diff --git a/src/bts.cpp b/src/bts.cpp
index 84eea08..3b27676 100644
--- a/src/bts.cpp
+++ b/src/bts.cpp
@@ -244,7 +244,6 @@
 	while ((ms = llist_first_entry_or_null(&bts->ms_list, struct GprsMs, list))) {
 		ms_set_callback(ms, NULL);
 		ms_set_timeout(ms, 0);
-		llist_del(&ms->list);
 		bts_stat_item_dec(bts, STAT_MS_PRESENT);
 		talloc_free(ms);
 	}
@@ -1201,7 +1200,6 @@
 
 static void bts_ms_idle_cb(struct GprsMs *ms)
 {
-	llist_del(&ms->list);
 	bts_stat_item_dec(ms->bts, STAT_MS_PRESENT);
 	if (ms_is_idle(ms))
 		talloc_free(ms);
@@ -1225,7 +1223,6 @@
 
 	ms_set_callback(ms, &bts_ms_cb);
 	ms_set_timeout(ms, osmo_tdef_get(bts->pcu->T_defs, -2030, OSMO_TDEF_S, -1));
-	llist_add(&ms->list, &bts->ms_list);
 
 	bts_stat_item_inc(bts, STAT_MS_PRESENT);
 	return ms;
diff --git a/src/gprs_ms.c b/src/gprs_ms.c
index 7ee697e..3e95103 100644
--- a/src/gprs_ms.c
+++ b/src/gprs_ms.c
@@ -110,6 +110,8 @@
 
 	talloc_set_destructor(ms, ms_talloc_destructor);
 
+	llist_add(&ms->list, &bts->ms_list);
+
 	ms->bts = bts;
 	ms->cb = gprs_default_cb;
 	ms->tlli = GSM_RESERVED_TMSI;
@@ -119,7 +121,6 @@
 	ms->current_cs_ul = UNKNOWN;
 	ms->current_cs_dl = UNKNOWN;
 	ms->is_idle = true;
-	INIT_LLIST_HEAD(&ms->list);
 	INIT_LLIST_HEAD(&ms->old_tbfs);
 
 	int codel_interval = LLC_CODEL_USE_DEFAULT;
@@ -158,6 +159,8 @@
 
 	LOGPMS(ms, DRLCMAC, LOGL_INFO, "Destroying MS object\n");
 
+	llist_del(&ms->list);
+
 	ms_set_reserved_slots(ms, NULL, 0, 0);
 
 	osmo_timer_del(&ms->timer);