diff --git a/msc/MSC_Tests.ttcn b/msc/MSC_Tests.ttcn
index ccfc154..cf91b1e 100644
--- a/msc/MSC_Tests.ttcn
+++ b/msc/MSC_Tests.ttcn
@@ -5896,6 +5896,44 @@
 	vc_conn.done;
 }
 
+/* Verify the case when T3212 expires during Paging procedure, just before the receipt
+ * of Paging Response. This used to provoke a NULL-pointer dereference in old versions
+ * of OsmoMSC, but apparently the bug has been fixed, and we're safe now. */
+friend function f_tc_lu_and_expire_while_paging(charstring id, BSC_ConnHdlrPars pars)
+runs on BSC_ConnHdlr {
+	var charstring imsi := hex2str(pars.imsi);
+
+	f_init_handler(pars);
+
+	/* Perform location update */
+	f_perform_lu();
+
+	f_ran_register_imsi(g_pars.imsi, g_pars.tmsi);
+	f_create_gsup_expect(hex2str(g_pars.imsi));
+
+	/* Initiate paging procedure from the VTY */
+	f_vty_transceive(MSCVTY, "subscriber imsi " & imsi & " paging");
+	f_expect_paging();
+
+	/* Emulate T3212 expiration during paging (we don't want to wait, right?) */
+	f_vty_transceive(MSCVTY, "subscriber imsi " & imsi & " expire");
+
+	/* MS sends PAGING RESPONSE, *old* OsmoMSC crashes here... */
+	f_establish_fully(EST_TYPE_PAG_RESP);
+
+	/* The recent OsmoMSC keeps subscriber in its VLR unless the Paging is completed.
+	 * In this case we do not send anything and just wait for a Clear Command. */
+	f_expect_clear();
+}
+testcase TC_lu_and_expire_while_paging() runs on MTC_CT {
+	var BSC_ConnHdlr vc_conn;
+
+	f_init();
+
+	vc_conn := f_start_handler(refers(f_tc_lu_and_expire_while_paging), 7);
+	vc_conn.done;
+}
+
 control {
 	execute( TC_cr_before_reset() );
 	execute( TC_lu_imsi_noauth_tmsi() );
@@ -6034,6 +6072,7 @@
 	}
 	execute( TC_invalid_mgcp_crash() );
 	execute( TC_mm_id_resp_no_identity() );
+	execute( TC_lu_and_expire_while_paging() );
 }
 
 
diff --git a/msc/MSC_Tests_Iu.ttcn b/msc/MSC_Tests_Iu.ttcn
index 72bbf03..febae09 100644
--- a/msc/MSC_Tests_Iu.ttcn
+++ b/msc/MSC_Tests_Iu.ttcn
@@ -523,6 +523,14 @@
 	vc_conn.done;
 }
 
+testcase TC_iu_lu_and_expire_while_paging() runs on MTC_CT {
+	var BSC_ConnHdlr vc_conn;
+	f_init(3);
+	vc_conn := f_start_handler(refers(f_tc_lu_and_expire_while_paging), 1055,
+				   ran_idx := 2, ran_is_geran := false);
+	vc_conn.done;
+}
+
 control {
 	execute( TC_iu_lu_imsi_reject() );
 	execute( TC_iu_lu_imsi_timeout_gsup() );
@@ -582,6 +590,7 @@
 	execute( TC_iu_multi_lu_and_mt_ussd() );
 
 	execute( TC_iu_lu_with_invalid_mcc_mnc() );
+	execute( TC_iu_lu_and_expire_while_paging() );
 
 	/* TODO: Iu + SGsAP related tests, e.g. paging on IuCS */
 
diff --git a/msc/expected-results.xml b/msc/expected-results.xml
index 68e2958..2d24d43 100644
--- a/msc/expected-results.xml
+++ b/msc/expected-results.xml
@@ -122,6 +122,7 @@
   <testcase classname='MSC_Tests' name='TC_lu_imsi_auth_tmsi_encr_3_1_log_msc_debug' time='MASKED'/>
   <testcase classname='MSC_Tests' name='TC_mo_cc_bssmap_clear' time='MASKED'/>
   <testcase classname='MSC_Tests' name='TC_lu_and_mt_call_osmux' time='MASKED'/>
+  <testcase classname='MSC_Tests' name='TC_lu_and_expire_while_paging' time='MASKED'/>
   <testcase classname='MSC_Tests_Iu' name='TC_iu_lu_imsi_reject' time='MASKED'>
     <failure type='fail-verdict'>Tguard timeout
       MSC_Tests_Iu.ttcn:MASKED MSC_Tests_Iu control part
@@ -219,5 +220,6 @@
   <testcase classname='MSC_Tests_Iu' name='TC_iu_multi_lu_and_mo_ussd' time='MASKED'/>
   <testcase classname='MSC_Tests_Iu' name='TC_iu_multi_lu_and_mt_ussd' time='MASKED'/>
   <testcase classname='MSC_Tests_Iu' name='TC_iu_lu_with_invalid_mcc_mnc' time='MASKED'/>
+  <testcase classname='MSC_Tests_Iu' name='TC_iu_lu_and_expire_while_paging' time='MASKED'/>
   <testcase classname='MSC_Tests_Iu' name='TC_mo_cc_iu_release' time='MASKED'/>
 </testsuite>