diff --git a/sgsn/SGSN_Tests.ttcn b/sgsn/SGSN_Tests.ttcn
index a89a949dc..f07042934 100644
--- a/sgsn/SGSN_Tests.ttcn
+++ b/sgsn/SGSN_Tests.ttcn
@@ -1070,7 +1070,7 @@ private function f_TC_rau_unknown(charstring id) runs on BSSGP_ConnHdlr {
 
 	f_send_l3(ts_GMM_RAU_REQ(f_mi_get_lv(), GPRS_UPD_T_RA, old_ra, false, omit, omit));
 	alt {
-	[] BSSGP[0].receive(tr_GMM_RAU_REJECT('0a'O)) {
+	[] BSSGP[0].receive(tr_GMM_RAU_REJECT('0a'O)) { /* gmm cause: implicitly detached */
 		setverdict(pass);
 		}
 	/* FIXME: Expect XID RESET? */
@@ -2814,6 +2814,42 @@ testcase TC_attach_pdp_act_gmm_detach() runs on test_CT {
 	f_cleanup();
 }
 
+private function f_TC_attach_req_id_req_ra_update(charstring id) runs on BSSGP_ConnHdlr {
+	var RoutingAreaIdentificationV old_ra := f_random_RAI();
+	var RoutingAreaIdentificationV new_ra := f_random_RAI();
+	while (old_ra == new_ra) { new_ra := f_random_RAI(); };
+	var template PDU_L3_MS_SGSN attach_req := ts_GMM_ATTACH_REQ(f_mi_get_lv(), old_ra, false, false, omit, omit);
+	var PDU_L3_SGSN_MS l3_mt;
+
+	f_send_l3(attach_req, 0);
+
+	BSSGP[0].receive(tr_GMM_ID_REQ(?));
+
+	f_send_l3(ts_GMM_RAU_REQ(f_mi_get_lv(), GPRS_UPD_T_RA, new_ra, false, omit, omit));
+	alt {
+	[] BSSGP[0].receive(tr_GMM_RAU_REJECT('0a'O)) {
+		setverdict(pass);
+		}
+	[] BSSGP[0].receive { repeat; }
+	}
+}
+
+/* This test triggers crash in osmo-sgsn before osmo-sgsn.git I64fa5cf1b427d3abb99e553e584897261a827ce6.
+ * See OS#3957 and OS#4245 for more information.
+ */
+testcase TC_attach_req_id_req_ra_update() runs on test_CT {
+	/*
+	 * MS --> SGSN: Attach Req (TMSI, RAI=901-70-356-101)
+	 * MS <-- SGSN: Identity Request (IMEI)
+	 * MS --> SGSN: RA Updating (RAI=901-70-2758-208)
+	 */
+	var BSSGP_ConnHdlr vc_conn;
+	f_init();
+	vc_conn := f_start_handler(refers(f_TC_attach_req_id_req_ra_update), testcasename(), g_gb, 47);
+	vc_conn.done;
+	f_cleanup();
+}
+
 control {
 	execute( TC_attach() );
 	execute( TC_attach_mnc3() );
@@ -2870,6 +2906,9 @@ control {
 	execute( TC_llc_null() );
 	execute( TC_llc_sabm_dm_llgmm() );
 	execute( TC_llc_sabm_dm_ll5() );
+
+	/* At the end, may crash osmo-sgsn, see OS#3957, OS#4245 */
+	execute( TC_attach_req_id_req_ra_update() );
 }
 
 
diff --git a/sgsn/expected-results.xml b/sgsn/expected-results.xml
index fc8856a7d..838106471 100644
--- a/sgsn/expected-results.xml
+++ b/sgsn/expected-results.xml
@@ -62,4 +62,5 @@
   <testcase classname='SGSN_Tests' name='TC_attach_pdp_act_deact_gtp_retrans_resp' time='MASKED'/>
   <testcase classname='SGSN_Tests' name='TC_attach_pdp_act_user_error_ind_ggsn' time='MASKED'/>
   <testcase classname='SGSN_Tests' name='TC_attach_gmm_attach_req_while_gmm_attach' time='MASKED'/>
+  <testcase classname='SGSN_Tests' name='TC_attach_req_id_req_ra_update' time='MASKED'/>
 </testsuite>