diff --git a/hnbgw/HNBGW_Tests.ttcn b/hnbgw/HNBGW_Tests.ttcn
index 505beabad..adb32bd2b 100644
--- a/hnbgw/HNBGW_Tests.ttcn
+++ b/hnbgw/HNBGW_Tests.ttcn
@@ -2596,6 +2596,73 @@ testcase TC_apply_sccp() runs on test_CT
 	f_shutdown_helper();
 }
 
+/* In the field, we encountered a "normal" RAB Assignment that concludes successfully, followed by another RAB
+ * Assignment that has different SDU subflow parameters, and does not contain RTP information. At the time of writing,
+ * it seems that the second RAB Assignment causes a crash. Play through this scenario. */
+friend function f_tc_second_rab_assignment(charstring id, TestHdlrParams pars) runs on ConnHdlr {
+	var MgcpCommand mgcp_cmd;
+	var RANAP_PDU tx;
+	timer T := 5.0;
+
+	f_init_handler(pars);
+	f_create_mgcp_expect(ExpectCriteria:{omit,omit,omit});
+
+	tx := f_build_initial_ue(g_pars);
+	f_iuh2iu_connect(tx);
+
+	f_create_rab(pars.mgcp_pars);
+
+	/* Now send a second RAB Assignment with different subflows and omitting transportLayerInformation. (Assuming
+	 * the first RAB Assignment's transportLayerInformation remains in use unchanged.) */
+	var template RAB_SetupOrModifyList rab_sml;
+	rab_sml := ts_RAB_SML2(t_RAB_id(23),
+			       ts_RabParams,
+			       user_plane_info := omit,
+			       transport_layer_info := omit);
+	tx := valueof(ts_RANAP_RabAssReq(rab_sml));
+	BSSAP.send(tx);
+	T.start;
+
+	/* Expect this secondary RAB Assignment to go through unchanged. */
+	f_rua_expect(tx);
+
+	/* I'm guessing that the RAB Assignment Response also omits transportLayerInformation, so far not known because
+	 * osmo-hnbgw crashed before we could receive the response. */
+
+	/* Send back RAB Assignment Response via Iuh */
+	var template RAB_SetupOrModifiedList rab_smdl;
+	rab_smdl := ts_RAB_SMdL_no_tla(t_RAB_id(23));
+	tx := valueof(ts_RANAP_RabAssResp(rab_smdl));
+	RUA.send(tx);
+	f_bssap_expect(tx);
+
+	/* Send Iu Release */
+	tx := valueof(ts_RANAP_IuReleaseCommand(ts_RanapCause_om_intervention));
+	f_iu2iuh(tx);
+
+	T.start;
+	alt {
+	[] as_mgcp_dlcx(pars) {}
+	[] T.timeout {
+		setverdict(fail, "Timeout waiting for DLCX");
+	}
+	}
+
+	tx := valueof(ts_RANAP_IuReleaseComplete());
+	f_iuh2iu(tx);
+}
+
+testcase TC_second_rab_assignment() runs on test_CT {
+	var ConnHdlr vc_conn;
+	g_num_hnbs := 1;
+	f_init();
+
+	vc_conn := f_start_handler_with_pars(refers(f_tc_second_rab_assignment), t_pars(3));
+	vc_conn.done;
+
+	f_shutdown_helper();
+}
+
 control {
 	execute(TC_hnb_register());
 	execute(TC_hnb_register_duplicate());
@@ -2643,6 +2710,8 @@ control {
 	execute( TC_sgsnpool_sccp_n_pcstate_detaches_cnlink() );
 	execute( TC_sgsnpool_sccp_n_pcstate_attaches_cnlink() );
 
+	execute(TC_second_rab_assignment());
+
 	/* Run at the end since it makes osmo-hnbgw <= 1.3.0 crash: OS#5676 */
 	execute(TC_hnb_reregister_reuse_sctp_assoc());
 
diff --git a/library/ranap/RANAP_Templates.ttcn b/library/ranap/RANAP_Templates.ttcn
index 051195fee..018cb8161 100644
--- a/library/ranap/RANAP_Templates.ttcn
+++ b/library/ranap/RANAP_Templates.ttcn
@@ -1331,6 +1331,42 @@ template RAB_SetupOrModifyList tr_RAB_SML(template (present) RAB_ID rab_id,
 	}
 } }
 
+/* Like ts_RAB_SML(), but more control on presence/absence of individual IEs */
+template (value) RAB_SetupOrModifyList ts_RAB_SML2(
+		template (value) RAB_ID rab_id,
+		template (omit) RAB_Parameters rab_params,
+		template (omit) UserPlaneInformation user_plane_info,
+		template (omit) TransportLayerInformation transport_layer_info
+	) := { {
+	{
+		id := id_RAB_SetupOrModifyItem,
+		firstCriticality := reject,
+		firstValue := {
+			rAB_SetupOrModifyItemFirst := {
+				rAB_ID := rab_id,
+				nAS_SynchronisationIndicator := omit,
+				rAB_Parameters := rab_params,
+				userPlaneInformation := user_plane_info,
+				transportLayerInformation := transport_layer_info,
+				service_Handover := omit,
+				iE_Extensions := omit
+			}
+		},
+		secondCriticality := ignore,
+		secondValue := {
+			rAB_SetupOrModifyItemSecond := {
+				pDP_TypeInformation := omit,
+				dataVolumeReportingIndication := omit,
+				dl_GTP_PDU_SequenceNumber := omit,
+				ul_GTP_PDU_SequenceNumber := omit,
+				dl_N_PDU_SequenceNumber := omit,
+				ul_N_PDU_SequenceNumber := omit,
+				iE_Extensions := omit
+			}
+		}
+	}
+} }
+
 template (value) TransportLayerInformation ts_TLI_ps(template (value) TransportLayerAddress tla,
 						     template (value) GTP_TEI gtp_tei) := {
 	transportLayerAddress := tla,
@@ -1431,6 +1467,22 @@ template (value) RAB_SetupOrModifiedList ts_RAB_SMdL(template (value) RAB_ID rab
 	}
 } }
 
+template (value) RAB_SetupOrModifiedList ts_RAB_SMdL_no_tla(template (value) RAB_ID rab_id) := { {
+	{
+		id := id_RAB_SetupOrModifiedItem,
+		criticality := ignore,
+		value_ := {
+			rAB_SetupOrModifiedItem := {
+				rAB_ID := rab_id,
+				transportLayerAddress := omit,
+				iuTransportAssociation := omit,
+				dl_dataVolumes := omit,
+				iE_Extensions := omit
+			}
+		}
+	}
+} }
+
 template (value) RAB_SetupOrModifiedList ts_RAB_SMdL_ps(template (value) RAB_ID rab_id,
 							template (value) TransportLayerAddress tla,
 							template (value) GTP_TEI gtp_tei) := { {