diff --git a/openbsc/include/openbsc/gsm_04_08.h b/openbsc/include/openbsc/gsm_04_08.h
index 01afe05..b867155 100644
--- a/openbsc/include/openbsc/gsm_04_08.h
+++ b/openbsc/include/openbsc/gsm_04_08.h
@@ -769,8 +769,8 @@
 int gsm48_send_rr_app_info(struct gsm_lchan *lchan, u_int8_t apdu_id,
 			   u_int8_t apdu_len, const u_int8_t *apdu);
 int gsm48_send_rr_ass_cmd(struct gsm_lchan *lchan, u_int8_t power_class);
-int gsm48_send_ho_cmd(struct gsm_lchan *old_lchan,
-		      struct gsm_lchan *new_lchan, u_int8_t power_command);
+int gsm48_send_ho_cmd(struct gsm_lchan *old_lchan, struct gsm_lchan *new_lchan,
+		      u_int8_t power_command, u_int8_t ho_ref);
 
 int bsc_upqueue(struct gsm_network *net);
 
diff --git a/openbsc/src/gsm_04_08_utils.c b/openbsc/src/gsm_04_08_utils.c
index 8497fa8..e96a1ca 100644
--- a/openbsc/src/gsm_04_08_utils.c
+++ b/openbsc/src/gsm_04_08_utils.c
@@ -541,21 +541,22 @@
 }
 
 /* Chapter 9.1.15: Handover Command */
-int gsm48_send_ho_cmd(struct gsm_lchan *old_lchan,
-		      struct gsm_lchan *new_lchan, u_int8_t power_command)
+int gsm48_send_ho_cmd(struct gsm_lchan *old_lchan, struct gsm_lchan *new_lchan,
+		      u_int8_t power_command, u_int8_t ho_ref)
 {
 	struct msgb *msg = gsm48_msgb_alloc();
 	struct gsm48_hdr *gh = (struct gsm48_hdr *) msgb_put(msg, sizeof(*gh));
 	struct gsm48_ho_cmd *ho =
 		(struct gsm48_ho_cmd *) msgb_put(msg, sizeof(*ho));
-	static u_int8_t ho_ref;
 
 	msg->lchan = old_lchan;
+	gh->proto_discr = GSM48_PDISC_RR;
+	gh->msg_type = GSM48_MT_RR_HANDO_CMD;
 
 	/* mandatory bits */
 	gsm48_cell_desc(&ho->cell_desc, new_lchan->ts->trx->bts);
 	gsm48_chan_desc(&ho->chan_desc, new_lchan);
-	ho->ho_ref = ho_ref++;
+	ho->ho_ref = ho_ref;
 	ho->power_command = power_command;
 
 	/* FIXME: optional bits for type of synchronization? */