diff --git a/src/host/layer23/include/osmocom/bb/common/l1ctl.h b/src/host/layer23/include/osmocom/bb/common/l1ctl.h
index 88aedcf58..64abf9c48 100644
--- a/src/host/layer23/include/osmocom/bb/common/l1ctl.h
+++ b/src/host/layer23/include/osmocom/bb/common/l1ctl.h
@@ -20,8 +20,8 @@ int l1ctl_tx_crypto_req(struct osmocom_ms *ms, uint8_t algo, uint8_t *key,
 	uint8_t len);
 
 /* Transmit L1CTL_RACH_REQ */
-int l1ctl_tx_rach_req(struct osmocom_ms *ms, uint8_t ra, uint8_t fn51,
-	uint8_t mf_off);
+int l1ctl_tx_rach_req(struct osmocom_ms *ms, uint8_t ra, uint16_t offset,
+	uint8_t combined);
 
 /* Transmit L1CTL_DM_EST_REQ */
 int l1ctl_tx_dm_est_req_h0(struct osmocom_ms *ms, uint16_t band_arfcn,
diff --git a/src/host/layer23/src/common/l1ctl.c b/src/host/layer23/src/common/l1ctl.c
index 0b25008e9..945200733 100644
--- a/src/host/layer23/src/common/l1ctl.c
+++ b/src/host/layer23/src/common/l1ctl.c
@@ -405,8 +405,8 @@ int l1ctl_tx_crypto_req(struct osmocom_ms *ms, uint8_t algo, uint8_t *key,
 }
 
 /* Transmit L1CTL_RACH_REQ */
-int l1ctl_tx_rach_req(struct osmocom_ms *ms, uint8_t ra, uint8_t fn51,
-	uint8_t mf_off)
+int l1ctl_tx_rach_req(struct osmocom_ms *ms, uint8_t ra, uint16_t offset,
+	uint8_t combined)
 {
 	struct msgb *msg;
 	struct l1ctl_info_ul *ul;
@@ -416,12 +416,12 @@ int l1ctl_tx_rach_req(struct osmocom_ms *ms, uint8_t ra, uint8_t fn51,
 	if (!msg)
 		return -1;
 
-	DEBUGP(DL1C, "RACH Req. fn51=%d, mf_off=%d\n", fn51, mf_off);
+	DEBUGP(DL1C, "RACH Req. offset=%d combined=%d\n", offset, combined);
 	ul = (struct l1ctl_info_ul *) msgb_put(msg, sizeof(*ul));
 	req = (struct l1ctl_rach_req *) msgb_put(msg, sizeof(*req));
 	req->ra = ra;
-	req->fn51 = fn51;
-	req->mf_off = mf_off;
+	req->offset = htons(offset);
+	req->combined = combined;
 
 	return osmo_send_l1(ms, msg);
 }
diff --git a/src/host/layer23/src/common/lapdm.c b/src/host/layer23/src/common/lapdm.c
index 80020798a..dc9c9165b 100644
--- a/src/host/layer23/src/common/lapdm.c
+++ b/src/host/layer23/src/common/lapdm.c
@@ -2052,7 +2052,8 @@ static int rslms_rx_chan_rqd(struct osmocom_ms *ms, struct msgb *msg)
 	/* TA = 0 - delay */
 	rc = l1ctl_tx_param_req(ms, 0 - cch->data[5], cch->data[7]);
 
-	rc = l1ctl_tx_rach_req(ms, cch->data[1], cch->data[2], cch->data[3]);
+	rc = l1ctl_tx_rach_req(ms, cch->data[1],
+		((cch->data[2] & 0x7f) << 8) | cch->data[3], cch->data[2] >> 7);
 
 	msgb_free(msg);
 
diff --git a/src/host/layer23/src/misc/cell_log.c b/src/host/layer23/src/misc/cell_log.c
index c5d7c194f..e6c5771b8 100644
--- a/src/host/layer23/src/misc/cell_log.c
+++ b/src/host/layer23/src/misc/cell_log.c
@@ -287,9 +287,8 @@ static void start_rach(void)
 	ncch->chan_nr = RSL_CHAN_RACH;
 	ncch->data[0] = RSL_IE_REQ_REFERENCE;
 	ncch->data[1] = rach_ref.cr;
-#warning HACK: fn51 and fn_off
-	ncch->data[2] = (s->ccch_conf == 1) ? 27 : 50;
-	ncch->data[3] = 1; /* next frame */
+	ncch->data[2] = (s->ccch_conf == 1) << 7;
+	ncch->data[3] = 0;
 	ncch->data[4] = RSL_IE_ACCESS_DELAY;
 	ncch->data[5] = 0; /* no delay */ 
 	ncch->data[6] = RSL_IE_MS_POWER;
diff --git a/src/host/layer23/src/misc/layer3.c b/src/host/layer23/src/misc/layer3.c
index 6a6cbeca4..936623f37 100644
--- a/src/host/layer23/src/misc/layer3.c
+++ b/src/host/layer23/src/misc/layer3.c
@@ -287,8 +287,8 @@ int gsm48_rx_bcch(struct msgb *msg, struct osmocom_ms *ms)
 
 	/* Req channel logic */
 	if (app_state.ccch_enabled && (app_state.rach_count < 2)) {
-		l1ctl_tx_rach_req(ms, app_state.rach_count,
-			app_state.ccch_mode == CCCH_MODE_COMBINED ? 27 : 51, 0);
+		l1ctl_tx_rach_req(ms, app_state.rach_count, 0,
+			app_state.ccch_mode == CCCH_MODE_COMBINED);
 		app_state.rach_count++;
 	}
 
diff --git a/src/host/layer23/src/mobile/gsm48_rr.c b/src/host/layer23/src/mobile/gsm48_rr.c
index 65fc05f30..6c38e8f14 100644
--- a/src/host/layer23/src/mobile/gsm48_rr.c
+++ b/src/host/layer23/src/mobile/gsm48_rr.c
@@ -1508,6 +1508,8 @@ fail:
 		"S(lots) %d ra 0x%02x)\n", s->tx_integer,
 		(s->ccch_conf == 1) ? "yes": "no", slots, chan_req);
 
+	slots = (random() % s->tx_integer) + slots;
+
 	/* (re)send CHANNEL RQD with new randiom */
 	nmsg = gsm48_rsl_msgb_alloc();
 	if (!nmsg)
@@ -1518,9 +1520,8 @@ fail:
 	ncch->chan_nr = RSL_CHAN_RACH;
 	ncch->data[0] = RSL_IE_REQ_REFERENCE;
 	ncch->data[1] = chan_req;
-#warning HACK: fn51 and fn_off
-	ncch->data[2] = (s->ccch_conf == 1) ? 27 : 50;
-	ncch->data[3] = 1 + ((random() % s->tx_integer) + slots) / 51;
+	ncch->data[2] = (slots >> 8) | ((s->ccch_conf == 1) << 7);
+	ncch->data[3] = slots;
 	ncch->data[4] = RSL_IE_ACCESS_DELAY;
 	ncch->data[5] = set->alter_delay; /* (-)=earlier (+)=later */
 	ncch->data[6] = RSL_IE_MS_POWER;