diff --git a/include/osmo-bts/oml.h b/include/osmo-bts/oml.h
index afc52d4f3..effb3dd36 100644
--- a/include/osmo-bts/oml.h
+++ b/include/osmo-bts/oml.h
@@ -9,8 +9,13 @@ int oml_send_msg(struct msgb *msg, int is_mauf);
 int oml_mo_send_msg(struct gsm_abis_mo *mo, struct msgb *msg, uint8_t msg_type);
 int oml_mo_opstart_ack(struct gsm_abis_mo *mo);
 int oml_mo_opstart_nack(struct gsm_abis_mo *mo, uint8_t nack_cause);
+
+/* Change the state and send STATE CHG REP */
 int oml_mo_state_chg(struct gsm_abis_mo *mo, int op_state, int avail_state);
 
+/* Transmit STATE CHG REP even if there was no state change */
+int oml_tx_state_changed(struct gsm_abis_mo *mo);
+
 int oml_mo_tx_sw_act_rep(struct gsm_abis_mo *mo);
 
 int oml_fom_ack_nack(struct msgb *old_msg, uint8_t cause);
diff --git a/src/common/abis.c b/src/common/abis.c
index 7a08e188f..f9063e78f 100644
--- a/src/common/abis.c
+++ b/src/common/abis.c
@@ -29,6 +29,7 @@
 #include <unistd.h>
 #include <errno.h>
 #include <string.h>
+#include <stdlib.h>
 
 #include <osmocom/core/select.h>
 #include <osmocom/core/timer.h>
diff --git a/src/common/bts.c b/src/common/bts.c
index e34639729..22008572a 100644
--- a/src/common/bts.c
+++ b/src/common/bts.c
@@ -36,6 +36,7 @@
 #include <osmo-bts/logging.h>
 #include <osmo-bts/abis.h>
 #include <osmo-bts/bts.h>
+#include <osmo-bts/bts_model.h>
 #include <osmo-bts/rsl.h>
 #include <osmo-bts/oml.h>
 
@@ -318,7 +319,6 @@ int bts_link_estab(struct gsm_bts *bts)
 	/* All other objects start off-line until the BTS Model code says otherwise */
 	for (i = 0; i < bts->num_trx; i++) {
 		struct gsm_bts_trx *trx = gsm_bts_trx_num(bts, i);
-		struct ipabis_link *link = (struct ipabis_link *) trx->rsl_link;
 
 		oml_tx_state_changed(&trx->mo);
 		oml_tx_state_changed(&trx->bb_transc.mo);
@@ -353,7 +353,6 @@ int trx_link_estab(struct gsm_bts_trx *trx)
 void bts_new_si(void *arg)
 {
 	struct osmobts_trx *trx = arg;
-	int i;
 
 #if 0
 	if (osmo_timer_pending(&trx->si.timer))
diff --git a/src/common/logging.c b/src/common/logging.c
index a7df2282a..608b62672 100644
--- a/src/common/logging.c
+++ b/src/common/logging.c
@@ -30,7 +30,7 @@
 #include <osmo-bts/bts.h>
 #include <osmo-bts/logging.h>
 
-static const struct log_info_cat bts_log_info_cat[] = {
+static struct log_info_cat bts_log_info_cat[] = {
 	[DRSL] = {
 		.name = "DRSL",
 		.description = "A-bis Radio Siganlling Link (RSL)",
diff --git a/src/common/measurement.c b/src/common/measurement.c
index 5daa5a5ee..0b2f371dc 100644
--- a/src/common/measurement.c
+++ b/src/common/measurement.c
@@ -171,7 +171,7 @@ int lchan_meas_check_compute(struct gsm_lchan *lchan, uint32_t fn)
 		irssi_sub_sum = irssi_sub_sum / num_meas_sub;
 	}
 
-	DEBUGP(DMEAS, "%s Computed TA(% 4uqb) BER-FULL(%2u.%02u%%), RSSI-FULL(-%3udBm), "
+	DEBUGP(DMEAS, "%s Computed TA(% 4dqb) BER-FULL(%2u.%02u%%), RSSI-FULL(-%3udBm), "
 		"BER-SUB(%2u.%02u%%), RSSI-SUB(-%3udBm)", gsm_lchan_name(lchan),
 		taqb_sum, ber_full_sum/100,
 		ber_full_sum%100, irssi_full_sum, ber_sub_sum/100, ber_sub_sum%100,
diff --git a/src/common/rsl.c b/src/common/rsl.c
index 7fd59cc7a..5aa40f4ad 100644
--- a/src/common/rsl.c
+++ b/src/common/rsl.c
@@ -570,11 +570,12 @@ static int rsl_rx_chan_activ(struct msgb *msg)
 	if (TLVP_PRESENT(&tp, RSL_IE_SACCH_INFO)) {
 		uint8_t tot_len = TLVP_LEN(&tp, RSL_IE_SACCH_INFO);
 		const uint8_t *val = TLVP_VAL(&tp, RSL_IE_SACCH_INFO);
-		uint8_t num_msgs = *val++;
+		const uint8_t *cur = val;
+		uint8_t num_msgs = *cur++;
 		unsigned int i;
 		for (i = 0; i < num_msgs; i++) {
-			uint8_t rsl_si = *val++;
-			uint8_t si_len = *val++;
+			uint8_t rsl_si = *cur++;
+			uint8_t si_len = *cur++;
 			uint8_t osmo_si;
 			uint8_t copy_len;
 
@@ -594,9 +595,13 @@ static int rsl_rx_chan_activ(struct msgb *msg)
 			lchan->si.valid |= (1 << osmo_si);
 			lchan->si.buf[osmo_si][0] = 0x00;
 			lchan->si.buf[osmo_si][1] = 0x03;
-			memcpy(lchan->si.buf[osmo_si]+2, val, copy_len);
+			memcpy(lchan->si.buf[osmo_si]+2, cur, copy_len);
 
-			val += si_len;
+			cur += si_len;
+			if (cur >= val + tot_len) {
+				LOGP(DRSL, LOGL_ERROR, "Error parsing SACCH INFO IE\n");
+				return rsl_tx_error_report(msg->trx, RSL_ERR_IE_CONTENT);
+			}
 		}
 	} else {
 		/* use standard SACCH filling of the BTS */
diff --git a/src/osmo-bts-sysmo/bts_model.c b/src/osmo-bts-sysmo/bts_model.c
index ac4e20558..a10402171 100644
--- a/src/osmo-bts-sysmo/bts_model.c
+++ b/src/osmo-bts-sysmo/bts_model.c
@@ -27,8 +27,8 @@
 
 int bts_model_rsl_chan_act(struct gsm_lchan *lchan, struct tlv_parsed *tp)
 {
-	uint8_t mode = *TLVP_VAL(tp, RSL_IE_CHAN_MODE);
-	uint8_t type = *TLVP_VAL(tp, RSL_IE_ACT_TYPE);
+	//uint8_t mode = *TLVP_VAL(tp, RSL_IE_CHAN_MODE);
+	//uint8_t type = *TLVP_VAL(tp, RSL_IE_ACT_TYPE);
 
 	lchan_activate(lchan);
 	/* FIXME: only do this in case of success */
diff --git a/src/osmo-bts-sysmo/l1_fwd_main.c b/src/osmo-bts-sysmo/l1_fwd_main.c
index c7bdcdf58..2f9bf2172 100644
--- a/src/osmo-bts-sysmo/l1_fwd_main.c
+++ b/src/osmo-bts-sysmo/l1_fwd_main.c
@@ -49,6 +49,7 @@
 
 #include "femtobts.h"
 #include "l1_if.h"
+#include "l1_transp.h"
 #include "l1_fwd.h"
 
 static const uint16_t fwd_udp_ports[_NUM_MQ_WRITE] = {