msc: f_call_hangup: add missing rx MNCC_REL_cnf

Add the missing rx of MNCC_REL_cnf to f_call_hangup for the MO case
(called with release_by_ms = false, see f_mo_call()).

This is in preparation for running f_mo_call several times in a row to
test multiple bearer services in a CSD test (follow up patch). Without
this patch, calling f_mo_call_establish() for the second time fails to
rx the MNCC_RTP_CREATE because the REL cnf is still in the port. This
leads to a timeout of X2 and OsmoMSC sending a CC RELEASE.

Adjust the log numbers next to f_call_hangup to re-use numbers 2 and 3
from above, as only one of the two code paths gets executed (similar to
numbers 5 and 6 below).

Related: OS#4394
Change-Id: Ia2ed7ce092e73e17c4243e83bfd239ead8266b49
diff --git a/msc/BSC_ConnectionHandler.ttcn b/msc/BSC_ConnectionHandler.ttcn
index 1359dc7..996f54a 100644
--- a/msc/BSC_ConnectionHandler.ttcn
+++ b/msc/BSC_ConnectionHandler.ttcn
@@ -1801,8 +1801,10 @@
 		/* A-side (PLMN) Release of call */
 		MNCC.send(ts_MNCC_REL_req(cpars.mncc_callref, valueof(ts_MNCC_cause(42))));
 		BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_CC_RELEASE(cpars.transaction_id)));
-		log("f_call_hangup 4: rx DTAP CC RELEASE");
+		log("f_call_hangup 2.a: rx DTAP CC RELEASE");
 		BSSAP.send(ts_PDU_DTAP_MO(ts_ML3_MO_CC_REL_COMPL(cpars.transaction_id)));
+		log("f_call_hangup 3.a: rx MNCC REL cnf");
+		MNCC.receive(tr_MNCC_REL_cnf(cpars.mncc_callref, cause := *));
 	}
 
 	respond_to_dlcx := not (isbound(cpars.mgw_drop_dlcx) and valueof(cpars.mgw_drop_dlcx));