diff --git a/src/pdch.cpp b/src/pdch.cpp
index 76ca1d00..5389763b 100644
--- a/src/pdch.cpp
+++ b/src/pdch.cpp
@@ -685,8 +685,7 @@ void gprs_rlcmac_pdch::rcv_resource_request(Packet_Resource_Request_t *request,
 
 		ul_tbf = tbf_alloc_ul(bts(), ms, trx_no(), tlli);
 		if (!ul_tbf) {
-			handle_tbf_reject(bts(), ms, tlli,
-				trx_no(), ts_no);
+			handle_tbf_reject(bts(), ms, trx_no(), ts_no);
 			goto return_unref;
 		}
 
diff --git a/src/tbf_ul.cpp b/src/tbf_ul.cpp
index 7a4e3a36..c41793df 100644
--- a/src/tbf_ul.cpp
+++ b/src/tbf_ul.cpp
@@ -96,6 +96,7 @@ static int ul_tbf_dtor(struct gprs_rlcmac_ul_tbf *tbf)
 	return 0;
 }
 
+/* Generic function to alloc a UL TBF, later configured to be assigned either over CCCH or PACCH */
 struct gprs_rlcmac_ul_tbf *tbf_alloc_ul_tbf(struct gprs_rlcmac_bts *bts, GprsMs *ms, int8_t use_trx, bool single_slot)
 {
 	struct gprs_rlcmac_ul_tbf *tbf;
@@ -139,19 +140,16 @@ struct gprs_rlcmac_ul_tbf *tbf_alloc_ul_tbf(struct gprs_rlcmac_bts *bts, GprsMs
 	return tbf;
 }
 
-
+/* Alloc a UL TBF to be assigned over PACCH */
 gprs_rlcmac_ul_tbf *tbf_alloc_ul(struct gprs_rlcmac_bts *bts, GprsMs *ms, int8_t use_trx,
 				 uint32_t tlli)
 {
 	struct gprs_rlcmac_ul_tbf *tbf;
 
-/* FIXME: Copy and paste with tbf_new_dl_assignment */
-	/* create new TBF, use same TRX as DL TBF */
-	/* use multislot class of downlink TBF */
 	tbf = tbf_alloc_ul_tbf(bts, ms, use_trx, false);
 	if (!tbf) {
 		LOGPMS(ms, DTBF, LOGL_NOTICE, "No PDCH resource\n");
-		/* FIXME: send reject */
+		/* Caller will most probably send a Imm Ass Reject after return */
 		return NULL;
 	}
 	tbf->m_contention_resolution_done = 1;
@@ -162,30 +160,23 @@ gprs_rlcmac_ul_tbf *tbf_alloc_ul(struct gprs_rlcmac_bts *bts, GprsMs *ms, int8_t
 	return tbf;
 }
 
+/* Create a temporary dummy TBF to Tx a ImmAssReject if allocating a new one during
+ * packet resource Request failed. This is similar as tbf_alloc_ul() but without
+ * calling tbf->setup() (in charge of TFI/USF allocation), and reusing resources
+ * from Packet Resource Request we received. See TS 44.060 sec 7.1.3.2.1  */
 struct gprs_rlcmac_ul_tbf *handle_tbf_reject(struct gprs_rlcmac_bts *bts,
-			GprsMs *ms, uint32_t tlli, uint8_t trx_no, uint8_t ts)
+			GprsMs *ms, uint8_t trx_no, uint8_t ts)
 {
 	struct gprs_rlcmac_ul_tbf *ul_tbf = NULL;
 	struct gprs_rlcmac_trx *trx = &bts->trx[trx_no];
-
-	if (!ms)
-		ms = bts_alloc_ms(bts, 0, 0);
-	ms_set_tlli(ms, tlli);
+	OSMO_ASSERT(ms);
 
 	ul_tbf = talloc(tall_pcu_ctx, struct gprs_rlcmac_ul_tbf);
 	if (!ul_tbf)
 		return ul_tbf;
-
 	talloc_set_destructor(ul_tbf, ul_tbf_dtor);
 	new (ul_tbf) gprs_rlcmac_ul_tbf(bts, ms);
 
-	llist_add(tbf_bts_list((struct gprs_rlcmac_tbf *)ul_tbf), &bts->ul_tbfs);
-	bts_do_rate_ctr_inc(ul_tbf->bts, CTR_TBF_UL_ALLOCATED);
-	TBF_SET_ASS_ON(ul_tbf, GPRS_RLCMAC_FLAG_PACCH, false);
-
-	ms_attach_tbf(ms, ul_tbf);
-	ul_tbf->update_ms(tlli, GPRS_RLCMAC_UL_TBF);
-	TBF_SET_ASS_STATE_UL(ul_tbf, GPRS_RLCMAC_UL_ASS_SEND_ASS_REJ);
 	ul_tbf->control_ts = ts;
 	ul_tbf->trx = trx;
 	ul_tbf->m_ctrs = rate_ctr_group_alloc(ul_tbf, &tbf_ctrg_desc, next_tbf_ctr_group_id++);
@@ -201,6 +192,12 @@ struct gprs_rlcmac_ul_tbf *handle_tbf_reject(struct gprs_rlcmac_bts *bts,
 		return NULL;
 	}
 
+	ms_attach_tbf(ms, ul_tbf);
+	llist_add(tbf_bts_list((struct gprs_rlcmac_tbf *)ul_tbf), &bts->ul_tbfs);
+	bts_do_rate_ctr_inc(ul_tbf->bts, CTR_TBF_UL_ALLOCATED);
+	TBF_SET_ASS_ON(ul_tbf, GPRS_RLCMAC_FLAG_PACCH, false);
+	TBF_SET_ASS_STATE_UL(ul_tbf, GPRS_RLCMAC_UL_ASS_SEND_ASS_REJ);
+
 	return ul_tbf;
 }
 
diff --git a/src/tbf_ul.h b/src/tbf_ul.h
index a2ad25ea..53c7ad86 100644
--- a/src/tbf_ul.h
+++ b/src/tbf_ul.h
@@ -121,7 +121,7 @@ struct gprs_rlcmac_ul_tbf *tbf_alloc_ul_tbf(struct gprs_rlcmac_bts *bts, GprsMs
 struct gprs_rlcmac_ul_tbf *tbf_alloc_ul(struct gprs_rlcmac_bts *bts, GprsMs *ms,
 					int8_t use_trx, uint32_t tlli);
 struct gprs_rlcmac_ul_tbf *handle_tbf_reject(struct gprs_rlcmac_bts *bts,
-	GprsMs *ms, uint32_t tlli, uint8_t trx_no, uint8_t ts_no);
+	GprsMs *ms, uint8_t trx_no, uint8_t ts_no);
 
 #else /* ifdef __cplusplus */
 struct gprs_rlcmac_ul_tbf;
diff --git a/tests/tbf/TbfTest.cpp b/tests/tbf/TbfTest.cpp
index c839ee05..cf8e0830 100644
--- a/tests/tbf/TbfTest.cpp
+++ b/tests/tbf/TbfTest.cpp
@@ -3160,7 +3160,8 @@ static void test_packet_access_rej_prr_no_other_tbfs()
 	int ts_no = 7;
 	uint8_t trx_no = 0;
 	uint32_t tlli = 0xffeeddcc;
-	struct gprs_rlcmac_ul_tbf *ul_tbf = NULL;
+	struct gprs_rlcmac_ul_tbf *ul_tbf;
+	struct GprsMs *ms;
 
 	fprintf(stderr, "=== start %s ===\n", __func__);
 
@@ -3168,8 +3169,9 @@ static void test_packet_access_rej_prr_no_other_tbfs()
 
 	int rc = 0;
 
-	ul_tbf = handle_tbf_reject(bts, NULL, tlli,
-				trx_no, ts_no);
+	ms = bts_alloc_ms(bts, 0, 0);
+	ms_set_tlli(ms, tlli);
+	ul_tbf = handle_tbf_reject(bts, ms, trx_no, ts_no);
 
 	OSMO_ASSERT(ul_tbf != 0);
 
diff --git a/tests/tbf/TbfTest.err b/tests/tbf/TbfTest.err
index 4b38aec9..e700fe26 100644
--- a/tests/tbf/TbfTest.err
+++ b/tests/tbf/TbfTest.err
@@ -7956,8 +7956,8 @@ MS(TLLI=0xffeeddd3, IMSI=, TA=7, 11/11,) Allocating UL TBF
 [UL] algo A <multi> (suggested TRX: 0): failed to allocate a TS, no USF available
 TBF(TFI=0 TLLI=0xffeeddd3 DIR=UL STATE=NULL EGPRS) Timeslot Allocation failed: trx = 0, single_slot = 0
 MS(TLLI=0xffeeddd3, IMSI=, TA=7, 11/11,) No PDCH resource
+MS(TLLI=0xffeeddd3, IMSI=, TA=7, 11/11,) Attaching UL TBF: TBF(TFI=0 TLLI=0xffeeddd3 DIR=UL STATE=NULL)
 TBF(TFI=0 TLLI=0xffeeddd3 DIR=UL STATE=NULL) changes state from NULL to ASSIGN
-MS(TLLI=0xffeeddd3, IMSI=, TA=7, 11/11,) Attaching UL TBF: TBF(TFI=0 TLLI=0xffeeddd3 DIR=UL STATE=ASSIGN)
 TBF(TFI=0 TLLI=0xffeeddd3 DIR=UL STATE=ASSIGN) changes UL ASS state from GPRS_RLCMAC_UL_ASS_NONE to GPRS_RLCMAC_UL_ASS_SEND_ASS_REJ
 PDCH(bts=0,trx=0,ts=7) Expiring FN=82 but previous FN=2654231 is still reserved!
 PDCH(bts=0,trx=0,ts=7) Timeout for registered POLL (FN=2654231): TBF(TFI=6 TLLI=0xffeeddd2 DIR=UL STATE=ASSIGN EGPRS)
@@ -7974,8 +7974,8 @@ PDCH(bts=0,trx=0,ts=7) FN=2654218 Scheduling control message at RTS for TBF(TFI=
 === start test_packet_access_rej_prr_no_other_tbfs ===
 Creating MS object, TLLI = 0xffffffff
 Modifying MS object, UL TLLI: 0xffffffff -> 0xffeeddcc, not yet confirmed
+MS(TLLI=0xffeeddcc, IMSI=, TA=220, 0/0,) Attaching UL TBF: TBF(TFI=0 TLLI=0xffeeddcc DIR=UL STATE=NULL)
 TBF(TFI=0 TLLI=0xffeeddcc DIR=UL STATE=NULL) changes state from NULL to ASSIGN
-MS(TLLI=0xffeeddcc, IMSI=, TA=220, 0/0,) Attaching UL TBF: TBF(TFI=0 TLLI=0xffeeddcc DIR=UL STATE=ASSIGN)
 TBF(TFI=0 TLLI=0xffeeddcc DIR=UL STATE=ASSIGN) changes UL ASS state from GPRS_RLCMAC_UL_ASS_NONE to GPRS_RLCMAC_UL_ASS_SEND_ASS_REJ
 TBF(TFI=0 TLLI=0xffeeddcc DIR=UL STATE=ASSIGN) starting timer T0 [reject (PACCH)] with 0 sec. 2000 microsec, cur_fn=2654167
 PDCH(bts=0,trx=0,ts=7) FN=2654218 Scheduling control message at RTS for TBF(TFI=0 TLLI=0xffeeddcc DIR=UL STATE=ASSIGN)