diff --git a/bsc/BSC_Tests.ttcn b/bsc/BSC_Tests.ttcn
index 1b37f78..fb9fa68 100644
--- a/bsc/BSC_Tests.ttcn
+++ b/bsc/BSC_Tests.ttcn
@@ -4156,8 +4156,10 @@
 }
 
 /* execute a "bts <0-255> trx <0-255> timeslot <0-7> sub-slot <0-7>" command on given Dchan */
-private function f_vty_ss_action(charstring suffix, integer bts_nr, integer trx_nr, RslChannelNr chan_nr)
-runs on MSC_ConnHdlr {
+private function f_vty_ss_action(TELNETasp_PT pt, charstring suffix,
+				 uint8_t bts_nr, uint8_t trx_nr,
+				 in RslChannelNr chan_nr)
+{
 	/* FIXME: resolve those from component-global state */
 	var integer ts_nr := chan_nr.tn;
 	var integer ss_nr;
@@ -4176,7 +4178,7 @@
 
 	var charstring cmd := "bts "&int2str(bts_nr)&" trx "&int2str(trx_nr)&
 				" timeslot "&int2str(ts_nr)&" sub-slot "&int2str(ss_nr)&" ";
-	f_vty_transceive(BSCVTY, cmd & suffix);
+	f_vty_transceive(pt, cmd & suffix);
 }
 
 /* Even though the VTY command to trigger handover takes a new BTS number as argument, behind the scenes osmo-bsc always
@@ -4184,10 +4186,10 @@
  * ident key (ARFCN + BSIC) in the struct passed on to handover_request(). handover_start() then resolves that to a
  * viable actual neighbor cell. So from the internal osmo-bsc perspective, we always request handover to an ARFCN + BSIC
  * pair, not really to a specific BTS number. */
-private function f_vty_handover(integer bts_nr, integer trx_nr, RslChannelNr chan_nr,
-				integer new_bts_nr)
-runs on MSC_ConnHdlr {
-	f_vty_ss_action("handover " & int2str(new_bts_nr), bts_nr, trx_nr, chan_nr);
+private function f_vty_handover(TELNETasp_PT pt, uint8_t bts_nr, uint8_t trx_nr,
+				in RslChannelNr chan_nr, uint8_t new_bts_nr)
+{
+	f_vty_ss_action(pt, "handover " & int2str(new_bts_nr), bts_nr, trx_nr, chan_nr);
 }
 
 /* intra-BSC hand-over between BTS0 and BTS1 */
@@ -4209,7 +4211,7 @@
 		old_chan_nr := -
 	};
 	/* issue hand-over command on VTY */
-	f_vty_handover(0, 0, g_chan_nr, 1);
+	f_vty_handover(BSCVTY, 0, 0, g_chan_nr, 1);
 	/* temporarily suspend DChan processing on BTS1 to avoid race with RSLEM_register */
 	f_rslem_suspend(RSL1_PROC);