diff --git a/msc/MSC_Tests.ttcn b/msc/MSC_Tests.ttcn
index 1427fd0..4a6b822 100644
--- a/msc/MSC_Tests.ttcn
+++ b/msc/MSC_Tests.ttcn
@@ -1155,7 +1155,11 @@
 private function f_tc_cl3_rnd_payload(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr {
 	f_init_handler(pars);
 
-	var integer len := float2int(rnd() * 256.0);
+	/* length is limited by PDU_BSSAP length field which includes some
+	 * other fields beside l3info payload. So payl can only be 240 bytes
+	 * Since rnd() returns values < 1 multiply with 241
+	 */
+	var integer len := float2int(rnd() * 241.0);
 	var octetstring payl := f_rnd_octstring(len);
 
 	/* Send Complete L3 Info with empty L3 frame */