diff --git a/include/osmocom/bsc/signal.h b/include/osmocom/bsc/signal.h
index f775b5b89..17c9c03f1 100644
--- a/include/osmocom/bsc/signal.h
+++ b/include/osmocom/bsc/signal.h
@@ -131,8 +131,8 @@ struct nm_statechg_signal_data {
 	struct gsm_bts *bts;
 	uint8_t obj_class;
 	void *obj;
-	const struct gsm_nm_state *old_state;
-	const struct gsm_nm_state *new_state;
+	struct gsm_nm_state old_state;
+	struct gsm_nm_state new_state;
 
 	/* This pointer is valid for TS 12.21 MO */
 	struct abis_om_obj_inst *obj_inst;
diff --git a/src/ipaccess/ipaccess-config.c b/src/ipaccess/ipaccess-config.c
index 332e349ee..76f10f573 100644
--- a/src/ipaccess/ipaccess-config.c
+++ b/src/ipaccess/ipaccess-config.c
@@ -369,8 +369,8 @@ static int nm_sig_cb(unsigned int subsys, unsigned int signal,
 		break;
 	case S_NM_STATECHG:
 		nsd = signal_data;
-		nm_state_event(signal, nsd->obj_class, nsd->obj, nsd->old_state,
-				nsd->new_state, nsd->obj_inst);
+		nm_state_event(signal, nsd->obj_class, nsd->obj, &nsd->old_state,
+				&nsd->new_state, nsd->obj_inst);
 		break;
 	case S_NM_GET_ATTR_REP:
 		fprintf(stderr, "Received SIGNAL S_NM_GET_ATTR_REP\n");
diff --git a/src/osmo-bsc/abis_nm.c b/src/osmo-bsc/abis_nm.c
index e1e8efa09..cdb1fa663 100644
--- a/src/osmo-bsc/abis_nm.c
+++ b/src/osmo-bsc/abis_nm.c
@@ -210,7 +210,7 @@ static int abis_nm_rcvmsg_sw(struct msgb *mb);
 static int update_admstate(struct gsm_bts *bts, uint8_t obj_class,
 			   struct abis_om_obj_inst *obj_inst, uint8_t adm_state)
 {
-	struct gsm_nm_state *nm_state, new_state;
+	struct gsm_nm_state *nm_state;
 	struct nm_statechg_signal_data nsd;
 
 	memset(&nsd, 0, sizeof(nsd));
@@ -222,18 +222,16 @@ static int update_admstate(struct gsm_bts *bts, uint8_t obj_class,
 	if (!nm_state)
 		return -1;
 
-	new_state = *nm_state;
-	new_state.administrative = adm_state;
-
 	nsd.bts = bts;
 	nsd.obj_class = obj_class;
-	nsd.old_state = nm_state;
-	nsd.new_state = &new_state;
+	nsd.old_state = *nm_state;
+	nsd.new_state = *nm_state;
 	nsd.obj_inst = obj_inst;
+
+	nsd.new_state.administrative = adm_state;
+
 	osmo_signal_dispatch(SS_NM, S_NM_STATECHG, &nsd);
-
 	nm_state->administrative = adm_state;
-
 	return 0;
 }
 
@@ -244,17 +242,27 @@ static int abis_nm_rx_statechg_rep(struct msgb *mb)
 	struct e1inp_sign_link *sign_link = mb->dst;
 	struct gsm_bts *bts = sign_link->trx->bts;
 	struct tlv_parsed tp;
-	struct gsm_nm_state *nm_state, new_state;
+	struct gsm_nm_state *nm_state;
+	struct nm_statechg_signal_data nsd;
 
-	memset(&new_state, 0, sizeof(new_state));
+	memset(&nsd, 0, sizeof(nsd));
 
+	nsd.obj = gsm_objclass2obj(bts, foh->obj_class, &foh->obj_inst);
+	if (!nsd.obj) {
+		LOGPFOH(DNM, LOGL_ERROR, foh, "unknown managed object\n");
+		return -EINVAL;
+	}
 	nm_state = gsm_objclass2nmstate(bts, foh->obj_class, &foh->obj_inst);
 	if (!nm_state) {
 		LOGPFOH(DNM, LOGL_ERROR, foh, "unknown managed object\n");
 		return -EINVAL;
 	}
 
-	new_state = *nm_state;
+	nsd.obj_class = foh->obj_class;
+	nsd.old_state = *nm_state;
+	nsd.new_state = *nm_state;
+	nsd.obj_inst = &foh->obj_inst;
+	nsd.bts = bts;
 
 	if (abis_nm_tlv_parse(&tp, bts, foh->data, oh->length - sizeof(*foh)) < 0) {
 		LOGPFOH(DNM, LOGL_ERROR, foh, "%s(): tlv_parse failed\n", __func__);
@@ -263,45 +271,35 @@ static int abis_nm_rx_statechg_rep(struct msgb *mb)
 
 	DEBUGPFOH(DNM, foh, "STATE CHG: ");
 	if (TLVP_PRESENT(&tp, NM_ATT_OPER_STATE)) {
-		new_state.operational = *TLVP_VAL(&tp, NM_ATT_OPER_STATE);
+		nsd.new_state.operational = *TLVP_VAL(&tp, NM_ATT_OPER_STATE);
 		DEBUGPC(DNM, "OP_STATE=%s ",
-			abis_nm_opstate_name(new_state.operational));
+			abis_nm_opstate_name(nsd.new_state.operational));
 	}
 	if (TLVP_PRESENT(&tp, NM_ATT_AVAIL_STATUS)) {
 		if (TLVP_LEN(&tp, NM_ATT_AVAIL_STATUS) == 0)
-			new_state.availability = NM_AVSTATE_OK;
+			nsd.new_state.availability = NM_AVSTATE_OK;
 		else
-			new_state.availability = *TLVP_VAL(&tp, NM_ATT_AVAIL_STATUS);
+			nsd.new_state.availability = *TLVP_VAL(&tp, NM_ATT_AVAIL_STATUS);
 		DEBUGPC(DNM, "AVAIL=%s(%02x) ",
-			abis_nm_avail_name(new_state.availability),
-			new_state.availability);
+			abis_nm_avail_name(nsd.new_state.availability),
+			nsd.new_state.availability);
 	} else
-		new_state.availability = NM_AVSTATE_OK;
+		nsd.new_state.availability = NM_AVSTATE_OK;
 	if (TLVP_PRESENT(&tp, NM_ATT_ADM_STATE)) {
-		new_state.administrative = *TLVP_VAL(&tp, NM_ATT_ADM_STATE);
+		nsd.new_state.administrative = *TLVP_VAL(&tp, NM_ATT_ADM_STATE);
 		DEBUGPC(DNM, "ADM=%2s ",
 			get_value_string(abis_nm_adm_state_names,
-					 new_state.administrative));
+					 nsd.new_state.administrative));
 	}
 
-	if ((new_state.administrative != 0 && nm_state->administrative == 0) ||
-	    new_state.operational != nm_state->operational ||
-	    new_state.availability != nm_state->availability) {
+	if ((nsd.new_state.administrative != 0 && nsd.old_state.administrative == 0) ||
+	    nsd.new_state.operational != nsd.old_state.operational ||
+	    nsd.new_state.availability != nsd.old_state.availability) {
 		DEBUGPC(DNM, "\n");
 		/* Update the operational state of a given object in our in-memory data
  		* structures and send an event to the higher layer */
-		struct nm_statechg_signal_data nsd;
-		nsd.obj = gsm_objclass2obj(bts, foh->obj_class, &foh->obj_inst);
-		nsd.obj_class = foh->obj_class;
-		nsd.old_state = nm_state;
-		nsd.new_state = &new_state;
-		nsd.obj_inst = &foh->obj_inst;
-		nsd.bts = bts;
 		osmo_signal_dispatch(SS_NM, S_NM_STATECHG, &nsd);
-		nm_state->operational = new_state.operational;
-		nm_state->availability = new_state.availability;
-		if (nm_state->administrative == 0)
-			nm_state->administrative = new_state.administrative;
+		*nm_state = nsd.new_state;
 	} else {
 		DEBUGPC(DNM, "(No State change detected)\n");
 	}
diff --git a/src/osmo-bsc/abis_om2000.c b/src/osmo-bsc/abis_om2000.c
index 18d0728a3..04c783b4c 100644
--- a/src/osmo-bsc/abis_om2000.c
+++ b/src/osmo-bsc/abis_om2000.c
@@ -950,13 +950,20 @@ static void *mo2obj(struct gsm_bts *bts, struct abis_om2k_mo *mo)
 static void update_mo_state(struct gsm_bts *bts, struct abis_om2k_mo *mo, uint8_t mo_state)
 {
 	struct gsm_nm_state *nm_state = mo2nm_state(bts, mo);
-	struct gsm_nm_state new_state;
 	struct nm_statechg_signal_data nsd;
 	bool has_enabled_state;
 
 	if (!nm_state)
 		return;
 
+	memset(&nsd, 0, sizeof(nsd));
+
+	nsd.bts = bts;
+	nsd.obj = mo2obj(bts, mo);
+	nsd.old_state = *nm_state;
+	nsd.new_state = *nm_state;
+	nsd.om2k_mo = mo;
+
 	switch (mo->class) {
 	case OM2K_MO_CLS_CF:
 	case OM2K_MO_CLS_TRXC:
@@ -967,36 +974,27 @@ static void update_mo_state(struct gsm_bts *bts, struct abis_om2k_mo *mo, uint8_
 		break;
 	}
 
-	new_state = *nm_state;
 	switch (mo_state) {
 	case OM2K_MOSTATE_RESET:
-		new_state.availability = NM_AVSTATE_POWER_OFF;
+		nsd.new_state.availability = NM_AVSTATE_POWER_OFF;
 		break;
 	case OM2K_MOSTATE_STARTED:
-		new_state.availability = has_enabled_state ? NM_AVSTATE_OFF_LINE : NM_AVSTATE_OK;
+		nsd.new_state.availability = has_enabled_state ? NM_AVSTATE_OFF_LINE : NM_AVSTATE_OK;
 		break;
 	case OM2K_MOSTATE_ENABLED:
-		new_state.availability = NM_AVSTATE_OK;
+		nsd.new_state.availability = NM_AVSTATE_OK;
 		break;
 	case OM2K_MOSTATE_DISABLED:
-		new_state.availability = NM_AVSTATE_POWER_OFF;
+		nsd.new_state.availability = NM_AVSTATE_POWER_OFF;
 		break;
 	default:
-		new_state.availability = NM_AVSTATE_DEGRADED;
+		nsd.new_state.availability = NM_AVSTATE_DEGRADED;
 		break;
 	}
 
-	memset(&nsd, 0, sizeof(nsd));
-
-	nsd.bts = bts;
-	nsd.obj = mo2obj(bts, mo);
-	nsd.old_state = nm_state;
-	nsd.new_state = &new_state;
-	nsd.om2k_mo = mo;
-
 	osmo_signal_dispatch(SS_NM, S_NM_STATECHG, &nsd);
 
-	nm_state->availability = new_state.availability;
+	nm_state->availability = nsd.new_state.availability;
 }
 
 static void update_op_state(struct gsm_bts *bts, const struct abis_om2k_mo *mo, uint8_t op_state)
diff --git a/src/osmo-bsc/acc.c b/src/osmo-bsc/acc.c
index 1172fd898..61a226c53 100644
--- a/src/osmo-bsc/acc.c
+++ b/src/osmo-bsc/acc.c
@@ -427,11 +427,11 @@ static int acc_ramp_nm_sig_cb(unsigned int subsys, unsigned int signal, void *ha
 	trx = nsd->obj;
 
 	LOG_TRX(trx, DRSL, LOGL_DEBUG, "ACC RAMP: administrative state %s -> %s\n",
-	    get_value_string(abis_nm_adm_state_names, nsd->old_state->administrative),
-	    get_value_string(abis_nm_adm_state_names, nsd->new_state->administrative));
+	    get_value_string(abis_nm_adm_state_names, nsd->old_state.administrative),
+	    get_value_string(abis_nm_adm_state_names, nsd->new_state.administrative));
 	LOG_TRX(trx, DRSL, LOGL_DEBUG, "ACC RAMP: operational state %s -> %s\n",
-	    abis_nm_opstate_name(nsd->old_state->operational),
-	    abis_nm_opstate_name(nsd->new_state->operational));
+	    abis_nm_opstate_name(nsd->old_state.operational),
+	    abis_nm_opstate_name(nsd->new_state.operational));
 
 	/* We only care about state changes of the first TRX. */
 	if (trx->nr != 0)
@@ -445,21 +445,21 @@ static int acc_ramp_nm_sig_cb(unsigned int subsys, unsigned int signal, void *ha
 	}
 
 	/* Trigger or abort ACC ramping based on the new state of this TRX. */
-	if (nsd->old_state->administrative != nsd->new_state->administrative) {
-		switch (nsd->new_state->administrative) {
+	if (nsd->old_state.administrative != nsd->new_state.administrative) {
+		switch (nsd->new_state.administrative) {
 		case NM_STATE_UNLOCKED:
-			if (nsd->old_state->operational != nsd->new_state->operational) {
+			if (nsd->old_state.operational != nsd->new_state.operational) {
 				/*
 				 * Administrative and operational state have both changed.
 				 * Trigger ramping only if TRX 0 will be both enabled and unlocked.
 				 */
-				if (nsd->new_state->operational == NM_OPSTATE_ENABLED)
+				if (nsd->new_state.operational == NM_OPSTATE_ENABLED)
 					trigger_ramping = true;
 				else
 					LOG_TRX(trx, DRSL, LOGL_DEBUG,
 						"ACC RAMP: ignoring state change because TRX is "
 						"transitioning into operational state '%s'\n",
-						abis_nm_opstate_name(nsd->new_state->operational));
+						abis_nm_opstate_name(nsd->new_state.operational));
 			} else {
 				/*
 				 * Operational state has not changed.
@@ -479,24 +479,24 @@ static int acc_ramp_nm_sig_cb(unsigned int subsys, unsigned int signal, void *ha
 		case NM_STATE_NULL:
 		default:
 			LOG_TRX(trx, DRSL, LOGL_ERROR, "ACC RAMP: unrecognized administrative state '0x%x' "
-				"reported for TRX 0\n", nsd->new_state->administrative);
+				"reported for TRX 0\n", nsd->new_state.administrative);
 			break;
 		}
 	}
-	if (nsd->old_state->operational != nsd->new_state->operational) {
-		switch (nsd->new_state->operational) {
+	if (nsd->old_state.operational != nsd->new_state.operational) {
+		switch (nsd->new_state.operational) {
 		case NM_OPSTATE_ENABLED:
-			if (nsd->old_state->administrative != nsd->new_state->administrative) {
+			if (nsd->old_state.administrative != nsd->new_state.administrative) {
 				/*
 				 * Administrative and operational state have both changed.
 				 * Trigger ramping only if TRX 0 will be both enabled and unlocked.
 				 */
-				if (nsd->new_state->administrative == NM_STATE_UNLOCKED)
+				if (nsd->new_state.administrative == NM_STATE_UNLOCKED)
 					trigger_ramping = true;
 				else
 					LOG_TRX(trx, DRSL, LOGL_DEBUG, "ACC RAMP: ignoring state change "
 						"because TRX is transitioning into administrative state '%s'\n",
-						get_value_string(abis_nm_adm_state_names, nsd->new_state->administrative));
+						get_value_string(abis_nm_adm_state_names, nsd->new_state.administrative));
 			} else {
 				/*
 				 * Administrative state has not changed.
@@ -516,7 +516,7 @@ static int acc_ramp_nm_sig_cb(unsigned int subsys, unsigned int signal, void *ha
 		case NM_OPSTATE_NULL:
 		default:
 			LOG_TRX(trx, DRSL, LOGL_ERROR, "ACC RAMP: unrecognized operational state '0x%x' "
-			     "reported for TRX 0\n", nsd->new_state->administrative);
+			     "reported for TRX 0\n", nsd->new_state.administrative);
 			break;
 		}
 	}
diff --git a/src/osmo-bsc/nm_bb_transc_fsm.c b/src/osmo-bsc/nm_bb_transc_fsm.c
index dc8c68228..a4cef9cdf 100644
--- a/src/osmo-bsc/nm_bb_transc_fsm.c
+++ b/src/osmo-bsc/nm_bb_transc_fsm.c
@@ -64,7 +64,7 @@ static void st_op_disabled_notinstalled(struct osmo_fsm_inst *fi, uint32_t event
 		break;
 	case NM_EV_STATE_CHG_REP:
 		nsd = (struct nm_statechg_signal_data *)data;
-		new_state = nsd->new_state;
+		new_state = &nsd->new_state;
 		if (new_state->operational == NM_OPSTATE_ENABLED) {
 			/*should not happen... */
 			nm_bb_transc_fsm_state_chg(fi, NM_BB_TRANSC_ST_OP_ENABLED);
@@ -149,7 +149,7 @@ static void st_op_disabled_dependency(struct osmo_fsm_inst *fi, uint32_t event,
 		return;
 	case NM_EV_STATE_CHG_REP:
 		nsd = (struct nm_statechg_signal_data *)data;
-		new_state = nsd->new_state;
+		new_state = &nsd->new_state;
 		if (new_state->operational == NM_OPSTATE_ENABLED) {
 			/* should not happen... */
 			nm_bb_transc_fsm_state_chg(fi, NM_BB_TRANSC_ST_OP_ENABLED);
@@ -199,7 +199,7 @@ static void st_op_disabled_offline(struct osmo_fsm_inst *fi, uint32_t event, voi
 		return;
 	case NM_EV_STATE_CHG_REP:
 		nsd = (struct nm_statechg_signal_data *)data;
-		new_state = nsd->new_state;
+		new_state = &nsd->new_state;
 		if (new_state->operational == NM_OPSTATE_ENABLED) {
 			nm_bb_transc_fsm_state_chg(fi, NM_BB_TRANSC_ST_OP_ENABLED);
 			return;
@@ -253,7 +253,7 @@ static void st_op_enabled(struct osmo_fsm_inst *fi, uint32_t event, void *data)
 	switch (event) {
 	case NM_EV_STATE_CHG_REP:
 		nsd = (struct nm_statechg_signal_data *)data;
-		new_state = nsd->new_state;
+		new_state = &nsd->new_state;
 		if (new_state->operational == NM_OPSTATE_ENABLED)
 			return;
 		switch (new_state->availability) { /* operational = DISABLED */
diff --git a/src/osmo-bsc/nm_bts_fsm.c b/src/osmo-bsc/nm_bts_fsm.c
index 5216ec8a4..79ae6a7de 100644
--- a/src/osmo-bsc/nm_bts_fsm.c
+++ b/src/osmo-bsc/nm_bts_fsm.c
@@ -66,7 +66,7 @@ static void st_op_disabled_notinstalled(struct osmo_fsm_inst *fi, uint32_t event
 		break;
 	case NM_EV_STATE_CHG_REP:
 		nsd = (struct nm_statechg_signal_data *)data;
-		new_state = nsd->new_state;
+		new_state = &nsd->new_state;
 		if (new_state->operational == NM_OPSTATE_ENABLED) {
 			/*should not happen... */
 			nm_bts_fsm_state_chg(fi, NM_BTS_ST_OP_ENABLED);
@@ -177,7 +177,7 @@ static void st_op_disabled_dependency(struct osmo_fsm_inst *fi, uint32_t event,
 		return;
 	case NM_EV_STATE_CHG_REP:
 		nsd = (struct nm_statechg_signal_data *)data;
-		new_state = nsd->new_state;
+		new_state = &nsd->new_state;
 		if (new_state->operational == NM_OPSTATE_ENABLED) {
 			/* should not happen... */
 			nm_bts_fsm_state_chg(fi, NM_BTS_ST_OP_ENABLED);
@@ -229,7 +229,7 @@ static void st_op_disabled_offline(struct osmo_fsm_inst *fi, uint32_t event, voi
 		return;
 	case NM_EV_STATE_CHG_REP:
 		nsd = (struct nm_statechg_signal_data *)data;
-		new_state = nsd->new_state;
+		new_state = &nsd->new_state;
 		if (new_state->operational == NM_OPSTATE_ENABLED) {
 			nm_bts_fsm_state_chg(fi, NM_BTS_ST_OP_ENABLED);
 			return;
@@ -285,7 +285,7 @@ static void st_op_enabled(struct osmo_fsm_inst *fi, uint32_t event, void *data)
 	switch (event) {
 	case NM_EV_STATE_CHG_REP:
 		nsd = (struct nm_statechg_signal_data *)data;
-		new_state = nsd->new_state;
+		new_state = &nsd->new_state;
 		if (new_state->operational == NM_OPSTATE_ENABLED)
 			return;
 		switch (new_state->availability) { /* operational = DISABLED */
diff --git a/src/osmo-bsc/nm_bts_sm_fsm.c b/src/osmo-bsc/nm_bts_sm_fsm.c
index b99fb53f7..03bf43c40 100644
--- a/src/osmo-bsc/nm_bts_sm_fsm.c
+++ b/src/osmo-bsc/nm_bts_sm_fsm.c
@@ -64,7 +64,7 @@ static void st_op_disabled_notinstalled(struct osmo_fsm_inst *fi, uint32_t event
 		break;
 	case NM_EV_STATE_CHG_REP:
 		nsd = (struct nm_statechg_signal_data *)data;
-		new_state = nsd->new_state;
+		new_state = &nsd->new_state;
 		if (new_state->operational == NM_OPSTATE_ENABLED) {
 			/* nanobts always go directly into Reported ENABLED state during
 			   startup, but we still need to OPSTART it, otherwise it won't
@@ -107,7 +107,7 @@ static void st_op_disabled_dependency(struct osmo_fsm_inst *fi, uint32_t event,
 	switch (event) {
 	case NM_EV_STATE_CHG_REP:
 		nsd = (struct nm_statechg_signal_data *)data;
-		new_state = nsd->new_state;
+		new_state = &nsd->new_state;
 		if (new_state->operational == NM_OPSTATE_ENABLED) {
 			nm_bts_sm_fsm_state_chg(fi, NM_BTS_SM_ST_OP_ENABLED);
 			return;
@@ -147,7 +147,7 @@ static void st_op_disabled_offline(struct osmo_fsm_inst *fi, uint32_t event, voi
 	switch (event) {
 	case NM_EV_STATE_CHG_REP:
 		nsd = (struct nm_statechg_signal_data *)data;
-		new_state = nsd->new_state;
+		new_state = &nsd->new_state;
 		if (new_state->operational == NM_OPSTATE_ENABLED) {
 			nm_bts_sm_fsm_state_chg(fi, NM_BTS_SM_ST_OP_ENABLED);
 			return;
@@ -178,7 +178,7 @@ static void st_op_enabled(struct osmo_fsm_inst *fi, uint32_t event, void *data)
 	switch (event) {
 	case NM_EV_STATE_CHG_REP:
 		nsd = (struct nm_statechg_signal_data *)data;
-		new_state = nsd->new_state;
+		new_state = &nsd->new_state;
 		if (new_state->operational == NM_OPSTATE_ENABLED)
 			return;
 		switch (new_state->availability) { /* operational = DISABLED */
diff --git a/src/osmo-bsc/nm_channel_fsm.c b/src/osmo-bsc/nm_channel_fsm.c
index a4f083937..680e658c8 100644
--- a/src/osmo-bsc/nm_channel_fsm.c
+++ b/src/osmo-bsc/nm_channel_fsm.c
@@ -65,7 +65,7 @@ static void st_op_disabled_notinstalled(struct osmo_fsm_inst *fi, uint32_t event
 		break;
 	case NM_EV_STATE_CHG_REP:
 		nsd = (struct nm_statechg_signal_data *)data;
-		new_state = nsd->new_state;
+		new_state = &nsd->new_state;
 		if (new_state->operational == NM_OPSTATE_ENABLED) {
 			/*should not happen... */
 			nm_chan_fsm_state_chg(fi, NM_CHAN_ST_OP_ENABLED);
@@ -138,7 +138,7 @@ static void st_op_disabled_dependency(struct osmo_fsm_inst *fi, uint32_t event,
 		return;
 	case NM_EV_STATE_CHG_REP:
 		nsd = (struct nm_statechg_signal_data *)data;
-		new_state = nsd->new_state;
+		new_state = &nsd->new_state;
 		if (new_state->operational == NM_OPSTATE_ENABLED) {
 			/* should not happen... */
 			nm_chan_fsm_state_chg(fi, NM_CHAN_ST_OP_ENABLED);
@@ -187,7 +187,7 @@ static void st_op_disabled_offline(struct osmo_fsm_inst *fi, uint32_t event, voi
 		return;
 	case NM_EV_STATE_CHG_REP:
 		nsd = (struct nm_statechg_signal_data *)data;
-		new_state = nsd->new_state;
+		new_state = &nsd->new_state;
 		if (new_state->operational == NM_OPSTATE_ENABLED) {
 			nm_chan_fsm_state_chg(fi, NM_CHAN_ST_OP_ENABLED);
 			return;
@@ -241,7 +241,7 @@ static void st_op_enabled(struct osmo_fsm_inst *fi, uint32_t event, void *data)
 	switch (event) {
 	case NM_EV_STATE_CHG_REP:
 		nsd = (struct nm_statechg_signal_data *)data;
-		new_state = nsd->new_state;
+		new_state = &nsd->new_state;
 		if (new_state->operational == NM_OPSTATE_ENABLED)
 			return;
 		switch (new_state->availability) { /* operational = DISABLED */
diff --git a/src/osmo-bsc/nm_gprs_cell_fsm.c b/src/osmo-bsc/nm_gprs_cell_fsm.c
index cf91397af..9a656e1ef 100644
--- a/src/osmo-bsc/nm_gprs_cell_fsm.c
+++ b/src/osmo-bsc/nm_gprs_cell_fsm.c
@@ -64,7 +64,7 @@ static void st_op_disabled_notinstalled(struct osmo_fsm_inst *fi, uint32_t event
 		break;
 	case NM_EV_STATE_CHG_REP:
 		nsd = (struct nm_statechg_signal_data *)data;
-		new_state = nsd->new_state;
+		new_state = &nsd->new_state;
 		if (new_state->operational == NM_OPSTATE_ENABLED) {
 			/* should not happen... */
 			nm_gprs_cell_fsm_state_chg(fi, NM_GPRS_CELL_ST_OP_ENABLED);
@@ -148,7 +148,7 @@ static void st_op_disabled_dependency(struct osmo_fsm_inst *fi, uint32_t event,
 		return;
 	case NM_EV_STATE_CHG_REP:
 		nsd = (struct nm_statechg_signal_data *)data;
-		new_state = nsd->new_state;
+		new_state = &nsd->new_state;
 		if (new_state->operational == NM_OPSTATE_ENABLED) {
 			/* should not happen... */
 			nm_gprs_cell_fsm_state_chg(fi, NM_GPRS_CELL_ST_OP_ENABLED);
@@ -198,7 +198,7 @@ static void st_op_disabled_offline(struct osmo_fsm_inst *fi, uint32_t event, voi
 		return;
 	case NM_EV_STATE_CHG_REP:
 		nsd = (struct nm_statechg_signal_data *)data;
-		new_state = nsd->new_state;
+		new_state = &nsd->new_state;
 		if (new_state->operational == NM_OPSTATE_ENABLED) {
 			nm_gprs_cell_fsm_state_chg(fi, NM_GPRS_CELL_ST_OP_ENABLED);
 			return;
@@ -252,7 +252,7 @@ static void st_op_enabled(struct osmo_fsm_inst *fi, uint32_t event, void *data)
 	switch (event) {
 	case NM_EV_STATE_CHG_REP:
 		nsd = (struct nm_statechg_signal_data *)data;
-		new_state = nsd->new_state;
+		new_state = &nsd->new_state;
 		if (new_state->operational == NM_OPSTATE_ENABLED)
 			return;
 		switch (new_state->availability) { /* operational = DISABLED */
diff --git a/src/osmo-bsc/nm_gprs_nse_fsm.c b/src/osmo-bsc/nm_gprs_nse_fsm.c
index 2d6e13bb3..4ad623e48 100644
--- a/src/osmo-bsc/nm_gprs_nse_fsm.c
+++ b/src/osmo-bsc/nm_gprs_nse_fsm.c
@@ -65,7 +65,7 @@ static void st_op_disabled_notinstalled(struct osmo_fsm_inst *fi, uint32_t event
 		break;
 	case NM_EV_STATE_CHG_REP:
 		nsd = (struct nm_statechg_signal_data *)data;
-		new_state = nsd->new_state;
+		new_state = &nsd->new_state;
 		if (new_state->operational == NM_OPSTATE_ENABLED) {
 			/* should not happen... */
 			nm_gprs_nse_fsm_state_chg(fi, NM_GPRS_NSE_ST_OP_ENABLED);
@@ -149,7 +149,7 @@ static void st_op_disabled_dependency(struct osmo_fsm_inst *fi, uint32_t event,
 		return;
 	case NM_EV_STATE_CHG_REP:
 		nsd = (struct nm_statechg_signal_data *)data;
-		new_state = nsd->new_state;
+		new_state = &nsd->new_state;
 		if (new_state->operational == NM_OPSTATE_ENABLED) {
 			/* should not happen... */
 			nm_gprs_nse_fsm_state_chg(fi, NM_GPRS_NSE_ST_OP_ENABLED);
@@ -199,7 +199,7 @@ static void st_op_disabled_offline(struct osmo_fsm_inst *fi, uint32_t event, voi
 		return;
 	case NM_EV_STATE_CHG_REP:
 		nsd = (struct nm_statechg_signal_data *)data;
-		new_state = nsd->new_state;
+		new_state = &nsd->new_state;
 		if (new_state->operational == NM_OPSTATE_ENABLED) {
 			nm_gprs_nse_fsm_state_chg(fi, NM_GPRS_NSE_ST_OP_ENABLED);
 			return;
@@ -253,7 +253,7 @@ static void st_op_enabled(struct osmo_fsm_inst *fi, uint32_t event, void *data)
 	switch (event) {
 	case NM_EV_STATE_CHG_REP:
 		nsd = (struct nm_statechg_signal_data *)data;
-		new_state = nsd->new_state;
+		new_state = &nsd->new_state;
 		if (new_state->operational == NM_OPSTATE_ENABLED)
 			return;
 		switch (new_state->availability) { /* operational = DISABLED */
diff --git a/src/osmo-bsc/nm_gprs_nsvc_fsm.c b/src/osmo-bsc/nm_gprs_nsvc_fsm.c
index c2b7db3bb..75cf4d639 100644
--- a/src/osmo-bsc/nm_gprs_nsvc_fsm.c
+++ b/src/osmo-bsc/nm_gprs_nsvc_fsm.c
@@ -68,7 +68,7 @@ static void st_op_disabled_notinstalled(struct osmo_fsm_inst *fi, uint32_t event
 		break;
 	case NM_EV_STATE_CHG_REP:
 		nsd = (struct nm_statechg_signal_data *)data;
-		new_state = nsd->new_state;
+		new_state = &nsd->new_state;
 		if (new_state->operational == NM_OPSTATE_ENABLED) {
 			/* should not happen... */
 			nm_gprs_nsvc_fsm_state_chg(fi, NM_GPRS_NSVC_ST_OP_ENABLED);
@@ -164,7 +164,7 @@ static void st_op_disabled_dependency(struct osmo_fsm_inst *fi, uint32_t event,
 		return;
 	case NM_EV_STATE_CHG_REP:
 		nsd = (struct nm_statechg_signal_data *)data;
-		new_state = nsd->new_state;
+		new_state = &nsd->new_state;
 		if (new_state->operational == NM_OPSTATE_ENABLED) {
 			/* should not happen... */
 			nm_gprs_nsvc_fsm_state_chg(fi, NM_GPRS_NSVC_ST_OP_ENABLED);
@@ -216,7 +216,7 @@ static void st_op_disabled_offline(struct osmo_fsm_inst *fi, uint32_t event, voi
 		return;
 	case NM_EV_STATE_CHG_REP:
 		nsd = (struct nm_statechg_signal_data *)data;
-		new_state = nsd->new_state;
+		new_state = &nsd->new_state;
 		if (new_state->operational == NM_OPSTATE_ENABLED) {
 			nm_gprs_nsvc_fsm_state_chg(fi, NM_GPRS_NSVC_ST_OP_ENABLED);
 			return;
@@ -270,7 +270,7 @@ static void st_op_enabled(struct osmo_fsm_inst *fi, uint32_t event, void *data)
 	switch (event) {
 	case NM_EV_STATE_CHG_REP:
 		nsd = (struct nm_statechg_signal_data *)data;
-		new_state = nsd->new_state;
+		new_state = &nsd->new_state;
 		if (new_state->operational == NM_OPSTATE_ENABLED)
 			return;
 		switch (new_state->availability) { /* operational = DISABLED */
diff --git a/src/osmo-bsc/nm_rcarrier_fsm.c b/src/osmo-bsc/nm_rcarrier_fsm.c
index 0cdba681f..f3c230d70 100644
--- a/src/osmo-bsc/nm_rcarrier_fsm.c
+++ b/src/osmo-bsc/nm_rcarrier_fsm.c
@@ -64,7 +64,7 @@ static void st_op_disabled_notinstalled(struct osmo_fsm_inst *fi, uint32_t event
 		break;
 	case NM_EV_STATE_CHG_REP:
 		nsd = (struct nm_statechg_signal_data *)data;
-		new_state = nsd->new_state;
+		new_state = &nsd->new_state;
 		if (new_state->operational == NM_OPSTATE_ENABLED) {
 			/*should not happen... */
 			nm_rcarrier_fsm_state_chg(fi, NM_RCARRIER_ST_OP_ENABLED);
@@ -144,7 +144,7 @@ static void st_op_disabled_dependency(struct osmo_fsm_inst *fi, uint32_t event,
 		return;
 	case NM_EV_STATE_CHG_REP:
 		nsd = (struct nm_statechg_signal_data *)data;
-		new_state = nsd->new_state;
+		new_state = &nsd->new_state;
 		if (new_state->operational == NM_OPSTATE_ENABLED) {
 			/* should not happen... */
 			nm_rcarrier_fsm_state_chg(fi, NM_RCARRIER_ST_OP_ENABLED);
@@ -193,7 +193,7 @@ static void st_op_disabled_offline(struct osmo_fsm_inst *fi, uint32_t event, voi
 		return;
 	case NM_EV_STATE_CHG_REP:
 		nsd = (struct nm_statechg_signal_data *)data;
-		new_state = nsd->new_state;
+		new_state = &nsd->new_state;
 		if (new_state->operational == NM_OPSTATE_ENABLED) {
 			nm_rcarrier_fsm_state_chg(fi, NM_RCARRIER_ST_OP_ENABLED);
 			return;
@@ -238,7 +238,7 @@ static void st_op_enabled(struct osmo_fsm_inst *fi, uint32_t event, void *data)
 	switch (event) {
 	case NM_EV_STATE_CHG_REP:
 		nsd = (struct nm_statechg_signal_data *)data;
-		new_state = nsd->new_state;
+		new_state = &nsd->new_state;
 		if (new_state->operational == NM_OPSTATE_ENABLED)
 			return;
 		switch (new_state->availability) { /* operational = DISABLED */