fully confirm an unexpected TLLI: 0xc000000c, partly confirmed
 Modifying MS object, TLLI = 0xc000000c, MS class 0 -> 45
@@ -1064,7 +1089,7 @@
 TBF(DL:TFI-0-0-12:STATE-NEW:GPRS:IMSI-001001000000012:TLLI-0xc000000c) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-12:STATE-NEW:GPRS:IMSI-001001000000012:TLLI-0xc000000c) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000012:TLLI-0xc000000c:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-12:STATE-NEW:GPRS:IMSI-001001000000012:TLLI-0xc000000c)
-MS(IMSI-001001000000012:TLLI-0xc000000c:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000012:TLLI-0xc000000c:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-12:STATE-NEW:GPRS:IMSI-001001000000012:TLLI-0xc000000c) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-12:STATE-NEW:GPRS:IMSI-001001000000012:TLLI-0xc000000c) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000012)
 DL_TBF(DL:TFI-0-0-12:STATE-NEW:GPRS:IMSI-001001000000012:TLLI-0xc000000c){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -1072,7 +1097,9 @@
 DL_TBF(DL:TFI-0-0-12:STATE-NEW:GPRS:IMSI-001001000000012:TLLI-0xc000000c){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-12:STATE-ASSIGN:GPRS:IMSI-001001000000012:TLLI-0xc000000c) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000012:TLLI-0xc000000c:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000013'
 The MS object cannot fully confirm an unexpected TLLI: 0xc000000d, partly confirmed
 Modifying MS object, TLLI = 0xc000000d, MS class 0 -> 45
@@ -1095,7 +1122,7 @@
 TBF(DL:TFI-0-0-13:STATE-NEW:GPRS:IMSI-001001000000013:TLLI-0xc000000d) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-13:STATE-NEW:GPRS:IMSI-001001000000013:TLLI-0xc000000d) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000013:TLLI-0xc000000d:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-13:STATE-NEW:GPRS:IMSI-001001000000013:TLLI-0xc000000d)
-MS(IMSI-001001000000013:TLLI-0xc000000d:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000013:TLLI-0xc000000d:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-13:STATE-NEW:GPRS:IMSI-001001000000013:TLLI-0xc000000d) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-13:STATE-NEW:GPRS:IMSI-001001000000013:TLLI-0xc000000d) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000013)
 DL_TBF(DL:TFI-0-0-13:STATE-NEW:GPRS:IMSI-001001000000013:TLLI-0xc000000d){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -1103,7 +1130,9 @@
 DL_TBF(DL:TFI-0-0-13:STATE-NEW:GPRS:IMSI-001001000000013:TLLI-0xc000000d){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-13:STATE-ASSIGN:GPRS:IMSI-001001000000013:TLLI-0xc000000d) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000013:TLLI-0xc000000d:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000014'
 The MS object cannot fully confirm an unexpected TLLI: 0xc000000e, partly confirmed
 Modifying MS object, TLLI = 0xc000000e, MS class 0 -> 45
@@ -1126,7 +1155,7 @@
 TBF(DL:TFI-0-0-14:STATE-NEW:GPRS:IMSI-001001000000014:TLLI-0xc000000e) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-14:STATE-NEW:GPRS:IMSI-001001000000014:TLLI-0xc000000e) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000014:TLLI-0xc000000e:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-14:STATE-NEW:GPRS:IMSI-001001000000014:TLLI-0xc000000e)
-MS(IMSI-001001000000014:TLLI-0xc000000e:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000014:TLLI-0xc000000e:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-14:STATE-NEW:GPRS:IMSI-001001000000014:TLLI-0xc000000e) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-14:STATE-NEW:GPRS:IMSI-001001000000014:TLLI-0xc000000e) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000014)
 DL_TBF(DL:TFI-0-0-14:STATE-NEW:GPRS:IMSI-001001000000014:TLLI-0xc000000e){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -1134,7 +1163,9 @@
 DL_TBF(DL:TFI-0-0-14:STATE-NEW:GPRS:IMSI-001001000000014:TLLI-0xc000000e){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-14:STATE-ASSIGN:GPRS:IMSI-001001000000014:TLLI-0xc000000e) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000014:TLLI-0xc000000e:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000015'
 The MS object cannot fully confirm an unexpected TLLI: 0xc000000f, partly confirmed
 Modifying MS object, TLLI = 0xc000000f, MS class 0 -> 45
@@ -1157,7 +1188,7 @@
 TBF(DL:TFI-0-0-15:STATE-NEW:GPRS:IMSI-001001000000015:TLLI-0xc000000f) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-15:STATE-NEW:GPRS:IMSI-001001000000015:TLLI-0xc000000f) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000015:TLLI-0xc000000f:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-15:STATE-NEW:GPRS:IMSI-001001000000015:TLLI-0xc000000f)
-MS(IMSI-001001000000015:TLLI-0xc000000f:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000015:TLLI-0xc000000f:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-15:STATE-NEW:GPRS:IMSI-001001000000015:TLLI-0xc000000f) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-15:STATE-NEW:GPRS:IMSI-001001000000015:TLLI-0xc000000f) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000015)
 DL_TBF(DL:TFI-0-0-15:STATE-NEW:GPRS:IMSI-001001000000015:TLLI-0xc000000f){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -1165,7 +1196,9 @@
 DL_TBF(DL:TFI-0-0-15:STATE-NEW:GPRS:IMSI-001001000000015:TLLI-0xc000000f){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-15:STATE-ASSIGN:GPRS:IMSI-001001000000015:TLLI-0xc000000f) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000015:TLLI-0xc000000f:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000016'
 The MS object cannot fully confirm an unexpected TLLI: 0xc0000010, partly confirmed
 Modifying MS object, TLLI = 0xc0000010, MS class 0 -> 45
@@ -1188,7 +1221,7 @@
 TBF(DL:TFI-0-0-16:STATE-NEW:GPRS:IMSI-001001000000016:TLLI-0xc0000010) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-16:STATE-NEW:GPRS:IMSI-001001000000016:TLLI-0xc0000010) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000016:TLLI-0xc0000010:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-16:STATE-NEW:GPRS:IMSI-001001000000016:TLLI-0xc0000010)
-MS(IMSI-001001000000016:TLLI-0xc0000010:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000016:TLLI-0xc0000010:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-16:STATE-NEW:GPRS:IMSI-001001000000016:TLLI-0xc0000010) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-16:STATE-NEW:GPRS:IMSI-001001000000016:TLLI-0xc0000010) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000016)
 DL_TBF(DL:TFI-0-0-16:STATE-NEW:GPRS:IMSI-001001000000016:TLLI-0xc0000010){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -1196,7 +1229,9 @@
 DL_TBF(DL:TFI-0-0-16:STATE-NEW:GPRS:IMSI-001001000000016:TLLI-0xc0000010){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-16:STATE-ASSIGN:GPRS:IMSI-001001000000016:TLLI-0xc0000010) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000016:TLLI-0xc0000010:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000017'
 The MS object cannot fully confirm an unexpected TLLI: 0xc0000011, partly confirmed
 Modifying MS object, TLLI = 0xc0000011, MS class 0 -> 45
@@ -1219,7 +1254,7 @@
 TBF(DL:TFI-0-0-17:STATE-NEW:GPRS:IMSI-001001000000017:TLLI-0xc0000011) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-17:STATE-NEW:GPRS:IMSI-001001000000017:TLLI-0xc0000011) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000017:TLLI-0xc0000011:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-17:STATE-NEW:GPRS:IMSI-001001000000017:TLLI-0xc0000011)
-MS(IMSI-001001000000017:TLLI-0xc0000011:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000017:TLLI-0xc0000011:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-17:STATE-NEW:GPRS:IMSI-001001000000017:TLLI-0xc0000011) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-17:STATE-NEW:GPRS:IMSI-001001000000017:TLLI-0xc0000011) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000017)
 DL_TBF(DL:TFI-0-0-17:STATE-NEW:GPRS:IMSI-001001000000017:TLLI-0xc0000011){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -1227,7 +1262,9 @@
 DL_TBF(DL:TFI-0-0-17:STATE-NEW:GPRS:IMSI-001001000000017:TLLI-0xc0000011){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-17:STATE-ASSIGN:GPRS:IMSI-001001000000017:TLLI-0xc0000011) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000017:TLLI-0xc0000011:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000018'
 The MS object cannot fully confirm an unexpected TLLI: 0xc0000012, partly confirmed
 Modifying MS object, TLLI = 0xc0000012, MS class 0 -> 45
@@ -1250,7 +1287,7 @@
 TBF(DL:TFI-0-0-18:STATE-NEW:GPRS:IMSI-001001000000018:TLLI-0xc0000012) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-18:STATE-NEW:GPRS:IMSI-001001000000018:TLLI-0xc0000012) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000018:TLLI-0xc0000012:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-18:STATE-NEW:GPRS:IMSI-001001000000018:TLLI-0xc0000012)
-MS(IMSI-001001000000018:TLLI-0xc0000012:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000018:TLLI-0xc0000012:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-18:STATE-NEW:GPRS:IMSI-001001000000018:TLLI-0xc0000012) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-18:STATE-NEW:GPRS:IMSI-001001000000018:TLLI-0xc0000012) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000018)
 DL_TBF(DL:TFI-0-0-18:STATE-NEW:GPRS:IMSI-001001000000018:TLLI-0xc0000012){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -1258,7 +1295,9 @@
 DL_TBF(DL:TFI-0-0-18:STATE-NEW:GPRS:IMSI-001001000000018:TLLI-0xc0000012){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-18:STATE-ASSIGN:GPRS:IMSI-001001000000018:TLLI-0xc0000012) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000018:TLLI-0xc0000012:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000019'
 The MS object cannot fully confirm an unexpected TLLI: 0xc0000013, partly confirmed
 Modifying MS object, TLLI = 0xc0000013, MS class 0 -> 45
@@ -1281,7 +1320,7 @@
 TBF(DL:TFI-0-0-19:STATE-NEW:GPRS:IMSI-001001000000019:TLLI-0xc0000013) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-19:STATE-NEW:GPRS:IMSI-001001000000019:TLLI-0xc0000013) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000019:TLLI-0xc0000013:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-19:STATE-NEW:GPRS:IMSI-001001000000019:TLLI-0xc0000013)
-MS(IMSI-001001000000019:TLLI-0xc0000013:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000019:TLLI-0xc0000013:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-19:STATE-NEW:GPRS:IMSI-001001000000019:TLLI-0xc0000013) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-19:STATE-NEW:GPRS:IMSI-001001000000019:TLLI-0xc0000013) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000019)
 DL_TBF(DL:TFI-0-0-19:STATE-NEW:GPRS:IMSI-001001000000019:TLLI-0xc0000013){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -1289,7 +1328,9 @@
 DL_TBF(DL:TFI-0-0-19:STATE-NEW:GPRS:IMSI-001001000000019:TLLI-0xc0000013){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-19:STATE-ASSIGN:GPRS:IMSI-001001000000019:TLLI-0xc0000013) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000019:TLLI-0xc0000013:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000020'
 The MS object cannot fully confirm an unexpected TLLI: 0xc0000014, partly confirmed
 Modifying MS object, TLLI = 0xc0000014, MS class 0 -> 45
@@ -1312,7 +1353,7 @@
 TBF(DL:TFI-0-0-20:STATE-NEW:GPRS:IMSI-001001000000020:TLLI-0xc0000014) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-20:STATE-NEW:GPRS:IMSI-001001000000020:TLLI-0xc0000014) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000020:TLLI-0xc0000014:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-20:STATE-NEW:GPRS:IMSI-001001000000020:TLLI-0xc0000014)
-MS(IMSI-001001000000020:TLLI-0xc0000014:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000020:TLLI-0xc0000014:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-20:STATE-NEW:GPRS:IMSI-001001000000020:TLLI-0xc0000014) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-20:STATE-NEW:GPRS:IMSI-001001000000020:TLLI-0xc0000014) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000020)
 DL_TBF(DL:TFI-0-0-20:STATE-NEW:GPRS:IMSI-001001000000020:TLLI-0xc0000014){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -1320,7 +1361,9 @@
 DL_TBF(DL:TFI-0-0-20:STATE-NEW:GPRS:IMSI-001001000000020:TLLI-0xc0000014){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-20:STATE-ASSIGN:GPRS:IMSI-001001000000020:TLLI-0xc0000014) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000020:TLLI-0xc0000014:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000021'
 The MS object cannot fully confirm an unexpected TLLI: 0xc0000015, partly confirmed
 Modifying MS object, TLLI = 0xc0000015, MS class 0 -> 45
@@ -1343,7 +1386,7 @@
 TBF(DL:TFI-0-0-21:STATE-NEW:GPRS:IMSI-001001000000021:TLLI-0xc0000015) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-21:STATE-NEW:GPRS:IMSI-001001000000021:TLLI-0xc0000015) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000021:TLLI-0xc0000015:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-21:STATE-NEW:GPRS:IMSI-001001000000021:TLLI-0xc0000015)
-MS(IMSI-001001000000021:TLLI-0xc0000015:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000021:TLLI-0xc0000015:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-21:STATE-NEW:GPRS:IMSI-001001000000021:TLLI-0xc0000015) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-21:STATE-NEW:GPRS:IMSI-001001000000021:TLLI-0xc0000015) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000021)
 DL_TBF(DL:TFI-0-0-21:STATE-NEW:GPRS:IMSI-001001000000021:TLLI-0xc0000015){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -1351,7 +1394,9 @@
 DL_TBF(DL:TFI-0-0-21:STATE-NEW:GPRS:IMSI-001001000000021:TLLI-0xc0000015){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-21:STATE-ASSIGN:GPRS:IMSI-001001000000021:TLLI-0xc0000015) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000021:TLLI-0xc0000015:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000022'
 The MS object cannot fully confirm an unexpected TLLI: 0xc0000016, partly confirmed
 Modifying MS object, TLLI = 0xc0000016, MS class 0 -> 45
@@ -1374,7 +1419,7 @@
 TBF(DL:TFI-0-0-22:STATE-NEW:GPRS:IMSI-001001000000022:TLLI-0xc0000016) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-22:STATE-NEW:GPRS:IMSI-001001000000022:TLLI-0xc0000016) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000022:TLLI-0xc0000016:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-22:STATE-NEW:GPRS:IMSI-001001000000022:TLLI-0xc0000016)
-MS(IMSI-001001000000022:TLLI-0xc0000016:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000022:TLLI-0xc0000016:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-22:STATE-NEW:GPRS:IMSI-001001000000022:TLLI-0xc0000016) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-22:STATE-NEW:GPRS:IMSI-001001000000022:TLLI-0xc0000016) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000022)
 DL_TBF(DL:TFI-0-0-22:STATE-NEW:GPRS:IMSI-001001000000022:TLLI-0xc0000016){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -1382,7 +1427,9 @@
 DL_TBF(DL:TFI-0-0-22:STATE-NEW:GPRS:IMSI-001001000000022:TLLI-0xc0000016){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-22:STATE-ASSIGN:GPRS:IMSI-001001000000022:TLLI-0xc0000016) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000022:TLLI-0xc0000016:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000023'
 The MS object cannot fully confirm an unexpected TLLI: 0xc0000017, partly confirmed
 Modifying MS object, TLLI = 0xc0000017, MS class 0 -> 45
@@ -1405,7 +1452,7 @@
 TBF(DL:TFI-0-0-23:STATE-NEW:GPRS:IMSI-001001000000023:TLLI-0xc0000017) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-23:STATE-NEW:GPRS:IMSI-001001000000023:TLLI-0xc0000017) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000023:TLLI-0xc0000017:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-23:STATE-NEW:GPRS:IMSI-001001000000023:TLLI-0xc0000017)
-MS(IMSI-001001000000023:TLLI-0xc0000017:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000023:TLLI-0xc0000017:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-23:STATE-NEW:GPRS:IMSI-001001000000023:TLLI-0xc0000017) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-23:STATE-NEW:GPRS:IMSI-001001000000023:TLLI-0xc0000017) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000023)
 DL_TBF(DL:TFI-0-0-23:STATE-NEW:GPRS:IMSI-001001000000023:TLLI-0xc0000017){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -1413,7 +1460,9 @@
 DL_TBF(DL:TFI-0-0-23:STATE-NEW:GPRS:IMSI-001001000000023:TLLI-0xc0000017){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-23:STATE-ASSIGN:GPRS:IMSI-001001000000023:TLLI-0xc0000017) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000023:TLLI-0xc0000017:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000024'
 The MS object cannot fully confirm an unexpected TLLI: 0xc0000018, partly confirmed
 Modifying MS object, TLLI = 0xc0000018, MS class 0 -> 45
@@ -1436,7 +1485,7 @@
 TBF(DL:TFI-0-0-24:STATE-NEW:GPRS:IMSI-001001000000024:TLLI-0xc0000018) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-24:STATE-NEW:GPRS:IMSI-001001000000024:TLLI-0xc0000018) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000024:TLLI-0xc0000018:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-24:STATE-NEW:GPRS:IMSI-001001000000024:TLLI-0xc0000018)
-MS(IMSI-001001000000024:TLLI-0xc0000018:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000024:TLLI-0xc0000018:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-24:STATE-NEW:GPRS:IMSI-001001000000024:TLLI-0xc0000018) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-24:STATE-NEW:GPRS:IMSI-001001000000024:TLLI-0xc0000018) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000024)
 DL_TBF(DL:TFI-0-0-24:STATE-NEW:GPRS:IMSI-001001000000024:TLLI-0xc0000018){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -1444,7 +1493,9 @@
 DL_TBF(DL:TFI-0-0-24:STATE-NEW:GPRS:IMSI-001001000000024:TLLI-0xc0000018){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-24:STATE-ASSIGN:GPRS:IMSI-001001000000024:TLLI-0xc0000018) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000024:TLLI-0xc0000018:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000025'
 The MS object cannot fully confirm an unexpected TLLI: 0xc0000019, partly confirmed
 Modifying MS object, TLLI = 0xc0000019, MS class 0 -> 45
@@ -1467,7 +1518,7 @@
 TBF(DL:TFI-0-0-25:STATE-NEW:GPRS:IMSI-001001000000025:TLLI-0xc0000019) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-25:STATE-NEW:GPRS:IMSI-001001000000025:TLLI-0xc0000019) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000025:TLLI-0xc0000019:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-25:STATE-NEW:GPRS:IMSI-001001000000025:TLLI-0xc0000019)
-MS(IMSI-001001000000025:TLLI-0xc0000019:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000025:TLLI-0xc0000019:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-25:STATE-NEW:GPRS:IMSI-001001000000025:TLLI-0xc0000019) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-25:STATE-NEW:GPRS:IMSI-001001000000025:TLLI-0xc0000019) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000025)
 DL_TBF(DL:TFI-0-0-25:STATE-NEW:GPRS:IMSI-001001000000025:TLLI-0xc0000019){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -1475,7 +1526,9 @@
 DL_TBF(DL:TFI-0-0-25:STATE-NEW:GPRS:IMSI-001001000000025:TLLI-0xc0000019){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-25:STATE-ASSIGN:GPRS:IMSI-001001000000025:TLLI-0xc0000019) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000025:TLLI-0xc0000019:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000026'
 The MS object cannot fully confirm an unexpected TLLI: 0xc000001a, partly confirmed
 Modifying MS object, TLLI = 0xc000001a, MS class 0 -> 45
@@ -1498,7 +1551,7 @@
 TBF(DL:TFI-0-0-26:STATE-NEW:GPRS:IMSI-001001000000026:TLLI-0xc000001a) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-26:STATE-NEW:GPRS:IMSI-001001000000026:TLLI-0xc000001a) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000026:TLLI-0xc000001a:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-26:STATE-NEW:GPRS:IMSI-001001000000026:TLLI-0xc000001a)
-MS(IMSI-001001000000026:TLLI-0xc000001a:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000026:TLLI-0xc000001a:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-26:STATE-NEW:GPRS:IMSI-001001000000026:TLLI-0xc000001a) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-26:STATE-NEW:GPRS:IMSI-001001000000026:TLLI-0xc000001a) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000026)
 DL_TBF(DL:TFI-0-0-26:STATE-NEW:GPRS:IMSI-001001000000026:TLLI-0xc000001a){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -1506,7 +1559,9 @@
 DL_TBF(DL:TFI-0-0-26:STATE-NEW:GPRS:IMSI-001001000000026:TLLI-0xc000001a){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-26:STATE-ASSIGN:GPRS:IMSI-001001000000026:TLLI-0xc000001a) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000026:TLLI-0xc000001a:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000027'
 The MS object cannot fully confirm an unexpected TLLI: 0xc000001b, partly confirmed
 Modifying MS object, TLLI = 0xc000001b, MS class 0 -> 45
@@ -1529,7 +1584,7 @@
 TBF(DL:TFI-0-0-27:STATE-NEW:GPRS:IMSI-001001000000027:TLLI-0xc000001b) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-27:STATE-NEW:GPRS:IMSI-001001000000027:TLLI-0xc000001b) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000027:TLLI-0xc000001b:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-27:STATE-NEW:GPRS:IMSI-001001000000027:TLLI-0xc000001b)
-MS(IMSI-001001000000027:TLLI-0xc000001b:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000027:TLLI-0xc000001b:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-27:STATE-NEW:GPRS:IMSI-001001000000027:TLLI-0xc000001b) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-27:STATE-NEW:GPRS:IMSI-001001000000027:TLLI-0xc000001b) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000027)
 DL_TBF(DL:TFI-0-0-27:STATE-NEW:GPRS:IMSI-001001000000027:TLLI-0xc000001b){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -1537,7 +1592,9 @@
 DL_TBF(DL:TFI-0-0-27:STATE-NEW:GPRS:IMSI-001001000000027:TLLI-0xc000001b){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-27:STATE-ASSIGN:GPRS:IMSI-001001000000027:TLLI-0xc000001b) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000027:TLLI-0xc000001b:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000028'
 The MS object cannot fully confirm an unexpected TLLI: 0xc000001c, partly confirmed
 Modifying MS object, TLLI = 0xc000001c, MS class 0 -> 45
@@ -1560,7 +1617,7 @@
 TBF(DL:TFI-0-0-28:STATE-NEW:GPRS:IMSI-001001000000028:TLLI-0xc000001c) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-28:STATE-NEW:GPRS:IMSI-001001000000028:TLLI-0xc000001c) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000028:TLLI-0xc000001c:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-28:STATE-NEW:GPRS:IMSI-001001000000028:TLLI-0xc000001c)
-MS(IMSI-001001000000028:TLLI-0xc000001c:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000028:TLLI-0xc000001c:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-28:STATE-NEW:GPRS:IMSI-001001000000028:TLLI-0xc000001c) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-28:STATE-NEW:GPRS:IMSI-001001000000028:TLLI-0xc000001c) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000028)
 DL_TBF(DL:TFI-0-0-28:STATE-NEW:GPRS:IMSI-001001000000028:TLLI-0xc000001c){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -1568,7 +1625,9 @@
 DL_TBF(DL:TFI-0-0-28:STATE-NEW:GPRS:IMSI-001001000000028:TLLI-0xc000001c){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-28:STATE-ASSIGN:GPRS:IMSI-001001000000028:TLLI-0xc000001c) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000028:TLLI-0xc000001c:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000029'
 The MS object cannot fully confirm an unexpected TLLI: 0xc000001d, partly confirmed
 Modifying MS object, TLLI = 0xc000001d, MS class 0 -> 45
@@ -1591,7 +1650,7 @@
 TBF(DL:TFI-0-0-29:STATE-NEW:GPRS:IMSI-001001000000029:TLLI-0xc000001d) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-29:STATE-NEW:GPRS:IMSI-001001000000029:TLLI-0xc000001d) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000029:TLLI-0xc000001d:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-29:STATE-NEW:GPRS:IMSI-001001000000029:TLLI-0xc000001d)
-MS(IMSI-001001000000029:TLLI-0xc000001d:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000029:TLLI-0xc000001d:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-29:STATE-NEW:GPRS:IMSI-001001000000029:TLLI-0xc000001d) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-29:STATE-NEW:GPRS:IMSI-001001000000029:TLLI-0xc000001d) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000029)
 DL_TBF(DL:TFI-0-0-29:STATE-NEW:GPRS:IMSI-001001000000029:TLLI-0xc000001d){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -1599,7 +1658,9 @@
 DL_TBF(DL:TFI-0-0-29:STATE-NEW:GPRS:IMSI-001001000000029:TLLI-0xc000001d){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-29:STATE-ASSIGN:GPRS:IMSI-001001000000029:TLLI-0xc000001d) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000029:TLLI-0xc000001d:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000030'
 The MS object cannot fully confirm an unexpected TLLI: 0xc000001e, partly confirmed
 Modifying MS object, TLLI = 0xc000001e, MS class 0 -> 45
@@ -1622,7 +1683,7 @@
 TBF(DL:TFI-0-0-30:STATE-NEW:GPRS:IMSI-001001000000030:TLLI-0xc000001e) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-30:STATE-NEW:GPRS:IMSI-001001000000030:TLLI-0xc000001e) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000030:TLLI-0xc000001e:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-30:STATE-NEW:GPRS:IMSI-001001000000030:TLLI-0xc000001e)
-MS(IMSI-001001000000030:TLLI-0xc000001e:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000030:TLLI-0xc000001e:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-30:STATE-NEW:GPRS:IMSI-001001000000030:TLLI-0xc000001e) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-30:STATE-NEW:GPRS:IMSI-001001000000030:TLLI-0xc000001e) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000030)
 DL_TBF(DL:TFI-0-0-30:STATE-NEW:GPRS:IMSI-001001000000030:TLLI-0xc000001e){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -1630,7 +1691,9 @@
 DL_TBF(DL:TFI-0-0-30:STATE-NEW:GPRS:IMSI-001001000000030:TLLI-0xc000001e){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-30:STATE-ASSIGN:GPRS:IMSI-001001000000030:TLLI-0xc000001e) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000030:TLLI-0xc000001e:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000031'
 The MS object cannot fully confirm an unexpected TLLI: 0xc000001f, partly confirmed
 Modifying MS object, TLLI = 0xc000001f, MS class 0 -> 45
@@ -1653,7 +1716,7 @@
 TBF(DL:TFI-0-0-31:STATE-NEW:GPRS:IMSI-001001000000031:TLLI-0xc000001f) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-31:STATE-NEW:GPRS:IMSI-001001000000031:TLLI-0xc000001f) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000000031:TLLI-0xc000001f:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-31:STATE-NEW:GPRS:IMSI-001001000000031:TLLI-0xc000001f)
-MS(IMSI-001001000000031:TLLI-0xc000001f:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000031:TLLI-0xc000001f:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-31:STATE-NEW:GPRS:IMSI-001001000000031:TLLI-0xc000001f) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-31:STATE-NEW:GPRS:IMSI-001001000000031:TLLI-0xc000001f) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000031)
 DL_TBF(DL:TFI-0-0-31:STATE-NEW:GPRS:IMSI-001001000000031:TLLI-0xc000001f){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -1661,7 +1724,9 @@
 DL_TBF(DL:TFI-0-0-31:STATE-NEW:GPRS:IMSI-001001000000031:TLLI-0xc000001f){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-31:STATE-ASSIGN:GPRS:IMSI-001001000000031:TLLI-0xc000001f) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000000031:TLLI-0xc000001f:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000032'
 The MS object cannot fully confirm an unexpected TLLI: 0xc0000020, partly confirmed
 Modifying MS object, TLLI = 0xc0000020, MS class 0 -> 45
@@ -1678,8 +1743,9 @@
 UL_ASS_TBF{NONE}: Deallocated
 DL_ASS_TBF{NONE}: Deallocated
 MS(IMSI-001001000000032:TLLI-0xc0000020:TA-220:MSCLS-45-0) No PDCH resource
-=== end test_tbf_exhaustion ===
+MS(IMSI-001001000000032:TLLI-0xc0000020:TA-220:MSCLS-45-0): - dl_tbf_handle: now used by 0 (-)
 MS(IMSI-001001000000032:TLLI-0xc0000020:TA-220:MSCLS-45-0) Destroying MS object
+=== end test_tbf_exhaustion ===
 MS(IMSI-001001000000031:TLLI-0xc000001f:TA-220:MSCLS-45-0:DL) Destroying MS object
 MS(IMSI-001001000000031:TLLI-0xc000001f:TA-220:MSCLS-45-0:DL) Detaching TBF: TBF(DL:TFI-0-0-31:STATE-ASSIGN:GPRS:IMSI-001001000000031:TLLI-0xc000001f)
 MS(IMSI-001001000000031:TLLI-0xc000001f:TA-220:MSCLS-45-0): - tbf: now used by 0 (-)
@@ -1779,6 +1845,7 @@
 === start test_tbf_dl_llc_loss ===
 PDCH(bts=0,trx=0,ts=4) PDCH state: disabled => enabled
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000123456'
 The MS object cannot fully confirm an unexpected TLLI: 0xc0123456, partly confirmed
 Modifying MS object, TLLI = 0xc0123456, MS class 0 -> 45
@@ -1801,7 +1868,7 @@
 TBF(DL:TFI-0-0-0:STATE-NEW:GPRS:IMSI-001001000123456:TLLI-0xc0123456) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-0:STATE-NEW:GPRS:IMSI-001001000123456:TLLI-0xc0123456) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001000123456:TLLI-0xc0123456:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-0:STATE-NEW:GPRS:IMSI-001001000123456:TLLI-0xc0123456)
-MS(IMSI-001001000123456:TLLI-0xc0123456:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000123456:TLLI-0xc0123456:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-0:STATE-NEW:GPRS:IMSI-001001000123456:TLLI-0xc0123456) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-0:STATE-NEW:GPRS:IMSI-001001000123456:TLLI-0xc0123456) Send downlink assignment on PCH, no TBF exist (IMSI=001001000123456)
 DL_TBF(DL:TFI-0-0-0:STATE-NEW:GPRS:IMSI-001001000123456:TLLI-0xc0123456){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -1809,6 +1876,7 @@
 DL_TBF(DL:TFI-0-0-0:STATE-NEW:GPRS:IMSI-001001000123456:TLLI-0xc0123456){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-0:STATE-ASSIGN:GPRS:IMSI-001001000123456:TLLI-0xc0123456) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001000123456:TLLI-0xc0123456:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 Modifying MS object, TLLI = 0xc0123456, TA 220 -> 0
 MS(IMSI-001001000123456:TLLI-0xc0123456:TA-0:MSCLS-45-0:DL) appending 19 bytes to DL LLC queue
 TBF(DL:TFI-0-0-0:STATE-ASSIGN:GPRS:IMSI-001001000123456:TLLI-0xc0123456) free
@@ -1901,6 +1969,7 @@
 MS requests Uplink resource on CCCH/RACH: ra=0x03 (8 bit) Fn=2654167 qta=31
 MS requests single TS uplink transmission (one phase packet access)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + bts_rcv_rach: now used by 1 (bts_rcv_rach)
 MS(TA-220:MSCLS-0-0) ********** UL-TBF starts here **********
 MS(TA-220:MSCLS-0-0) Allocating UL TBF
 UL_ASS_TBF{NONE}: Allocated
@@ -1920,11 +1989,12 @@
 TBF(UL:TFI-0-0-0:STATE-NEW:GPRS) Setting Control TS PDCH(bts=0,trx=0,ts=7)
 TBF(UL:TFI-0-0-0:STATE-NEW:GPRS) Allocated: trx = 0, ul_slots = 80, dl_slots = 00
 MS(TA-220:MSCLS-0-0) Attaching UL TBF: TBF(UL:TFI-0-0-0:STATE-NEW:GPRS)
-MS(TA-220:MSCLS-0-0:UL): + tbf: now used by 1 (tbf)
+MS(TA-220:MSCLS-0-0:UL): + tbf: now used by 2 (bts_rcv_rach,tbf)
 UL_TBF(UL:TFI-0-0-0:STATE-NEW:GPRS){NEW}: Received Event ASSIGN_ADD_CCCH
 TBF(UL:TFI-0-0-0:STATE-NEW:GPRS) set ass. type CCCH [prev CCCH:0, PACCH:0]
 UL_TBF(UL:TFI-0-0-0:STATE-NEW:GPRS){NEW}: state_chg to FLOW
 TBF(UL:TFI-0-0-0:STATE-FLOW:GPRS) starting timer T3141 [Contention resolution (UL-TBF, CCCH)] with 10 sec. 0 microsec, cur_fn=2654167
+MS(TA-220:MSCLS-0-0:UL): - bts_rcv_rach: now used by 1 (tbf)
 Modifying MS object, TLLI = 0xffffffff, TA 220 -> 7
 Tx Immediate Assignment on AGCH: TRX=0 (ARFCN 0) TS=7 TA=7 TSC=0 TFI=0 USF=0
 PDCH(bts=0,trx=0,ts=7) Got CS-1 RLC block: R=0, SI=0, TFI=0, CPS=0, RSB=0, rc=184
@@ -1965,6 +2035,7 @@
 MS requests Uplink resource on CCCH/RACH: ra=0x03 (8 bit) Fn=2654167 qta=31
 MS requests single TS uplink transmission (one phase packet access)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + bts_rcv_rach: now used by 1 (bts_rcv_rach)
 MS(TA-220:MSCLS-0-0) ********** UL-TBF starts here **********
 MS(TA-220:MSCLS-0-0) Allocating UL TBF
 UL_ASS_TBF{NONE}: Allocated
@@ -1984,11 +2055,12 @@
 TBF(UL:TFI-0-0-0:STATE-NEW:GPRS) Setting Control TS PDCH(bts=0,trx=0,ts=7)
 TBF(UL:TFI-0-0-0:STATE-NEW:GPRS) Allocated: trx = 0, ul_slots = 80, dl_slots = 00
 MS(TA-220:MSCLS-0-0) Attaching UL TBF: TBF(UL:TFI-0-0-0:STATE-NEW:GPRS)
-MS(TA-220:MSCLS-0-0:UL): + tbf: now used by 1 (tbf)
+MS(TA-220:MSCLS-0-0:UL): + tbf: now used by 2 (bts_rcv_rach,tbf)
 UL_TBF(UL:TFI-0-0-0:STATE-NEW:GPRS){NEW}: Received Event ASSIGN_ADD_CCCH
 TBF(UL:TFI-0-0-0:STATE-NEW:GPRS) set ass. type CCCH [prev CCCH:0, PACCH:0]
 UL_TBF(UL:TFI-0-0-0:STATE-NEW:GPRS){NEW}: state_chg to FLOW
 TBF(UL:TFI-0-0-0:STATE-FLOW:GPRS) starting timer T3141 [Contention resolution (UL-TBF, CCCH)] with 10 sec. 0 microsec, cur_fn=2654167
+MS(TA-220:MSCLS-0-0:UL): - bts_rcv_rach: now used by 1 (tbf)
 Modifying MS object, TLLI = 0xffffffff, TA 220 -> 7
 Tx Immediate Assignment on AGCH: TRX=0 (ARFCN 0) TS=7 TA=7 TSC=0 TFI=0 USF=0
 PDCH(bts=0,trx=0,ts=7) Got CS-1 RLC block: R=0, SI=0, TFI=0, CPS=0, RSB=0, rc=184
@@ -2853,6 +2925,7 @@
 MS requests Uplink resource on CCCH/RACH: ra=0x03 (8 bit) Fn=2654275 qta=31
 MS requests single TS uplink transmission (one phase packet access)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + bts_rcv_rach: now used by 1 (bts_rcv_rach)
 MS(TA-220:MSCLS-0-0) ********** UL-TBF starts here **********
 MS(TA-220:MSCLS-0-0) Allocating UL TBF
 UL_ASS_TBF{NONE}: Allocated
@@ -2872,11 +2945,12 @@
 TBF(UL:TFI-0-0-0:STATE-NEW:GPRS) Setting Control TS PDCH(bts=0,trx=0,ts=7)
 TBF(UL:TFI-0-0-0:STATE-NEW:GPRS) Allocated: trx = 0, ul_slots = 80, dl_slots = 00
 MS(TA-220:MSCLS-0-0) Attaching UL TBF: TBF(UL:TFI-0-0-0:STATE-NEW:GPRS)
-MS(TA-220:MSCLS-0-0:UL): + tbf: now used by 1 (tbf)
+MS(TA-220:MSCLS-0-0:UL): + tbf: now used by 2 (bts_rcv_rach,tbf)
 UL_TBF(UL:TFI-0-0-0:STATE-NEW:GPRS){NEW}: Received Event ASSIGN_ADD_CCCH
 TBF(UL:TFI-0-0-0:STATE-NEW:GPRS) set ass. type CCCH [prev CCCH:0, PACCH:0]
 UL_TBF(UL:TFI-0-0-0:STATE-NEW:GPRS){NEW}: state_chg to FLOW
 TBF(UL:TFI-0-0-0:STATE-FLOW:GPRS) starting timer T3141 [Contention resolution (UL-TBF, CCCH)] with 10 sec. 0 microsec, cur_fn=2654275
+MS(TA-220:MSCLS-0-0:UL): - bts_rcv_rach: now used by 1 (tbf)
 Modifying MS object, TLLI = 0xffffffff, TA 220 -> 7
 Tx Immediate Assignment on AGCH: TRX=0 (ARFCN 0) TS=7 TA=7 TSC=0 TFI=0 USF=0
 PDCH(bts=0,trx=0,ts=7) Got CS-1 RLC block: R=0, SI=0, TFI=0, CPS=0, RSB=0, rc=184
@@ -4026,6 +4100,7 @@
 === start test_tbf_gprs_egprs ===
 PDCH(bts=0,trx=0,ts=4) PDCH state: disabled => enabled
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001123456789'
 The MS object cannot fully confirm an unexpected TLLI: 0xc0006789, partly confirmed
 Modifying MS object, TLLI = 0xc0006789, MS class 0 -> 45
@@ -4048,7 +4123,7 @@
 TBF(DL:TFI-0-0-0:STATE-NEW:GPRS:IMSI-001001123456789:TLLI-0xc0006789) Setting Control TS PDCH(bts=0,trx=0,ts=4)
 TBF(DL:TFI-0-0-0:STATE-NEW:GPRS:IMSI-001001123456789:TLLI-0xc0006789) Allocated: trx = 0, ul_slots = 10, dl_slots = 10
 MS(IMSI-001001123456789:TLLI-0xc0006789:TA-220:MSCLS-45-0) Attaching DL TBF: TBF(DL:TFI-0-0-0:STATE-NEW:GPRS:IMSI-001001123456789:TLLI-0xc0006789)
-MS(IMSI-001001123456789:TLLI-0xc0006789:TA-220:MSCLS-45-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001123456789:TLLI-0xc0006789:TA-220:MSCLS-45-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-0-0:STATE-NEW:GPRS:IMSI-001001123456789:TLLI-0xc0006789) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-0-0:STATE-NEW:GPRS:IMSI-001001123456789:TLLI-0xc0006789) Send downlink assignment on PCH, no TBF exist (IMSI=001001123456789)
 DL_TBF(DL:TFI-0-0-0:STATE-NEW:GPRS:IMSI-001001123456789:TLLI-0xc0006789){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -4056,6 +4131,7 @@
 DL_TBF(DL:TFI-0-0-0:STATE-NEW:GPRS:IMSI-001001123456789:TLLI-0xc0006789){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-0-0:STATE-ASSIGN:GPRS:IMSI-001001123456789:TLLI-0xc0006789) TX: START Immediate Assignment Downlink (PCH)
  - TRX=0 (0) TS=4 TA=220
+MS(IMSI-001001123456789:TLLI-0xc0006789:TA-220:MSCLS-45-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 === end test_tbf_gprs_egprs ===
 MS(IMSI-001001123456789:TLLI-0xc0006789:TA-220:MSCLS-45-0:DL) Destroying MS object
 MS(IMSI-001001123456789:TLLI-0xc0006789:TA-220:MSCLS-45-0:DL) Detaching TBF: TBF(DL:TFI-0-0-0:STATE-ASSIGN:GPRS:IMSI-001001123456789:TLLI-0xc0006789)
@@ -7713,6 +7789,7 @@
 MS requests Uplink resource on CCCH/RACH: ra=0x78 (8 bit) Fn=2654167 qta=31
 MS requests single TS uplink transmission (one phase packet access)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + bts_rcv_rach: now used by 1 (bts_rcv_rach)
 MS(TA-220:MSCLS-0-0) ********** UL-TBF starts here **********
 MS(TA-220:MSCLS-0-0) Allocating UL TBF
 UL_ASS_TBF{NONE}: Allocated
@@ -7732,16 +7809,18 @@
 TBF(UL:TFI-0-0-0:STATE-NEW:GPRS) Setting Control TS PDCH(bts=0,trx=0,ts=7)
 TBF(UL:TFI-0-0-0:STATE-NEW:GPRS) Allocated: trx = 0, ul_slots = 80, dl_slots = 00
 MS(TA-220:MSCLS-0-0) Attaching UL TBF: TBF(UL:TFI-0-0-0:STATE-NEW:GPRS)
-MS(TA-220:MSCLS-0-0:UL): + tbf: now used by 1 (tbf)
+MS(TA-220:MSCLS-0-0:UL): + tbf: now used by 2 (bts_rcv_rach,tbf)
 UL_TBF(UL:TFI-0-0-0:STATE-NEW:GPRS){NEW}: Received Event ASSIGN_ADD_CCCH
 TBF(UL:TFI-0-0-0:STATE-NEW:GPRS) set ass. type CCCH [prev CCCH:0, PACCH:0]
 UL_TBF(UL:TFI-0-0-0:STATE-NEW:GPRS){NEW}: state_chg to FLOW
 TBF(UL:TFI-0-0-0:STATE-FLOW:GPRS) starting timer T3141 [Contention resolution (UL-TBF, CCCH)] with 10 sec. 0 microsec, cur_fn=2654167
+MS(TA-220:MSCLS-0-0:UL): - bts_rcv_rach: now used by 1 (tbf)
 Modifying MS object, TLLI = 0xffffffff, TA 220 -> 7
 Tx Immediate Assignment on AGCH: TRX=0 (ARFCN 0) TS=7 TA=7 TSC=0 TFI=0 USF=0
 MS requests Uplink resource on CCCH/RACH: ra=0x79 (8 bit) Fn=2654167 qta=31
 MS requests single TS uplink transmission (one phase packet access)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + bts_rcv_rach: now used by 1 (bts_rcv_rach)
 MS(TA-220:MSCLS-0-0) ********** UL-TBF starts here **********
 MS(TA-220:MSCLS-0-0) Allocating UL TBF
 UL_ASS_TBF{NONE}: Allocated
@@ -7761,16 +7840,18 @@
 TBF(UL:TFI-0-0-1:STATE-NEW:GPRS) Setting Control TS PDCH(bts=0,trx=0,ts=7)
 TBF(UL:TFI-0-0-1:STATE-NEW:GPRS) Allocated: trx = 0, ul_slots = 80, dl_slots = 00
 MS(TA-220:MSCLS-0-0) Attaching UL TBF: TBF(UL:TFI-0-0-1:STATE-NEW:GPRS)
-MS(TA-220:MSCLS-0-0:UL): + tbf: now used by 1 (tbf)
+MS(TA-220:MSCLS-0-0:UL): + tbf: now used by 2 (bts_rcv_rach,tbf)
 UL_TBF(UL:TFI-0-0-1:STATE-NEW:GPRS){NEW}: Received Event ASSIGN_ADD_CCCH
 TBF(UL:TFI-0-0-1:STATE-NEW:GPRS) set ass. type CCCH [prev CCCH:0, PACCH:0]
 UL_TBF(UL:TFI-0-0-1:STATE-NEW:GPRS){NEW}: state_chg to FLOW
 TBF(UL:TFI-0-0-1:STATE-FLOW:GPRS) starting timer T3141 [Contention resolution (UL-TBF, CCCH)] with 10 sec. 0 microsec, cur_fn=2654167
+MS(TA-220:MSCLS-0-0:UL): - bts_rcv_rach: now used by 1 (tbf)
 Modifying MS object, TLLI = 0xffffffff, TA 220 -> 7
 Tx Immediate Assignment on AGCH: TRX=0 (ARFCN 0) TS=7 TA=7 TSC=0 TFI=1 USF=1
 MS requests Uplink resource on CCCH/RACH: ra=0x7a (8 bit) Fn=2654167 qta=31
 MS requests single TS uplink transmission (one phase packet access)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + bts_rcv_rach: now used by 1 (bts_rcv_rach)
 MS(TA-220:MSCLS-0-0) ********** UL-TBF starts here **********
 MS(TA-220:MSCLS-0-0) Allocating UL TBF
 UL_ASS_TBF{NONE}: Allocated
@@ -7790,16 +7871,18 @@
 TBF(UL:TFI-0-0-2:STATE-NEW:GPRS) Setting Control TS PDCH(bts=0,trx=0,ts=7)
 TBF(UL:TFI-0-0-2:STATE-NEW:GPRS) Allocated: trx = 0, ul_slots = 80, dl_slots = 00
 MS(TA-220:MSCLS-0-0) Attaching UL TBF: TBF(UL:TFI-0-0-2:STATE-NEW:GPRS)
-MS(TA-220:MSCLS-0-0:UL): + tbf: now used by 1 (tbf)
+MS(TA-220:MSCLS-0-0:UL): + tbf: now used by 2 (bts_rcv_rach,tbf)
 UL_TBF(UL:TFI-0-0-2:STATE-NEW:GPRS){NEW}: Received Event ASSIGN_ADD_CCCH
 TBF(UL:TFI-0-0-2:STATE-NEW:GPRS) set ass. type CCCH [prev CCCH:0, PACCH:0]
 UL_TBF(UL:TFI-0-0-2:STATE-NEW:GPRS){NEW}: state_chg to FLOW
 TBF(UL:TFI-0-0-2:STATE-FLOW:GPRS) starting timer T3141 [Contention resolution (UL-TBF, CCCH)] with 10 sec. 0 microsec, cur_fn=2654167
+MS(TA-220:MSCLS-0-0:UL): - bts_rcv_rach: now used by 1 (tbf)
 Modifying MS object, TLLI = 0xffffffff, TA 220 -> 7
 Tx Immediate Assignment on AGCH: TRX=0 (ARFCN 0) TS=7 TA=7 TSC=0 TFI=2 USF=2
 MS requests Uplink resource on CCCH/RACH: ra=0x7b (8 bit) Fn=2654167 qta=31
 MS requests single TS uplink transmission (one phase packet access)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + bts_rcv_rach: now used by 1 (bts_rcv_rach)
 MS(TA-220:MSCLS-0-0) ********** UL-TBF starts here **********
 MS(TA-220:MSCLS-0-0) Allocating UL TBF
 UL_ASS_TBF{NONE}: Allocated
@@ -7819,16 +7902,18 @@
 TBF(UL:TFI-0-0-3:STATE-NEW:GPRS) Setting Control TS PDCH(bts=0,trx=0,ts=7)
 TBF(UL:TFI-0-0-3:STATE-NEW:GPRS) Allocated: trx = 0, ul_slots = 80, dl_slots = 00
 MS(TA-220:MSCLS-0-0) Attaching UL TBF: TBF(UL:TFI-0-0-3:STATE-NEW:GPRS)
-MS(TA-220:MSCLS-0-0:UL): + tbf: now used by 1 (tbf)
+MS(TA-220:MSCLS-0-0:UL): + tbf: now used by 2 (bts_rcv_rach,tbf)
 UL_TBF(UL:TFI-0-0-3:STATE-NEW:GPRS){NEW}: Received Event ASSIGN_ADD_CCCH
 TBF(UL:TFI-0-0-3:STATE-NEW:GPRS) set ass. type CCCH [prev CCCH:0, PACCH:0]
 UL_TBF(UL:TFI-0-0-3:STATE-NEW:GPRS){NEW}: state_chg to FLOW
 TBF(UL:TFI-0-0-3:STATE-FLOW:GPRS) starting timer T3141 [Contention resolution (UL-TBF, CCCH)] with 10 sec. 0 microsec, cur_fn=2654167
+MS(TA-220:MSCLS-0-0:UL): - bts_rcv_rach: now used by 1 (tbf)
 Modifying MS object, TLLI = 0xffffffff, TA 220 -> 7
 Tx Immediate Assignment on AGCH: TRX=0 (ARFCN 0) TS=7 TA=7 TSC=0 TFI=3 USF=3
 MS requests Uplink resource on CCCH/RACH: ra=0x7c (8 bit) Fn=2654167 qta=31
 MS requests single TS uplink transmission (one phase packet access)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + bts_rcv_rach: now used by 1 (bts_rcv_rach)
 MS(TA-220:MSCLS-0-0) ********** UL-TBF starts here **********
 MS(TA-220:MSCLS-0-0) Allocating UL TBF
 UL_ASS_TBF{NONE}: Allocated
@@ -7848,16 +7933,18 @@
 TBF(UL:TFI-0-0-4:STATE-NEW:GPRS) Setting Control TS PDCH(bts=0,trx=0,ts=7)
 TBF(UL:TFI-0-0-4:STATE-NEW:GPRS) Allocated: trx = 0, ul_slots = 80, dl_slots = 00
 MS(TA-220:MSCLS-0-0) Attaching UL TBF: TBF(UL:TFI-0-0-4:STATE-NEW:GPRS)
-MS(TA-220:MSCLS-0-0:UL): + tbf: now used by 1 (tbf)
+MS(TA-220:MSCLS-0-0:UL): + tbf: now used by 2 (bts_rcv_rach,tbf)
 UL_TBF(UL:TFI-0-0-4:STATE-NEW:GPRS){NEW}: Received Event ASSIGN_ADD_CCCH
 TBF(UL:TFI-0-0-4:STATE-NEW:GPRS) set ass. type CCCH [prev CCCH:0, PACCH:0]
 UL_TBF(UL:TFI-0-0-4:STATE-NEW:GPRS){NEW}: state_chg to FLOW
 TBF(UL:TFI-0-0-4:STATE-FLOW:GPRS) starting timer T3141 [Contention resolution (UL-TBF, CCCH)] with 10 sec. 0 microsec, cur_fn=2654167
+MS(TA-220:MSCLS-0-0:UL): - bts_rcv_rach: now used by 1 (tbf)
 Modifying MS object, TLLI = 0xffffffff, TA 220 -> 7
 Tx Immediate Assignment on AGCH: TRX=0 (ARFCN 0) TS=7 TA=7 TSC=0 TFI=4 USF=4
 MS requests Uplink resource on CCCH/RACH: ra=0x7d (8 bit) Fn=2654167 qta=31
 MS requests single TS uplink transmission (one phase packet access)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + bts_rcv_rach: now used by 1 (bts_rcv_rach)
 MS(TA-220:MSCLS-0-0) ********** UL-TBF starts here **********
 MS(TA-220:MSCLS-0-0) Allocating UL TBF
 UL_ASS_TBF{NONE}: Allocated
@@ -7877,16 +7964,18 @@
 TBF(UL:TFI-0-0-5:STATE-NEW:GPRS) Setting Control TS PDCH(bts=0,trx=0,ts=7)
 TBF(UL:TFI-0-0-5:STATE-NEW:GPRS) Allocated: trx = 0, ul_slots = 80, dl_slots = 00
 MS(TA-220:MSCLS-0-0) Attaching UL TBF: TBF(UL:TFI-0-0-5:STATE-NEW:GPRS)
-MS(TA-220:MSCLS-0-0:UL): + tbf: now used by 1 (tbf)
+MS(TA-220:MSCLS-0-0:UL): + tbf: now used by 2 (bts_rcv_rach,tbf)
 UL_TBF(UL:TFI-0-0-5:STATE-NEW:GPRS){NEW}: Received Event ASSIGN_ADD_CCCH
 TBF(UL:TFI-0-0-5:STATE-NEW:GPRS) set ass. type CCCH [prev CCCH:0, PACCH:0]
 UL_TBF(UL:TFI-0-0-5:STATE-NEW:GPRS){NEW}: state_chg to FLOW
 TBF(UL:TFI-0-0-5:STATE-FLOW:GPRS) starting timer T3141 [Contention resolution (UL-TBF, CCCH)] with 10 sec. 0 microsec, cur_fn=2654167
+MS(TA-220:MSCLS-0-0:UL): - bts_rcv_rach: now used by 1 (tbf)
 Modifying MS object, TLLI = 0xffffffff, TA 220 -> 7
 Tx Immediate Assignment on AGCH: TRX=0 (ARFCN 0) TS=7 TA=7 TSC=0 TFI=5 USF=5
 MS requests Uplink resource on CCCH/RACH: ra=0x7e (8 bit) Fn=2654167 qta=31
 MS requests single TS uplink transmission (one phase packet access)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + bts_rcv_rach: now used by 1 (bts_rcv_rach)
 MS(TA-220:MSCLS-0-0) ********** UL-TBF starts here **********
 MS(TA-220:MSCLS-0-0) Allocating UL TBF
 UL_ASS_TBF{NONE}: Allocated
@@ -7906,16 +7995,18 @@
 TBF(UL:TFI-0-0-6:STATE-NEW:GPRS) Setting Control TS PDCH(bts=0,trx=0,ts=7)
 TBF(UL:TFI-0-0-6:STATE-NEW:GPRS) Allocated: trx = 0, ul_slots = 80, dl_slots = 00
 MS(TA-220:MSCLS-0-0) Attaching UL TBF: TBF(UL:TFI-0-0-6:STATE-NEW:GPRS)
-MS(TA-220:MSCLS-0-0:UL): + tbf: now used by 1 (tbf)
+MS(TA-220:MSCLS-0-0:UL): + tbf: now used by 2 (bts_rcv_rach,tbf)
 UL_TBF(UL:TFI-0-0-6:STATE-NEW:GPRS){NEW}: Received Event ASSIGN_ADD_CCCH
 TBF(UL:TFI-0-0-6:STATE-NEW:GPRS) set ass. type CCCH [prev CCCH:0, PACCH:0]
 UL_TBF(UL:TFI-0-0-6:STATE-NEW:GPRS){NEW}: state_chg to FLOW
 TBF(UL:TFI-0-0-6:STATE-FLOW:GPRS) starting timer T3141 [Contention resolution (UL-TBF, CCCH)] with 10 sec. 0 microsec, cur_fn=2654167
+MS(TA-220:MSCLS-0-0:UL): - bts_rcv_rach: now used by 1 (tbf)
 Modifying MS object, TLLI = 0xffffffff, TA 220 -> 7
 Tx Immediate Assignment on AGCH: TRX=0 (ARFCN 0) TS=7 TA=7 TSC=0 TFI=6 USF=6
 MS requests Uplink resource on CCCH/RACH: ra=0x7f (8 bit) Fn=2654167 qta=31
 MS requests single TS uplink transmission (one phase packet access)
 Creating MS object
+MS(TA-220:MSCLS-0-0): + bts_rcv_rach: now used by 1 (bts_rcv_rach)
 MS(TA-220:MSCLS-0-0) ********** UL-TBF starts here **********
 MS(TA-220:MSCLS-0-0) Allocating UL TBF
 UL_ASS_TBF{NONE}: Allocated
@@ -7938,8 +8029,9 @@
 UL_ASS_TBF{NONE}: Deallocated
 DL_ASS_TBF{NONE}: Deallocated
 No PDCH resource for Uplink TBF
-Tx Immediate Assignment Reject on AGCH
+MS(TA-220:MSCLS-0-0): - bts_rcv_rach: now used by 0 (-)
 MS(TA-220:MSCLS-0-0) Destroying MS object
+Tx Immediate Assignment Reject on AGCH
 MS(TA-7:MSCLS-0-0:UL) Destroying MS object
 MS(TA-7:MSCLS-0-0:UL) Detaching TBF: TBF(UL:TFI-0-0-6:STATE-FLOW:GPRS)
 MS(TA-7:MSCLS-0-0): - tbf: now used by 0 (-)
@@ -9861,6 +9953,7 @@
 PDCH(bts=0,trx=1,ts=5) PDCH state: disabled => enabled
 PDCH(bts=0,trx=1,ts=6) PDCH state: disabled => enabled
 Creating MS object
+MS(TA-220:MSCLS-0-0): + dl_tbf_handle: now used by 1 (dl_tbf_handle)
 Modifying MS object, TLLI = 0xffffffff, IMSI '' -> '001001000000001'
 The MS object cannot fully confirm an unexpected TLLI: 0xa3c2f953, partly confirmed
 Modifying MS object, TLLI = 0xa3c2f953, MS class 0 -> 11
@@ -9889,7 +9982,7 @@
 TBF(DL:TFI-0-1-0:STATE-NEW:GPRS:IMSI-001001000000001:TLLI-0xa3c2f953) Setting Control TS PDCH(bts=0,trx=1,ts=5)
 TBF(DL:TFI-0-1-0:STATE-NEW:GPRS:IMSI-001001000000001:TLLI-0xa3c2f953) Allocated: trx = 1, ul_slots = 20, dl_slots = 20
 MS(IMSI-001001000000001:TLLI-0xa3c2f953:TA-220:MSCLS-11-0) Attaching DL TBF: TBF(DL:TFI-0-1-0:STATE-NEW:GPRS:IMSI-001001000000001:TLLI-0xa3c2f953)
-MS(IMSI-001001000000001:TLLI-0xa3c2f953:TA-220:MSCLS-11-0:DL): + tbf: now used by 1 (tbf)
+MS(IMSI-001001000000001:TLLI-0xa3c2f953:TA-220:MSCLS-11-0:DL): + tbf: now used by 2 (dl_tbf_handle,tbf)
 TBF(DL:TFI-0-1-0:STATE-NEW:GPRS:IMSI-001001000000001:TLLI-0xa3c2f953) [DOWNLINK] START (PCH)
 TBF(DL:TFI-0-1-0:STATE-NEW:GPRS:IMSI-001001000000001:TLLI-0xa3c2f953) Send downlink assignment on PCH, no TBF exist (IMSI=001001000000001)
 DL_TBF(DL:TFI-0-1-0:STATE-NEW:GPRS:IMSI-001001000000001:TLLI-0xa3c2f953){NEW}: Received Event ASSIGN_ADD_CCCH
@@ -9897,6 +9990,7 @@
 DL_TBF(DL:TFI-0-1-0:STATE-NEW:GPRS:IMSI-001001000000001:TLLI-0xa3c2f953){NEW}: state_chg to ASSIGN
 TBF(DL:TFI-0-1-0:STATE-ASSIGN:GPRS:IMSI-001001000000001:TLLI-0xa3c2f953) TX: START Immediate Assignment Downlink (PCH)
  - TRX=1 (0) TS=5 TA=220
+MS(IMSI-001001000000001:TLLI-0xa3c2f953:TA-220:MSCLS-11-0:DL): - dl_tbf_handle: now used by 1 (tbf)
 PDCH(bts=0,trx=0,ts=1) PDCH state: disabled => enabled
 PDCH(bts=0,trx=0,ts=2) PDCH state: disabled => enabled
 PDCH(bts=0,trx=0,ts=3) PDCH state: disabled => enabled
diff --git a/tests/types/TypesTest.cpp b/tests/types/TypesTest.cpp
index 91b7ce4..44e4e28 100644
--- a/tests/types/TypesTest.cpp
+++ b/tests/types/TypesTest.cpp
@@ -688,7 +688,7 @@
 	the_pcu->alloc_algorithm = alloc_algorithm_a;
 	bts->trx[0].pdch[4].enable();
 
-	GprsMs *ms = ms_alloc(bts);
+	GprsMs *ms = ms_alloc(bts, NULL);
 	ms_set_ms_class(ms, 1);
 	ms_set_egprs_ms_class(ms, 1);
 	struct gprs_rlcmac_ul_tbf *tbf = ul_tbf_alloc(bts, ms, 0, true);
@@ -781,7 +781,7 @@
 	the_pcu->alloc_algorithm = alloc_algorithm_a;
 	bts->trx[0].pdch[2].enable();
 	bts->trx[0].pdch[3].enable();
-	GprsMs *ms = ms_alloc(bts);
+	GprsMs *ms = ms_alloc(bts, NULL);
 	ms_set_ms_class(ms, 1);
 
 	struct gprs_rlcmac_tbf *tbf = dl_tbf_alloc(bts, ms, 0, false);
@@ -808,7 +808,7 @@
 	bts->trx[0].pdch[4].enable();
 	bts->trx[0].pdch[5].enable();
 
-	GprsMs *ms = ms_alloc(bts);
+	GprsMs *ms = ms_alloc(bts, NULL);
 	ms_set_ms_class(ms, 1);
 	struct gprs_rlcmac_tbf *tbf = ul_tbf_alloc(bts, ms, 0, false);
 	static uint8_t res[] = { 0x06,
@@ -851,7 +851,7 @@
 	bts->trx[0].pdch[1].enable();
 	bts->trx[0].pdch[2].enable();
 
-	GprsMs *ms = ms_alloc(bts);
+	GprsMs *ms = ms_alloc(bts, NULL);
 	ms_set_ms_class(ms, 1);
 	ms_set_egprs_ms_class(ms, 1);
 	struct gprs_rlcmac_tbf *tbf = ul_tbf_alloc(bts, ms, 0, false);
diff --git a/tests/ulc/PdchUlcTest.cpp b/tests/ulc/PdchUlcTest.cpp
index b77f1d4..3756b9d 100644
--- a/tests/ulc/PdchUlcTest.cpp
+++ b/tests/ulc/PdchUlcTest.cpp
@@ -182,7 +182,7 @@
 	the_pcu->alloc_algorithm = _alloc_algorithm_dummy;
 
 	struct gprs_rlcmac_bts *bts = setup_new_bts();
-	struct GprsMs *ms = ms_alloc(bts);
+	struct GprsMs *ms = ms_alloc(bts, NULL);
 	ms_confirm_tlli(ms, 0x12345678);
 	struct gprs_rlcmac_tbf *tbf1 = dl_tbf_alloc(bts, ms, 0, true);
 	struct gprs_rlcmac_pdch *pdch = &tbf1->trx->pdch[0];