diff --git a/ggsn_tests/GGSN_Tests.ttcn b/ggsn_tests/GGSN_Tests.ttcn
index dc9d07c..31c1056 100644
--- a/ggsn_tests/GGSN_Tests.ttcn
+++ b/ggsn_tests/GGSN_Tests.ttcn
@@ -22,6 +22,7 @@
 	import from GTPC_Types all;
 	import from GTPU_Types all;
 	import from IPCP_Types all;
+	import from PAP_Types all;
 	import from IP_Types all;
 	import from ICMP_Types all;
 	import from ICMPv6_Types all;
@@ -932,6 +933,39 @@
 		f_pdp_ctx_del(ctx, '1'B);
 	}
 
+	/* Test PDP context activation for dynamic IPv4 EUA with IPv4 DNS in IPCP + PAP authentication (broken) */
+	testcase TC_pdp4_act_deact_ipcp_pap_broken() runs on GT_CT {
+		f_init();
+		var OCT4 ggsn_ip4_dns1 := f_inet_addr(m_ggsn_ip4_dns1);
+		var OCT4 ggsn_ip4_dns2 := f_inet_addr(m_ggsn_ip4_dns2);
+		var PdpContext ctx := valueof(t_DefinePDP(f_rnd_imsi('26242'H), '1234'O, c_ApnInternet, valueof(t_EuaIPv4Dyn)));
+		ctx.pco_req := valueof(ts_PCO_PAP_IPv4_DNS);
+		f_pdp_ctx_act(ctx);
+		f_PCO_ensure_no_duplicates(ctx.pco_neg);
+		/* verify IPCP is at all contained */
+		if (not match(ctx.pco_neg, tr_PCO_Contains('8021'O))) {
+			setverdict(fail, "IPCP not found in PCO");
+		}
+		/* verify IPCP contains both primary and secondary DNS */
+		var IpcpPacket ipcp := dec_IpcpPacket(f_PCO_extract_proto(ctx.pco_neg, '8021'O));
+		if (not match(ipcp, tr_IPCP_Ack_DNS(0, ggsn_ip4_dns1, ggsn_ip4_dns2))) {
+			if (not match(ipcp, tr_IPCP_Ack_DNS(0))) {
+				setverdict(fail, "Primary/Secondary DNS PCO IPCP option not found");
+			} else {
+				setverdict(fail, "Primary/Secondary DNS PCO IPCP option found but not matching expected values");
+			}
+		}
+		/* verify that PAP is contained */
+		if (not match(ctx.pco_neg, tr_PCO_Contains('C023'O))) {
+			setverdict(fail, "PAP not found in PCO");
+		}
+		var PapPacket pap := dec_PapPacket(f_PCO_extract_proto(ctx.pco_neg, 'C023'O));
+		if (not match(pap, tr_PAP_AuthAck)) {
+			setverdict(fail, "PAP isn't an AuthenticateAck: ", pap);
+		}
+		f_pdp_ctx_del(ctx, '1'B);
+	}
+
 	/* Test PDP context activation for dynamic IPv4 EUA with IPv4 DNS in PCO */
 	testcase TC_pdp4_act_deact_pcodns() runs on GT_CT {
 		f_init();
@@ -1277,6 +1311,7 @@
 	control {
 		execute(TC_pdp4_act_deact());
 		execute(TC_pdp4_act_deact_ipcp());
+		execute(TC_pdp4_act_deact_ipcp_pap_broken());
 		execute(TC_pdp4_act_deact_pcodns());
 		execute(TC_pdp4_act_deact_gtpu_access());
 		execute(TC_pdp4_clients_interact_with_txseq());
diff --git a/ggsn_tests/expected-results.xml b/ggsn_tests/expected-results.xml
index c2defea..c60a804 100644
--- a/ggsn_tests/expected-results.xml
+++ b/ggsn_tests/expected-results.xml
@@ -1,7 +1,8 @@
 <?xml version="1.0"?>
-<testsuite name='GGSN_Tests' tests='14' failures='1' errors='0' skipped='0' inconc='0' time='MASKED'>
+<testsuite name='GGSN_Tests' tests='15' failures='1' errors='0' skipped='0' inconc='0' time='MASKED'>
   <testcase classname='GGSN_Tests' name='TC_pdp4_act_deact' time='MASKED'/>
   <testcase classname='GGSN_Tests' name='TC_pdp4_act_deact_ipcp' time='MASKED'/>
+  <testcase classname='GGSN_Tests' name='TC_pdp4_act_deact_ipcp_pap_broken' time='MASKED'/>
   <testcase classname='GGSN_Tests' name='TC_pdp4_act_deact_pcodns' time='MASKED'/>
   <testcase classname='GGSN_Tests' name='TC_pdp4_act_deact_gtpu_access' time='MASKED'/>
   <testcase classname='GGSN_Tests' name='TC_pdp4_clients_interact_with_txseq' time='MASKED'/>
diff --git a/ggsn_tests/gen_links.sh b/ggsn_tests/gen_links.sh
index 82e35d4..1b54e9d 100755
--- a/ggsn_tests/gen_links.sh
+++ b/ggsn_tests/gen_links.sh
@@ -45,7 +45,7 @@
 gen_links $DIR $FILES
 
 DIR=../library
-FILES="Misc_Helpers.ttcn General_Types.ttcn GSM_Types.ttcn Osmocom_Types.ttcn Native_Functions.ttcn Native_FunctionDefs.cc IPCP_Types.ttcn "
+FILES="Misc_Helpers.ttcn General_Types.ttcn GSM_Types.ttcn Osmocom_Types.ttcn Native_Functions.ttcn Native_FunctionDefs.cc IPCP_Types.ttcn PAP_Types.ttcn "
 FILES+="GTP_CodecPort.ttcn GTP_CodecPort_CtrlFunct.ttcn GTP_CodecPort_CtrlFunctDef.cc GTP_Templates.ttcn "
 FILES+="Osmocom_VTY_Functions.ttcn "
 gen_links $DIR $FILES
diff --git a/library/GTP_Templates.ttcn b/library/GTP_Templates.ttcn
index f2e6ac0..aa42759 100644
--- a/library/GTP_Templates.ttcn
+++ b/library/GTP_Templates.ttcn
@@ -471,6 +471,18 @@
 		lengthProtoID := ?,
 		protoIDContents := ?
 	}
+	template ProtocolElement ts_PCOelem_PAP_broken := {
+		protocolID := 'C023'O,
+		lengthProtoID := 60,
+		/* PPP Password Authentication Protocol containing incorrect Peer-Id-Length set to 4 (6-7 should be the valid one), see OS#3914. */
+		protoIDContents := '0100003c'O & '0444435338323700bc1c08087c1508083e00790000150808fd06000001000000000000000000000000000000000000000000000000000000'O
+	}
+	template ProtConfigOptions ts_PCO_PAP_IPv4_DNS modifies ts_PCO := {
+		protocols := {
+			ts_PCOelem_PAP_broken,
+			{ protocolID := '8021'O, lengthProtoID := 16, protoIDContents := enc_IpcpPacket(valueof(ts_IPCP_ReqDNS)) }
+		}
+	}
 	template ProtConfigOptions tr_PCO_Contains(OCT2 prot_id) modifies tr_PCO := {
 		protocols := { *, tr_PCO_Proto(prot_id), * }
 	}