diff --git a/bsc/BSC_Tests.ttcn b/bsc/BSC_Tests.ttcn
index aebb64c..106f8b4 100644
--- a/bsc/BSC_Tests.ttcn
+++ b/bsc/BSC_Tests.ttcn
@@ -115,8 +115,6 @@
 private const RSL_IE_Body c_mr_conf_5_90 :=
 	valueof(RSL_IE_Body:{multirate_cfg := ts_RSL_MultirateCfg(true, 0, '00000100'B /* 5,90k */)});
 
-friend const octetstring c_l3_payload := '00010203040506'O;
-
 /* per-BTS state which we keep */
 type record BTS_State {
 	/* component reference to the IPA_Client component used for RSL */
@@ -609,6 +607,15 @@
 	}
 }
 
+friend function gen_l3_valid_payload(hexstring imsi := ''H) return octetstring {
+	var octetstring l3_payload;
+	if (lengthof(imsi) == 0) {
+		imsi := f_rnd_imsi('00101'H);
+	}
+	l3_payload := enc_PDU_ML3_MS_NW(valueof(ts_LU_REQ(LU_Type_IMSI_Attach, ts_MI_LV(ts_MI_IMSI(imsi)))));
+	return l3_payload;
+}
+
 type component test_CT extends CTRL_Adapter_CT {
 	/* Array of per-BTS/TRX state */
 	var BTS_State bts[NUM_BTS][NUM_TRX];
@@ -1517,15 +1524,16 @@
 	var IpaStreamId sid := IPAC_PROTO_RSL_TRX0;
 	var RSL_Message rx_rsl;
 	var ASP_RSL_Unitdata rx_rsl_ud;
+	var octetstring l3_payload := gen_l3_valid_payload();
 
 	f_init(1);
 
 	/* Send CHAN RQD and wait for allocation; acknowledge it */
 	var RslChannelNr chan_nr := f_chreq_act_ack();
 
-	f_ipa_tx(ts_RSL_EST_IND(chan_nr, valueof(ts_RslLinkID_DCCH(0)), c_l3_payload));
+	f_ipa_tx(ts_RSL_EST_IND(chan_nr, valueof(ts_RslLinkID_DCCH(0)), l3_payload));
 
-	BSSAP.receive(tr_BSSAP_CONNECT_ind(?, ?, tr_BSSMAP_ComplL3(c_l3_payload)));
+	BSSAP.receive(tr_BSSAP_CONNECT_ind(?, ?, tr_BSSMAP_ComplL3(l3_payload)));
 
 	/* expect BSC to disable the channel again if there's no response from MSC */
 	/* MS waits 20s (T3210) at LU; 10s (T3230) at CM SERV REQ and 5s (T3220) AT detach */
@@ -1537,15 +1545,16 @@
 testcase TC_chan_act_ack_est_ind_refused() runs on test_CT {
 	var BSSAP_N_CONNECT_ind rx_c_ind;
 	var RSL_Message rx_rsl;
+	var octetstring l3_payload := gen_l3_valid_payload();
 
 	f_init(1);
 
 	/* Send CHAN RQD and wait for allocation; acknowledge it */
 	var RslChannelNr chan_nr := f_chreq_act_ack();
 
-	f_ipa_tx(ts_RSL_EST_IND(chan_nr, valueof(ts_RslLinkID_DCCH(0)), c_l3_payload));
+	f_ipa_tx(ts_RSL_EST_IND(chan_nr, valueof(ts_RslLinkID_DCCH(0)), l3_payload));
 
-	BSSAP.receive(tr_BSSAP_CONNECT_ind(?, ?, tr_BSSMAP_ComplL3(c_l3_payload))) -> value rx_c_ind;
+	BSSAP.receive(tr_BSSAP_CONNECT_ind(?, ?, tr_BSSMAP_ComplL3(l3_payload))) -> value rx_c_ind;
 	BSSAP.send(ts_BSSAP_DISC_req(rx_c_ind.connectionId, 0));
 
 	/* expect BSC to disable the channel */
@@ -1680,7 +1689,7 @@
 
 	f_init(1);
 
-	dt := f_est_dchan('23'O, 23, c_l3_payload);
+	dt := f_est_dchan('23'O, 23, gen_l3_valid_payload());
 	if (mp_bssap_cfg[bssap_idx].transport == BSSAP_TRANSPORT_AoIP) {
 		/* send assignment without AoIP IEs */
 		BSSAP.send(ts_BSSAP_DATA_req(dt.sccp_conn_id, ts_BSSMAP_AssignmentReq(ts_BSSMAP_IE_CIC(0, 1))));
@@ -1806,7 +1815,7 @@
 
 	f_init(1);
 
-	dt := f_est_dchan('23'O, 23, c_l3_payload);
+	dt := f_est_dchan('23'O, 23, gen_l3_valid_payload());
 	/* send assignment without AoIP IEs */
 	BSSAP.send(ts_BSSAP_DATA_req(dt.sccp_conn_id, ass_cmd));
 	alt {
@@ -1946,7 +1955,7 @@
 
 	f_init(1);
 
-	dt := f_est_dchan('23'O, 23, c_l3_payload);
+	dt := f_est_dchan('23'O, 23, gen_l3_valid_payload());
 
 	/* simulate RLL REL IND */
 	f_ipa_tx(ts_RSL_REL_IND(dt.rsl_chan_nr, valueof(ts_RslLinkID_DCCH(0))));
@@ -1974,7 +1983,7 @@
 
 	f_init(1);
 
-	dt := f_est_dchan('23'O, 23, c_l3_payload);
+	dt := f_est_dchan('23'O, 23, gen_l3_valid_payload());
 
 	/* Sending CONN FAIL IND immediately may trigger a race condition.
 	 * Give the BSC some time to process a new SCCP connection (OS#5823). */
@@ -2031,7 +2040,7 @@
 
 	f_init(1);
 
-	dt := f_est_dchan('23'O, 23, c_l3_payload);
+	dt := f_est_dchan('23'O, 23, gen_l3_valid_payload());
 
 	/* BSC<-MSC: Instruct BSC to clear connection */
 	BSSAP.send(ts_BSSAP_DATA_req(dt.sccp_conn_id, ts_BSSMAP_ClearCommand(0)));
@@ -2198,7 +2207,7 @@
 
 	f_init(1);
 
-	dt := f_est_dchan('23'O, 23, c_l3_payload);
+	dt := f_est_dchan('23'O, 23, gen_l3_valid_payload());
 
 	/* Instruct BSC to clear channel */
 	var BssmapCause cause := 0;
@@ -2220,7 +2229,7 @@
 
 	f_init(1);
 
-	dt := f_est_dchan('23'O, 23, c_l3_payload);
+	dt := f_est_dchan('23'O, 23, gen_l3_valid_payload());
 	/* Send CommonID with some random PLMN (BSC doesn't take it into account
 	/* yet when generating the EUTRAN neigh list in RR CHannel Release) */
 	BSSAP.send(ts_BSSAP_DATA_req(dt.sccp_conn_id, ts_BSSMAP_CommonId('001019876543210'H, '323454'O)));
@@ -2276,7 +2285,7 @@
 
 	f_init(1);
 
-	dt := f_est_dchan('23'O, 23, c_l3_payload);
+	dt := f_est_dchan('23'O, 23, gen_l3_valid_payload());
 
 	/* Instruct BSC to clear channel */
 	var BssmapCause cause := 0;
@@ -2298,7 +2307,7 @@
 
 	f_init(1);
 
-	dt := f_est_dchan('23'O, 23, c_l3_payload);
+	dt := f_est_dchan('23'O, 23, gen_l3_valid_payload());
 
 	/* release the SCCP connection */
 	BSSAP.send(ts_BSSAP_DISC_req(dt.sccp_conn_id, 0));
@@ -2313,7 +2322,7 @@
 
 	f_init(1);
 
-	dt := f_est_dchan('23'O, 23, c_l3_payload);
+	dt := f_est_dchan('23'O, 23, gen_l3_valid_payload());
 
 	/* release the SCCP connection */
 	BSSAP.send(ts_BSSAP_DISC_req(dt.sccp_conn_id, 0));
@@ -2328,7 +2337,7 @@
 
 	f_init(1);
 
-	dt := f_est_dchan('23'O, 23, c_l3_payload);
+	dt := f_est_dchan('23'O, 23, gen_l3_valid_payload());
 
 	/* Clear the queue, it might still contain stuff like IMMEDIATE ASSIGN */
 	IPA_RSL[0][0].clear;
@@ -2356,7 +2365,7 @@
 
 	f_init(1);
 
-	dt := f_est_dchan('23'O, 23, c_l3_payload);
+	dt := f_est_dchan('23'O, 23, gen_l3_valid_payload());
 	f_expect_chan_rel(dt.rsl_chan_nr, expect_rll_rel_req := false);
 	f_shutdown_helper();
 }
@@ -2367,7 +2376,7 @@
 {
 	var DchanTuple dt;
 
-	dt := f_est_dchan('23'O, 23, c_l3_payload);
+	dt := f_est_dchan('23'O, 23, gen_l3_valid_payload());
 	var BssmapCause cause := 0;
 	BSSAP.send(ts_BSSAP_DATA_req(dt.sccp_conn_id, ts_BSSMAP_ClearCommand(enum2int(clear_cmd_cause))));
 	BSSAP.receive(tr_BSSAP_DATA_ind(dt.sccp_conn_id, tr_BSSMAP_ClearComplete)) {
@@ -2398,11 +2407,12 @@
 	f_init(1);
 
 	var RslChannelNr chan_nr := valueof(t_RslChanNr_Bm(6));
-	f_ipa_tx(ts_RSL_EST_IND(chan_nr, valueof(ts_RslLinkID_DCCH(0)), c_l3_payload));
+	var octetstring l3_payload := gen_l3_valid_payload();
+	f_ipa_tx(ts_RSL_EST_IND(chan_nr, valueof(ts_RslLinkID_DCCH(0)), l3_payload));
 
 	T.start;
 	alt {
-	[] BSSAP.receive(tr_BSSAP_CONNECT_ind(?, ?, tr_BSSMAP_ComplL3(c_l3_payload))) {
+	[] BSSAP.receive(tr_BSSAP_CONNECT_ind(?, ?, tr_BSSMAP_ComplL3(l3_payload))) {
 		setverdict(fail, "MSC received COMPL L3 for non-active lchan");
 		}
 	[] BSSAP.receive {}
@@ -2416,17 +2426,19 @@
 /* Test behavior if RSL EST IND for invalid SAPI */
 testcase TC_rll_est_ind_inval_sapi1() runs on test_CT {
 	var RslChannelNr chan_nr;
+	var octetstring l3_payload;
 
 	f_init(1);
 
-	chan_nr := f_chreq_act_ack()
+	chan_nr := f_chreq_act_ack();
+	l3_payload := gen_l3_valid_payload();
 
-	f_ipa_tx(ts_RSL_EST_IND(chan_nr, valueof(ts_RslLinkID_DCCH(1)), c_l3_payload));
+	f_ipa_tx(ts_RSL_EST_IND(chan_nr, valueof(ts_RslLinkID_DCCH(1)), l3_payload));
 
 	timer T := 2.0;
 	T.start;
 	alt {
-	[] BSSAP.receive(tr_BSSAP_CONNECT_ind(?, ?, tr_BSSMAP_ComplL3(c_l3_payload))) {
+	[] BSSAP.receive(tr_BSSAP_CONNECT_ind(?, ?, tr_BSSMAP_ComplL3(l3_payload))) {
 		setverdict(fail, "MSC received COMPL L3 for invalid SAPI 1");
 		}
 	[] BSSAP.receive { repeat; }
@@ -2444,12 +2456,13 @@
 	f_init(1);
 
 	var RslChannelNr chan_nr := f_chreq_act_ack();
+	var octetstring l3_payload := gen_l3_valid_payload();
 
-	f_ipa_tx(ts_RSL_EST_IND(chan_nr, valueof(ts_RslLinkID_DCCH(3)), c_l3_payload));
+	f_ipa_tx(ts_RSL_EST_IND(chan_nr, valueof(ts_RslLinkID_DCCH(3)), l3_payload));
 
 	T.start;
 	alt {
-	[] BSSAP.receive(tr_BSSAP_CONNECT_ind(?, ?, tr_BSSMAP_ComplL3(c_l3_payload))) {
+	[] BSSAP.receive(tr_BSSAP_CONNECT_ind(?, ?, tr_BSSMAP_ComplL3(l3_payload))) {
 		setverdict(fail, "MSC received COMPL L3 for invalid SAPI 3");
 		}
 	[] BSSAP.receive { repeat; }
@@ -2467,12 +2480,13 @@
 	f_init(1);
 
 	var RslChannelNr chan_nr := f_chreq_act_ack();
+	var octetstring l3_payload := gen_l3_valid_payload();
 
-	f_ipa_tx(ts_RSL_EST_IND(chan_nr, valueof(ts_RslLinkID_SACCH(0)), c_l3_payload));
+	f_ipa_tx(ts_RSL_EST_IND(chan_nr, valueof(ts_RslLinkID_SACCH(0)), l3_payload));
 
 	T.start;
 	alt {
-	[] BSSAP.receive(tr_BSSAP_CONNECT_ind(?, ?, tr_BSSMAP_ComplL3(c_l3_payload))) {
+	[] BSSAP.receive(tr_BSSAP_CONNECT_ind(?, ?, tr_BSSMAP_ComplL3(l3_payload))) {
 		setverdict(fail, "MSC received COMPL L3 for invalid Link SACCH");
 		}
 	[] BSSAP.receive { repeat; }
@@ -2587,10 +2601,10 @@
 	f_init(1);
 
 	/* MS establishes a SAPI=0 link on DCCH */
-	dt := f_est_dchan(f_rnd_ra_cs(), 23, c_l3_payload);
+	dt := f_est_dchan(f_rnd_ra_cs(), 23, gen_l3_valid_payload());
 
 	/* MSC sends some data on (not yet established) SAPI=3 link */
-	BSSAP.send(ts_BSSAP_DATA_req(dt.sccp_conn_id, ts_BSSAP_DTAP(c_l3_payload, '03'O)));
+	BSSAP.send(ts_BSSAP_DATA_req(dt.sccp_conn_id, ts_BSSAP_DTAP(gen_l3_valid_payload(), '03'O)));
 	/* BSC attempts to establish a SAPI=3 link on DCCH */
 	rx_rsl := f_exp_ipa_rx(tr_RSL_EST_REQ(dt.rsl_chan_nr, tr_RslLinkID_DCCH(3)));
 
@@ -2614,10 +2628,10 @@
 	f_init(1);
 
 	/* MS establishes a SAPI=0 link on DCCH */
-	dt := f_est_dchan(f_rnd_ra_cs(), 23, c_l3_payload);
+	dt := f_est_dchan(f_rnd_ra_cs(), 23, gen_l3_valid_payload());
 
 	/* MSC sends some data on (not yet established) SAPI=3 link */
-	BSSAP.send(ts_BSSAP_DATA_req(dt.sccp_conn_id, ts_BSSAP_DTAP(c_l3_payload, '03'O)));
+	BSSAP.send(ts_BSSAP_DATA_req(dt.sccp_conn_id, ts_BSSAP_DTAP(gen_l3_valid_payload(), '03'O)));
 	/* BSC attempts to establish a SAPI=3 link on DCCH */
 	rx_rsl := f_exp_ipa_rx(tr_RSL_EST_REQ(dt.rsl_chan_nr, tr_RslLinkID_DCCH(3)));
 
@@ -2641,10 +2655,10 @@
 	f_init(1);
 
 	/* MS establishes a SAPI=0 link on DCCH */
-	dt := f_est_dchan(f_rnd_ra_cs(), 23, c_l3_payload);
+	dt := f_est_dchan(f_rnd_ra_cs(), 23, gen_l3_valid_payload());
 
 	/* MSC sends some data on (not yet established) SAPI=3 link */
-	BSSAP.send(ts_BSSAP_DATA_req(dt.sccp_conn_id, ts_BSSAP_DTAP(c_l3_payload, '03'O)));
+	BSSAP.send(ts_BSSAP_DATA_req(dt.sccp_conn_id, ts_BSSAP_DTAP(gen_l3_valid_payload(), '03'O)));
 	/* BSC attempts to establish a SAPI=3 link on DCCH */
 	rx_rsl := f_exp_ipa_rx(tr_RSL_EST_REQ(dt.rsl_chan_nr, tr_RslLinkID_DCCH(3)));
 
@@ -2666,10 +2680,10 @@
 	f_init(1);
 
 	/* MS establishes a SAPI=0 link on DCCH */
-	dt := f_est_dchan(f_rnd_ra_cs(), 23, c_l3_payload);
+	dt := f_est_dchan(f_rnd_ra_cs(), 23, gen_l3_valid_payload());
 
 	/* MSC sends some data on (not yet established) SAPI=3 link */
-	BSSAP.send(ts_BSSAP_DATA_req(dt.sccp_conn_id, ts_BSSAP_DTAP(c_l3_payload, '03'O)));
+	BSSAP.send(ts_BSSAP_DATA_req(dt.sccp_conn_id, ts_BSSAP_DTAP(gen_l3_valid_payload(), '03'O)));
 	/* BSC attempts to establish a SAPI=3 link on DCCH */
 	rx_rsl := f_exp_ipa_rx(tr_RSL_EST_REQ(dt.rsl_chan_nr, tr_RslLinkID_DCCH(3)));
 
@@ -2733,7 +2747,7 @@
 		var BSSAP_N_DATA_ind rx_di;
 		var DchanTuple dt;
 
-		dt := f_est_dchan('23'O, 23, c_l3_payload);
+		dt := f_est_dchan('23'O, 23, gen_l3_valid_payload());
 		/* Send CommonID with some random PLMN (BSC doesn't take it into account
 		 * yet when generating the EUTRAN neigh list in RR CHannel Release) */
 		BSSAP.send(ts_BSSAP_DATA_req(dt.sccp_conn_id, ts_BSSMAP_CommonId('001019876543210'H, '323454'O)));
@@ -7547,7 +7561,7 @@
 		/* Setup a BSSAP connection and clear it right away. This is
 		 * the MSC telling the BSC about a planned release, it's not an
 		 * erratic loss of a connection. */
-		dt := f_est_dchan(int2oct(i,1), 23+i, c_l3_payload);
+		dt := f_est_dchan(int2oct(i,1), 23+i, gen_l3_valid_payload());
 
 		/* MSC disconnects (RLSD). */
 		BSSAP.send(ts_BSSAP_DISC_req(dt.sccp_conn_id, 0));
@@ -7591,7 +7605,7 @@
 		/* Setup a BSSAP connection and clear it right away. This is
 		 * the MSC telling the BSC about a planned release, it's not an
 		 * erratic loss of a connection. */
-		dt := f_est_dchan(int2oct(i,1), 23+i, c_l3_payload);
+		dt := f_est_dchan(int2oct(i,1), 23+i, gen_l3_valid_payload());
 
 		/* Instruct BSC to clear channel */
 		BSSAP.send(ts_BSSAP_DATA_req(dt.sccp_conn_id, ts_BSSMAP_ClearCommand(cause)));
@@ -7637,7 +7651,7 @@
 		/* Setup a BSSAP connection and clear it right away. This is
 		 * the MSC telling the BSC about a planned release, it's not an
 		 * erratic loss of a connection. */
-		dt := f_est_dchan('23'O, 23, c_l3_payload);
+		dt := f_est_dchan('23'O, 23, gen_l3_valid_payload());
 
 		/* simulate RLL REL IND */
 		f_ipa_tx(ts_RSL_REL_IND(dt.rsl_chan_nr, valueof(ts_RslLinkID_DCCH(0))));
@@ -7951,7 +7965,7 @@
 	var DchanTuples sdcch_cleanup := {};
 	var integer i;
 	for (i := 0; i < NUM_SDCCH_PER_BTS; i := i + 1) {
-		dt := f_est_dchan('23'O, i, c_l3_payload);
+		dt := f_est_dchan('23'O, i, gen_l3_valid_payload());
 		sdcch_cleanup := sdcch_cleanup & { dt };
 	}
 
@@ -8028,14 +8042,14 @@
 	 */
 	var DchanTuples chan_cleanup := {};
 	for (i := 0; i < NUM_SDCCH_PER_BTS; i := i+1) {
-		chan_cleanup := chan_cleanup & { f_est_dchan('13'O, NUM_SDCCH_PER_BTS + i, c_l3_payload) };
+		chan_cleanup := chan_cleanup & { f_est_dchan('13'O, NUM_SDCCH_PER_BTS + i, gen_l3_valid_payload()) };
 	}
 
 	/* Only the dyn TS is still available. Its first lchan gets converted to SDCCH8 */
-	chan_cleanup := chan_cleanup & { f_est_dchan_dyn('33'O, NUM_SDCCH_PER_BTS + i, c_l3_payload) };
+	chan_cleanup := chan_cleanup & { f_est_dchan_dyn('33'O, NUM_SDCCH_PER_BTS + i, gen_l3_valid_payload()) };
 	/* Also occupy the seven other SDCCH of the dyn TS */
 	for (i := 0; i < 7; i := i+1) {
-		chan_cleanup := chan_cleanup & { f_est_dchan('33'O, NUM_SDCCH_PER_BTS + i, c_l3_payload) };
+		chan_cleanup := chan_cleanup & { f_est_dchan('33'O, NUM_SDCCH_PER_BTS + i, gen_l3_valid_payload()) };
 	}
 
 	/* Clean up SDCCH lchans */
@@ -8089,7 +8103,7 @@
 	var DchanTuples chan_cleanup := {};
 	var OCT1 ra := '43'O; /* RA containing reason=originating speech call*/
 	for (i := 0; i < NUM_SDCCH_PER_BTS; i := i + 1) {
-		dt := f_est_dchan(ra, i, c_l3_payload);
+		dt := f_est_dchan(ra, i, gen_l3_valid_payload());
 		chan_cleanup := chan_cleanup & { dt };
 	}
 
@@ -8167,7 +8181,7 @@
 	var DchanTuples chan_cleanup := {};
 	var integer i;
 	for (i := 0; i < NUM_SDCCH_PER_BTS; i := i + 1) {
-		dt := f_est_dchan('23'O, i, c_l3_payload);
+		dt := f_est_dchan('23'O, i, gen_l3_valid_payload());
 		chan_cleanup := chan_cleanup & { dt };
 	}
 
@@ -9207,6 +9221,7 @@
 	var integer i;
 	var integer chreq_total, chreq_nochan;
 	var RSL_Message rx_rsl;
+	var octetstring l3_payload := gen_l3_valid_payload();
 
 	f_init(1);
 	f_sleep(1.0);
@@ -9226,11 +9241,11 @@
 
 	/* Send EST IND for the first TCH, so we get to test the RR release cause */
 	var RslChannelNr first_tch := valueof(t_RslChanNr_Bm(1));
-	f_ipa_tx(ts_RSL_EST_IND(first_tch, valueof(ts_RslLinkID_DCCH(0)), c_l3_payload));
+	f_ipa_tx(ts_RSL_EST_IND(first_tch, valueof(ts_RslLinkID_DCCH(0)), l3_payload));
 
 	/* Accept BSSAP conn, so we get to test the Clear Request cause */
 	var BSSAP_N_CONNECT_ind rx_c_ind;
-	BSSAP.receive(tr_BSSAP_CONNECT_ind(?, ?, tr_BSSMAP_ComplL3(c_l3_payload))) -> value rx_c_ind;
+	BSSAP.receive(tr_BSSAP_CONNECT_ind(?, ?, tr_BSSMAP_ComplL3(l3_payload))) -> value rx_c_ind;
 	var integer sccp_conn_id := rx_c_ind.connectionId;
 	BSSAP.send(ts_BSSAP_CONNECT_res(rx_c_ind.connectionId));
 
@@ -9615,7 +9630,7 @@
 	 * NOTE: only 3 SDCCH/4 channels are available on CCCH+SDCCH4+CBCH */
 	for (var integer i := 0; i < 3; i := i + 1) {
 		/* Establish a dedicated channel, so we can trigger (late) TCH assignment */
-		var DchanTuple dt := f_est_dchan(f_rnd_ra_cs(), 23, c_l3_payload);
+		var DchanTuple dt := f_est_dchan(f_rnd_ra_cs(), 23, gen_l3_valid_payload());
 
 		/* Send a BSSMAP Assignment Command, expect CHANnel ACTIVation */
 		BSSAP.send(ts_BSSAP_DATA_req(dt.sccp_conn_id, ass_cmd));
@@ -9681,7 +9696,7 @@
 	var DchanTuple dt;
 
 	/* Establish a dedicated channel, so we can trigger handover */
-	dt := f_est_dchan(f_rnd_ra_cs(), 23, c_l3_payload);
+	dt := f_est_dchan(f_rnd_ra_cs(), 23, gen_l3_valid_payload());
 	f_sleep(0.5);
 
 	/* Trigger handover from BTS0 to BTS1 */
@@ -11022,6 +11037,7 @@
 testcase TC_imm_ass_post_chan_ack() runs on test_CT {
 	var RSL_Message chan_act;
 	var RSL_Message imm_ass;
+	var octetstring l3_payload := gen_l3_valid_payload();
 
 	f_init(1, false);
 	f_sleep(1.0);
@@ -11054,10 +11070,10 @@
 			 chan_ident_ie.chan_ident.ch_desc.v.tsc);
 
 	/* Check that the lchan is working */
-	f_ipa_tx(ts_RSL_EST_IND(chan_nr, valueof(ts_RslLinkID_DCCH(0)), c_l3_payload));
+	f_ipa_tx(ts_RSL_EST_IND(chan_nr, valueof(ts_RslLinkID_DCCH(0)), l3_payload));
 
 	var BSSAP_N_CONNECT_ind rx_c_ind;
-	BSSAP.receive(tr_BSSAP_CONNECT_ind(?, ?, tr_BSSMAP_ComplL3(c_l3_payload))) -> value rx_c_ind;
+	BSSAP.receive(tr_BSSAP_CONNECT_ind(?, ?, tr_BSSMAP_ComplL3(l3_payload))) -> value rx_c_ind;
 	dt.sccp_conn_id := rx_c_ind.connectionId;
 	BSSAP.send(ts_BSSAP_CONNECT_res(rx_c_ind.connectionId));
 
@@ -11069,6 +11085,7 @@
 testcase TC_imm_ass_pre_chan_ack() runs on test_CT {
 	var RSL_Message chan_act;
 	var RSL_Message imm_ass;
+	var octetstring l3_payload := gen_l3_valid_payload();
 
 	f_init(1, false);
 	f_sleep(1.0);
@@ -11101,10 +11118,10 @@
 	f_ipa_tx(ts_RSL_CHAN_ACT_ACK(chan_nr, fn+10));
 
 	/* Check that the lchan is working */
-	f_ipa_tx(ts_RSL_EST_IND(chan_nr, valueof(ts_RslLinkID_DCCH(0)), c_l3_payload));
+	f_ipa_tx(ts_RSL_EST_IND(chan_nr, valueof(ts_RslLinkID_DCCH(0)), l3_payload));
 
 	var BSSAP_N_CONNECT_ind rx_c_ind;
-	BSSAP.receive(tr_BSSAP_CONNECT_ind(?, ?, tr_BSSMAP_ComplL3(c_l3_payload))) -> value rx_c_ind;
+	BSSAP.receive(tr_BSSAP_CONNECT_ind(?, ?, tr_BSSMAP_ComplL3(l3_payload))) -> value rx_c_ind;
 	dt.sccp_conn_id := rx_c_ind.connectionId;
 	BSSAP.send(ts_BSSAP_CONNECT_res(rx_c_ind.connectionId));
 
@@ -11116,6 +11133,7 @@
 testcase TC_imm_ass_pre_ts_ack() runs on test_CT {
 	var RSL_Message chan_act;
 	var RSL_Message imm_ass;
+	var octetstring l3_payload := gen_l3_valid_payload();
 
 	f_init(1, false);
 	f_sleep(1.0);
@@ -11148,10 +11166,10 @@
 	f_ipa_tx(ts_RSL_CHAN_ACT_ACK(chan_nr, fn+10));
 
 	/* Check that the lchan is working */
-	f_ipa_tx(ts_RSL_EST_IND(chan_nr, valueof(ts_RslLinkID_DCCH(0)), c_l3_payload));
+	f_ipa_tx(ts_RSL_EST_IND(chan_nr, valueof(ts_RslLinkID_DCCH(0)), l3_payload));
 
 	var BSSAP_N_CONNECT_ind rx_c_ind;
-	BSSAP.receive(tr_BSSAP_CONNECT_ind(?, ?, tr_BSSMAP_ComplL3(c_l3_payload))) -> value rx_c_ind;
+	BSSAP.receive(tr_BSSAP_CONNECT_ind(?, ?, tr_BSSMAP_ComplL3(l3_payload))) -> value rx_c_ind;
 	dt.sccp_conn_id := rx_c_ind.connectionId;
 	BSSAP.send(ts_BSSAP_CONNECT_res(rx_c_ind.connectionId));
 
@@ -11169,6 +11187,7 @@
 	f_init(1, false);
 	f_sleep(1.0);
 
+	var octetstring l3_payload := gen_l3_valid_payload();
 	var RslChannelNr chan_nr := valueof(t_RslChanNr_PDCH(6));
 	/* The BSC will activate the dynamic PDCH by default, so confirm that */
 	f_exp_ipa_rx(tr_RSL_CHAN_ACT_PDCH(chan_nr));
@@ -11216,10 +11235,10 @@
 	f_ipa_tx(ts_RSL_CHAN_ACT_ACK(chan_nr, fn+10));
 
 	/* Check that the lchan is working */
-	f_ipa_tx(ts_RSL_EST_IND(chan_nr, valueof(ts_RslLinkID_DCCH(0)), c_l3_payload));
+	f_ipa_tx(ts_RSL_EST_IND(chan_nr, valueof(ts_RslLinkID_DCCH(0)), l3_payload));
 
 	var BSSAP_N_CONNECT_ind rx_c_ind;
-	BSSAP.receive(tr_BSSAP_CONNECT_ind(?, ?, tr_BSSMAP_ComplL3(c_l3_payload))) -> value rx_c_ind;
+	BSSAP.receive(tr_BSSAP_CONNECT_ind(?, ?, tr_BSSMAP_ComplL3(l3_payload))) -> value rx_c_ind;
 	dt.sccp_conn_id := rx_c_ind.connectionId;
 	BSSAP.send(ts_BSSAP_CONNECT_res(rx_c_ind.connectionId));
 
@@ -11240,6 +11259,7 @@
 	f_init(1, false);
 	f_sleep(1.0);
 
+	var octetstring l3_payload := gen_l3_valid_payload();
 	var RslChannelNr chan_nr := valueof(t_RslChanNr_PDCH(6));
 	/* The BSC will activate the dynamic PDCH by default, so confirm that */
 	f_exp_ipa_rx(tr_RSL_CHAN_ACT_PDCH(chan_nr));
@@ -11288,10 +11308,10 @@
 			 chan_ident_ie.chan_ident.ch_desc.v.tsc);
 
 	/* Check that the lchan is working */
-	f_ipa_tx(ts_RSL_EST_IND(chan_nr, valueof(ts_RslLinkID_DCCH(0)), c_l3_payload));
+	f_ipa_tx(ts_RSL_EST_IND(chan_nr, valueof(ts_RslLinkID_DCCH(0)), l3_payload));
 
 	var BSSAP_N_CONNECT_ind rx_c_ind;
-	BSSAP.receive(tr_BSSAP_CONNECT_ind(?, ?, tr_BSSMAP_ComplL3(c_l3_payload))) -> value rx_c_ind;
+	BSSAP.receive(tr_BSSAP_CONNECT_ind(?, ?, tr_BSSMAP_ComplL3(l3_payload))) -> value rx_c_ind;
 	dt.sccp_conn_id := rx_c_ind.connectionId;
 	BSSAP.send(ts_BSSAP_CONNECT_res(rx_c_ind.connectionId));
 
@@ -11567,7 +11587,7 @@
 	 */
 	var DchanTuples chan_cleanup := {};
 	for (i := 0; i < NUM_SDCCH_PER_BTS; i := i+1) {
-		chan_cleanup := chan_cleanup & { f_est_dchan('13'O, NUM_SDCCH_PER_BTS + i, c_l3_payload) };
+		chan_cleanup := chan_cleanup & { f_est_dchan('13'O, NUM_SDCCH_PER_BTS + i, gen_l3_valid_payload()) };
 	}
 
 	/* Since only bts 0 is connected, expecting all_allocated to become true for both bts 0 and the "global" bsc
@@ -11577,7 +11597,7 @@
 
 	/* Also fill up all remaining (TCH) channels */
 	for (i := 0; i < NUM_TCHF_PER_BTS + NUM_TCHH_PER_BTS; i := i+1) {
-		chan_cleanup := chan_cleanup & { f_est_dchan('33'O, NUM_SDCCH_PER_BTS + i, c_l3_payload) };
+		chan_cleanup := chan_cleanup & { f_est_dchan('33'O, NUM_SDCCH_PER_BTS + i, gen_l3_valid_payload()) };
 	}
 
 	/* All TCH are now also occupied */
@@ -11617,7 +11637,7 @@
 	 */
 	var DchanTuples chan_cleanup := {};
 	for (i := 0; i < NUM_SDCCH_PER_BTS; i := i+1) {
-		chan_cleanup := chan_cleanup & { f_est_dchan('13'O, NUM_SDCCH_PER_BTS + i, c_l3_payload) };
+		chan_cleanup := chan_cleanup & { f_est_dchan('13'O, NUM_SDCCH_PER_BTS + i, gen_l3_valid_payload()) };
 	}
 
 	/* The static SDCCH should now be occupied, while still 3x8 dynamic SDCCH potentially remain. So only
@@ -11627,11 +11647,11 @@
 	/* Request more SDCCH, hence convert the first dyn TS to SDCCH8.
 	 * Will release them later, so remember all the DchanTuples. */
 	var DchanTuples dyn_sddch := {};
-	dyn_sddch := dyn_sddch & { f_est_dchan_dyn('33'O, NUM_SDCCH_PER_BTS + i, c_l3_payload) };
+	dyn_sddch := dyn_sddch & { f_est_dchan_dyn('33'O, NUM_SDCCH_PER_BTS + i, gen_l3_valid_payload()) };
 
 	/* Also occupy the seven other SDCCH of the dyn TS */
 	for (i := 0; i < 7; i := i+1) {
-		dyn_sddch := dyn_sddch & { f_est_dchan('33'O, NUM_SDCCH_PER_BTS + i, c_l3_payload) };
+		dyn_sddch := dyn_sddch & { f_est_dchan('33'O, NUM_SDCCH_PER_BTS + i, gen_l3_valid_payload()) };
 	}
 
 	/* Now all dynamic SDCCH are also occupied, so for the first time all_allocated:sdcch will trigger... */
@@ -11639,7 +11659,7 @@
 
 	/* occupy the remaining TCH, three TCH/F and two TCH/H lchans */
 	for (i := 0; i < 5; i := i+1) {
-		chan_cleanup := chan_cleanup & { f_est_dchan('33'O, NUM_SDCCH_PER_BTS + i, c_l3_payload) };
+		chan_cleanup := chan_cleanup & { f_est_dchan('33'O, NUM_SDCCH_PER_BTS + i, gen_l3_valid_payload()) };
 	}
 
 	/* All TCH lchans are now also occupied, both static and dynamic */
@@ -11713,7 +11733,7 @@
 
 	/* Expect the BSC to allocate 4 x TCH/F channels on BTS2/TRX0 */
 	for (var integer i := 0; i < 4; i := i + 1) {
-		var DchanTuple dt := f_est_dchan('23'O, 23, c_l3_payload, {2, 0});
+		var DchanTuple dt := f_est_dchan('23'O, 23, gen_l3_valid_payload(), {2, 0});
 		f_TC_chan_alloc_algo(dt, {2, 0});
 		f_perform_clear_test_ct(dt);
 	}
@@ -11736,7 +11756,7 @@
 
 	/* Expect the BSC to allocate 5 x TCH/F channels on BTS2/TRX3 */
 	for (var integer i := 0; i < 5; i := i + 1) {
-		var DchanTuple dt := f_est_dchan('23'O, 23, c_l3_payload, {2, 0});
+		var DchanTuple dt := f_est_dchan('23'O, 23, gen_l3_valid_payload(), {2, 0});
 		f_TC_chan_alloc_algo(dt, {2, 3});
 		f_perform_clear_test_ct(dt);
 	}
@@ -11765,12 +11785,12 @@
 	var DchanTuple dt;
 
 	f_logp(BSCVTY, "Case a) Unknown Uplink RxLev, fall-back to ascending");
-	dt := f_est_dchan('23'O, 23, c_l3_payload, TRX0);
+	dt := f_est_dchan('23'O, 23, gen_l3_valid_payload(), TRX0);
 	f_TC_chan_alloc_algo(dt, TRX0);
 	f_perform_clear_test_ct(dt);
 
 	f_logp(BSCVTY, "Case b) Not enough RxLev samples, use ascending");
-	dt := f_est_dchan('23'O, 23, c_l3_payload, TRX0);
+	dt := f_est_dchan('23'O, 23, gen_l3_valid_payload(), TRX0);
 	f_ipa_tx(ts_RSL_MEAS_RES_EMPTY(dt.rsl_chan_nr, 0,
 				       ts_RSL_IE_UplinkMeas(30, 0),
 				       ts_RSL_IE_BS_Power(0)), TRX0);
@@ -11779,7 +11799,7 @@
 	f_perform_clear_test_ct(dt);
 
 	f_logp(BSCVTY, "Case c) Uplink RxLev below the threshold, use ascending");
-	dt := f_est_dchan('23'O, 23, c_l3_payload, TRX0);
+	dt := f_est_dchan('23'O, 23, gen_l3_valid_payload(), TRX0);
 	f_ipa_tx(ts_RSL_MEAS_RES_EMPTY(dt.rsl_chan_nr, 0,
 				       ts_RSL_IE_UplinkMeas(45, 0),
 				       ts_RSL_IE_BS_Power(0)), TRX0);
@@ -11791,7 +11811,7 @@
 	f_perform_clear_test_ct(dt);
 
 	f_logp(BSCVTY, "Case d) Uplink RxLev above the threshold, use descending");
-	dt := f_est_dchan('23'O, 23, c_l3_payload, TRX0);
+	dt := f_est_dchan('23'O, 23, gen_l3_valid_payload(), TRX0);
 	f_ipa_tx(ts_RSL_MEAS_RES_EMPTY(dt.rsl_chan_nr, 0,
 				       ts_RSL_IE_UplinkMeas(50, 0),
 				       ts_RSL_IE_BS_Power(0)), TRX0);
@@ -11807,7 +11827,7 @@
 	f_vty_transceive(BSCVTY, "end");
 
 	f_logp(BSCVTY, "Case e) Uplink RxLev above the threshold, but C0 load is not");
-	dt := f_est_dchan('23'O, 23, c_l3_payload, TRX0);
+	dt := f_est_dchan('23'O, 23, gen_l3_valid_payload(), TRX0);
 	f_ipa_tx(ts_RSL_MEAS_RES_EMPTY(dt.rsl_chan_nr, 0,
 				       ts_RSL_IE_UplinkMeas(50, 0),
 				       ts_RSL_IE_BS_Power(0)), TRX0);