diff --git a/src/tbf.cpp b/src/tbf.cpp
index 5987754..42d522b 100644
--- a/src/tbf.cpp
+++ b/src/tbf.cpp
@@ -986,6 +986,8 @@ int gprs_rlcmac_tbf::extract_tlli(const uint8_t *data, const size_t len)
 	}
 
 	old_ms = bts->ms_by_tlli(new_tlli);
+	/* Keep the old MS object for the update_ms() */
+	GprsMs::Guard guard(old_ms);
 	if (old_ms) {
 		/* Get them before calling set_ms() */
 		dl_tbf = old_ms->dl_tbf();
@@ -996,7 +998,7 @@ int gprs_rlcmac_tbf::extract_tlli(const uint8_t *data, const size_t len)
 
 		/* there might be an active and valid downlink TBF */
 		if (!ms()->dl_tbf() && dl_tbf)
-			/* Move it to the current MS */
+			/* Move it to the current MS (see the guard above) */
 			dl_tbf->set_ms(ms());
 	}
 
diff --git a/tests/tbf/TbfTest.cpp b/tests/tbf/TbfTest.cpp
index 3c3e91f..2af7e3a 100644
--- a/tests/tbf/TbfTest.cpp
+++ b/tests/tbf/TbfTest.cpp
@@ -900,7 +900,7 @@ static void test_tbf_dl_flow_and_rach_two_phase()
 	/* OSMO_ASSERT(ms->dl_tbf() == dl_tbf); */
 
 	/* No queued packets should be lost */
-	/* OSMO_ASSERT(ms->llc_queue()->size() == 2); */
+	OSMO_ASSERT(ms->llc_queue()->size() == 2);
 
 	printf("=== end %s ===\n", __func__);
 }
@@ -961,7 +961,7 @@ static void test_tbf_dl_flow_and_rach_single_phase()
 	OSMO_ASSERT(ms->dl_tbf() == dl_tbf);
 
 	/* No queued packets should be lost */
-	/* OSMO_ASSERT(ms->llc_queue()->size() == 2); */
+	OSMO_ASSERT(ms->llc_queue()->size() == 2);
 
 	printf("=== end %s ===\n", __func__);
 }