diff --git a/src/rlcmac/sched.c b/src/rlcmac/sched.c
index 25ee6da..8709f71 100644
--- a/src/rlcmac/sched.c
+++ b/src/rlcmac/sched.c
@@ -155,14 +155,22 @@ static struct gprs_rlcmac_ul_tbf *find_requested_ul_tbf_for_dummy(const struct g
 	return NULL;
 }
 
-
+/*! Select a CTRL message to transmit, based on different messages priority.
+ * \param[in] bi  RTS block indication information.
+ * \param[in] tbfs  TBF candidates having CTRL messages to send, filled in by get_ctrl_msg_tbf_candidates()
+ * \param[out] tbf_to_free  TBF to free after sending the generated message
+ */
 static struct msgb *sched_select_ctrl_msg(const struct gprs_rlcmac_rts_block_ind *bi,
-					     struct tbf_sched_ctrl_candidates *tbfs)
+					  const struct tbf_sched_ctrl_candidates *tbfs,
+					  struct gprs_rlcmac_tbf **tbf_to_free)
 {
 	struct msgb *msg = NULL;
 	struct gprs_rlcmac_entity *gre;
 	int rc;
 
+	/* No TBF to be freed by default: */
+	*tbf_to_free = NULL;
+
 	/* 8.1.2.2 1) (EGPRS) PACKET DOWNLINK ACK/NACK w/ FinalAckInd=1 */
 	if (tbfs->poll_dl_ack_final_ack) {
 		LOGRLCMAC(LOGL_DEBUG, "(ts=%u,fn=%u,usf=%u) Tx DL ACK/NACK FinalAck=1\n",
@@ -200,8 +208,8 @@ static struct msgb *sched_select_ctrl_msg(const struct gprs_rlcmac_rts_block_ind
 		LOGRLCMAC(LOGL_DEBUG, "(ts=%u,fn=%u,usf=%u) Tx Pkt Control Ack (UL ACK/NACK poll)\n",
 			  bi->ts, bi->fn, bi->usf);
 		msg = gprs_rlcmac_gre_create_pkt_ctrl_ack(ul_tbf_as_tbf(tbfs->poll_ul_ack)->gre);
-		/* Last UL message, freeing */
-		gprs_rlcmac_ul_tbf_free(tbfs->poll_ul_ack);
+		/* Last UL message, freeing (after passing msg to lower layers) */
+		*tbf_to_free = ul_tbf_as_tbf(tbfs->poll_ul_ack);
 		return msg;
 	}
 	if (tbfs->poll_dl_ass) {
@@ -280,6 +288,7 @@ int gprs_rlcmac_rcv_rts_block(struct gprs_rlcmac_rts_block_ind *bi)
 {
 	struct msgb *msg = NULL;
 	struct tbf_sched_ctrl_candidates tbf_cand = {0};
+	struct gprs_rlcmac_tbf *tbf_to_free;
 	struct osmo_gprs_rlcmac_prim *rlcmac_prim_tx;
 	int rc = 0;
 
@@ -287,7 +296,7 @@ int gprs_rlcmac_rcv_rts_block(struct gprs_rlcmac_rts_block_ind *bi)
 
 	get_ctrl_msg_tbf_candidates(bi, &tbf_cand);
 
-	if ((msg = sched_select_ctrl_msg(bi, &tbf_cand)))
+	if ((msg = sched_select_ctrl_msg(bi, &tbf_cand, &tbf_to_free)))
 		goto tx_msg;
 
 	if ((msg = sched_select_ul_data_msg(bi)))
@@ -305,6 +314,8 @@ tx_msg:
 	rlcmac_prim_tx->l1ctl.pdch_data_req.data_len = msgb_length(msg);
 	rc = gprs_rlcmac_prim_call_down_cb(rlcmac_prim_tx);
 	msgb_free(msg);
+	if (tbf_to_free)
+		gprs_rlcmac_tbf_free(tbf_to_free);
 
 ret_rc:
 	gprs_rlcmac_pdch_ulc_expire_fn(g_rlcmac_ctx->sched.ulc[bi->ts], bi->fn);
diff --git a/tests/rlcmac/rlcmac_prim_test.err b/tests/rlcmac/rlcmac_prim_test.err
index 120458a..24ee965 100644
--- a/tests/rlcmac/rlcmac_prim_test.err
+++ b/tests/rlcmac/rlcmac_prim_test.err
@@ -63,11 +63,11 @@ DLGLOBAL DEBUG Register POLL (TS=7 FN=21, reason=UL_ACK)
 DLGLOBAL DEBUG Rx from lower layers: L1CTL-PDCH_RTS.indication
 DLGLOBAL DEBUG (ts=7,fn=21,usf=0) Tx Pkt Control Ack (UL ACK/NACK poll)
 DLGLOBAL DEBUG GRE(00002342) Tx Packet Control Ack
+DLGLOBAL DEBUG Tx to lower layers: L1CTL-PDCH_DATA.request
 DLGLOBAL INFO UL_TBF_ASS{IDLE}: Deallocated
 DLGLOBAL INFO UL_TBF{RELEASING}: Send L1CTL-CFG_UL_TBF.req ul_tbf_nr=0 (release)
 DLGLOBAL DEBUG Tx to lower layers: L1CTL-CFG_UL_TBF.request
 DLGLOBAL INFO UL_TBF{RELEASING}: Deallocated
-DLGLOBAL DEBUG Tx to lower layers: L1CTL-PDCH_DATA.request
 DLGLOBAL INFO DL_TBF_ASS{IDLE}: Deallocated
 DLGLOBAL INFO Rx from upper layers: GRR-UNITDATA.request
 DLGLOBAL INFO TLLI=0x00002342 not found, creating entity on the fly
diff --git a/tests/rlcmac/rlcmac_prim_test.ok b/tests/rlcmac/rlcmac_prim_test.ok
index b555cbe..34b82f1 100644
--- a/tests/rlcmac/rlcmac_prim_test.ok
+++ b/tests/rlcmac/rlcmac_prim_test.ok
@@ -5,8 +5,8 @@ test_rlcmac_prim_down_cb(): Rx L1CTL-CFG_UL_TBF.request ul_tbf_nr=0 ul_slotmask=
 test_rlcmac_prim_up_cb(): Rx GMMRR-LLC_TRANSMITTED.indication TLLI=0x00002342
 test_rlcmac_prim_down_cb(): Rx L1CTL-PDCH_DATA.request fn=4 ts=7 data_len=34 data=[3c 01 01 00 00 23 42 01 c0 00 08 01 01 d5 71 00 00 08 29 26 24 00 00 00 00 71 62 f2 24 6c 84 44 04 00 ]
 test_rlcmac_prim_down_cb(): Rx L1CTL-PDCH_DATA.request fn=8 ts=7 data_len=34 data=[00 01 02 1d 00 00 23 42 11 e5 10 00 e2 18 f2 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 00 ]
-test_rlcmac_prim_down_cb(): Rx L1CTL-CFG_UL_TBF.request ul_tbf_nr=0 ul_slotmask=0x00
 test_rlcmac_prim_down_cb(): Rx L1CTL-PDCH_DATA.request fn=21 ts=7 data_len=23 data=[40 04 00 00 8d 08 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b ]
+test_rlcmac_prim_down_cb(): Rx L1CTL-CFG_UL_TBF.request ul_tbf_nr=0 ul_slotmask=0x00
 === test_ul_tbf_attach end ===
 === test_ul_tbf_t3164_timeout start ===
 sys={0.000000}, mono={0.000000}: clock_override_set