diff --git a/src/bts.cpp b/src/bts.cpp
index 449e1ac8..bcf4d1b0 100644
--- a/src/bts.cpp
+++ b/src/bts.cpp
@@ -602,8 +602,10 @@ int bts_rcv_imm_ass_cnf(struct gprs_rlcmac_bts *bts, const uint8_t *data, uint32
 
 	LOGP(DRLCMAC, LOGL_DEBUG, "Got IMM.ASS confirm for TLLI=%08x\n", tlli);
 
-	if (dl_tbf->m_wait_confirm)
+	if (dl_tbf->m_wait_confirm) {
+		/* Transition to FLOW in gprs_rlcmac_tbf::handle_timeout() when timer expires */
 		T_START(dl_tbf, T0, -2002, "assignment (AGCH)", true);
+	}
 
 	return 0;
 }
diff --git a/src/gprs_pcu.c b/src/gprs_pcu.c
index 226b861c..3875e09f 100644
--- a/src/gprs_pcu.c
+++ b/src/gprs_pcu.c
@@ -37,8 +37,8 @@ static struct osmo_tdef T_defs_pcu[] = {
 	{ .T=PCU_TDEF_SI_CACHE_ALIVE,      .default_val=5,  .unit=OSMO_TDEF_S,   .desc="[RAC+CI]->[SI] resolution cache entry storage timeout (s)", .val=0 },
 	{ .T=-101,  .default_val=30,  .unit=OSMO_TDEF_S,  .desc="BSSGP (un)blocking procedures timer (s)",  .val=0 },
 	{ .T=-102,  .default_val=30,  .unit=OSMO_TDEF_S,  .desc="BSSGP reset procedure timer (s)",          .val=0 },
-	{ .T=-2000, .default_val=2,   .unit=OSMO_TDEF_MS, .desc="Tbf reject for PRR timer (ms)",            .val=0 },
-	{ .T=-2001, .default_val=2,   .unit=OSMO_TDEF_S,  .desc="PACCH assignment timer (s)",               .val=0 },
+	{ .T=-2000, .default_val=2,   .unit=OSMO_TDEF_MS, .desc="Delay release of UL TBF after tx Packet Access Reject (PACCH) (ms)", .val=0 },
+	{ .T=-2001, .default_val=2,   .unit=OSMO_TDEF_S,  .desc="PACCH assignment timeout (s)",               .val=0 },
 	{ .T=-2002, .default_val=200, .unit=OSMO_TDEF_MS, .desc="Waiting after IMM.ASS confirm timer (ms)", .val=0 },
 	{ .T=-2030, .default_val=60,  .unit=OSMO_TDEF_S,  .desc="Time to keep an idle MS object alive (s)", .val=0 }, /* slightly above T3314 (default 44s, 24.008, 11.2.2) */
 	{ .T=-2031, .default_val=2000, .unit=OSMO_TDEF_MS, .desc="Time to keep an idle DL TBF alive (ms)",  .val=0 },
diff --git a/src/tbf.cpp b/src/tbf.cpp
index b51e7de7..672146fe 100644
--- a/src/tbf.cpp
+++ b/src/tbf.cpp
@@ -775,7 +775,7 @@ void gprs_rlcmac_tbf::handle_timeout()
 
 	LOGPTBF(this, LOGL_DEBUG, "timer 0 expired. cur_fn=%d\n", current_fn);
 
-	/* assignment */
+	/* PACCH assignment timeout (see timers X2000, X2001) */
 	if ((state_flags & (1 << GPRS_RLCMAC_FLAG_PACCH))) {
 		if (state_is(GPRS_RLCMAC_ASSIGN)) {
 			LOGPTBF(this, LOGL_NOTICE, "releasing due to PACCH assignment timeout.\n");
@@ -785,6 +785,7 @@ void gprs_rlcmac_tbf::handle_timeout()
 			LOGPTBF(this, LOGL_ERROR, "Error: TBF is not in assign state\n");
 	}
 
+	/* Finish waiting after IMM.ASS confirm timer for CCCH assignment (see timer X2002) */
 	if ((state_flags & (1 << GPRS_RLCMAC_FLAG_CCCH))) {
 		gprs_rlcmac_dl_tbf *dl_tbf = as_dl_tbf(this);
 		dl_tbf->m_wait_confirm = 0;
@@ -965,9 +966,11 @@ struct msgb *gprs_rlcmac_tbf::create_packet_access_reject()
 	bitvec_free(packet_access_rej);
 	ul_ass_state = GPRS_RLCMAC_UL_ASS_NONE;
 
-	/* Start Tmr only if it is UL TBF */
-	if (direction == GPRS_RLCMAC_UL_TBF)
+	/* Start release only if it is UL TBF */
+	if (direction == GPRS_RLCMAC_UL_TBF) {
+		/* tbf_free() called in gprs_rlcmac_tbf::handle_timeout */
 		T_START(this, T0, -2000, "reject (PACCH)", true);
+	}
 
 	return msg;
 
diff --git a/src/tbf_dl.cpp b/src/tbf_dl.cpp
index dd5d0f26..fc53c84b 100644
--- a/src/tbf_dl.cpp
+++ b/src/tbf_dl.cpp
@@ -603,7 +603,7 @@ void gprs_rlcmac_dl_tbf::trigger_ass(struct gprs_rlcmac_tbf *old_tbf)
 		/* change state */
 		TBF_SET_ASS_ON(this, GPRS_RLCMAC_FLAG_PACCH, true);
 
-		/* start timer */
+		/* Start timer, expiry in gprs_rlcmac_tbf::handle_timeout tbf_free()s the TBF */
 		T_START(this, T0, -2001, "assignment (PACCH)", true);
 	} else {
 		LOGPTBFDL(this, LOGL_DEBUG, "Send dowlink assignment on PCH, no TBF exist (IMSI=%s)\n",