diff --git a/msc/BSC_ConnectionHandler.ttcn b/msc/BSC_ConnectionHandler.ttcn
index cd1a114d3..1ce0b6976 100644
--- a/msc/BSC_ConnectionHandler.ttcn
+++ b/msc/BSC_ConnectionHandler.ttcn
@@ -642,13 +642,13 @@ function f_accept_reject_lu() runs on BSC_ConnHdlr {
 	setverdict(pass);
 }
 
-function f_expect_lu_reject() runs on BSC_ConnHdlr {
+function f_expect_lu_reject(template OCT1 cause := ?) runs on BSC_ConnHdlr {
 	var PDU_DTAP_MT dtap_mt;
 	timer T := 5.0;
 
 	T.start;
 	alt {
-	[] BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_LU_Rej)) {
+	[] BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_LU_Rej(cause))) {
 		setverdict(pass);
 		}
 	[] BSSAP.receive(tr_PDU_DTAP_MT(?)) -> value dtap_mt {
diff --git a/msc/MSC_Tests.ttcn b/msc/MSC_Tests.ttcn
index e2728d321..05d0ef6ef 100644
--- a/msc/MSC_Tests.ttcn
+++ b/msc/MSC_Tests.ttcn
@@ -561,6 +561,61 @@ testcase TC_lu_imsi_auth3g_tmsi() runs on MTC_CT {
 	vc_conn.done;
 }
 
+/* Proceed with LU but never receive an TMSI Realloc from MS after LU Accept (OS#4337).
+ * TS 24.008 sec 4.3.1.5 states MSC should simply release all MM connections.
+ */
+friend function f_tc_lu_imsi_timeout_tmsi_realloc(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr {
+
+	f_init_handler(pars);
+
+	var PDU_ML3_MS_NW l3_lu := f_build_lu_imsi(g_pars.imsi);
+	var PDU_DTAP_MT dtap_mt;
+
+	/* tell GSUP dispatcher to send this IMSI to us */
+	f_create_gsup_expect(hex2str(g_pars.imsi));
+
+	/* Send BSSAP_Conn_Req with COMPL L3 INFO to MSC */
+	if (g_pars.ran_is_geran) {
+		f_bssap_compl_l3(l3_lu);
+		if (g_pars.send_early_cm) {
+			BSSAP.send(ts_BSSMAP_ClassmarkUpd(g_pars.cm2, g_pars.cm3));
+		}
+	} else {
+		f_ranap_initial_ue(l3_lu);
+	}
+
+	f_mm_imei_early();
+	f_mm_common();
+	f_msc_lu_hlr();
+	f_mm_imei();
+
+	alt {
+	[] BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_LU_Acc)) -> value dtap_mt {}
+	[] BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_LU_Rej)) {
+		setverdict(fail, "Expected LU ACK, but received LU REJ");
+		mtc.stop;
+		}
+	}
+
+	/* currently (due to bug OS#4337), an extra LU reject is received before
+	   terminating the connection. Enabling following line makes the test
+	   pass: */
+	//f_expect_lu_reject('16'O); /* Cause: congestion */
+
+	/* f_expect_lu_reject() already waits for T"-1" (X1, 5 seconds), but give some
+	   extra time to avoid race conditons... */
+	f_expect_clear(7.0);
+
+	setverdict(pass);
+}
+testcase TC_lu_imsi_timeout_tmsi_realloc() runs on MTC_CT {
+	var BSC_ConnHdlr vc_conn;
+	f_init();
+
+	vc_conn := f_start_handler(refers(f_tc_lu_imsi_timeout_tmsi_realloc), 5);
+	vc_conn.done;
+}
+
 
 /* Send CM SERVICE REQ for IMSI that has never performed LU before */
 friend function f_tc_cmserv_imsi_unknown(charstring id, BSC_ConnHdlrPars pars)
@@ -5719,6 +5774,7 @@ control {
 	execute( TC_lu_imsi_timeout_gsup() );
 	execute( TC_lu_imsi_auth_tmsi() );
 	execute( TC_lu_imsi_auth3g_tmsi() );
+	execute( TC_lu_imsi_timeout_tmsi_realloc() );
 	execute( TC_cmserv_imsi_unknown() );
 	execute( TC_lu_and_mo_call() );
 	execute( TC_lu_auth_sai_timeout() );
diff --git a/msc/MSC_Tests_Iu.ttcn b/msc/MSC_Tests_Iu.ttcn
index 9ea0c762f..b80005e81 100644
--- a/msc/MSC_Tests_Iu.ttcn
+++ b/msc/MSC_Tests_Iu.ttcn
@@ -56,6 +56,15 @@ testcase TC_iu_lu_imsi_auth3g_tmsi() runs on MTC_CT {
 	vc_conn.done;
 }
 
+testcase TC_iu_lu_imsi_timeout_tmsi_realloc() runs on MTC_CT {
+	var BSC_ConnHdlr vc_conn;
+	f_init(3);
+	f_vty_config(MSCVTY, "network", "authentication required");
+
+	vc_conn := f_start_handler(refers(f_tc_lu_imsi_timeout_tmsi_realloc), 1005, ran_idx := 2, ran_is_geran := false);
+	vc_conn.done;
+}
+
 testcase TC_iu_cmserv_imsi_unknown() runs on MTC_CT {
 	var BSC_ConnHdlr vc_conn;
 	f_init(3);
@@ -424,6 +433,7 @@ control {
 	execute( TC_iu_lu_imsi_reject() );
 	execute( TC_iu_lu_imsi_timeout_gsup() );
 	execute( TC_iu_lu_imsi_auth3g_tmsi() );
+	execute( TC_iu_lu_imsi_timeout_tmsi_realloc() );
 	execute( TC_iu_cmserv_imsi_unknown() );
 	execute( TC_iu_lu_and_mo_call() );
 	execute( TC_iu_lu_auth_sai_timeout() );
diff --git a/msc/expected-results.xml b/msc/expected-results.xml
index 96af4a4e5..f94c781b2 100644
--- a/msc/expected-results.xml
+++ b/msc/expected-results.xml
@@ -7,6 +7,11 @@
   <testcase classname='MSC_Tests' name='TC_lu_imsi_timeout_gsup' time='MASKED'/>
   <testcase classname='MSC_Tests' name='TC_lu_imsi_auth_tmsi' time='MASKED'/>
   <testcase classname='MSC_Tests' name='TC_lu_imsi_auth3g_tmsi' time='MASKED'/>
+  <testcase classname='MSC_Tests' name='TC_lu_imsi_timeout_tmsi_realloc' time='MASKED'>
+    <failure type='fail-verdict'>Timeout waiting for ClearCommand/Release
+      MSC_Tests.ttcn:MASKED TC_lu_imsi_timeout_tmsi_realloc testcase
+    </failure>
+  </testcase>
   <testcase classname='MSC_Tests' name='TC_cmserv_imsi_unknown' time='MASKED'/>
   <testcase classname='MSC_Tests' name='TC_lu_and_mo_call' time='MASKED'/>
   <testcase classname='MSC_Tests' name='TC_lu_auth_sai_timeout' time='MASKED'/>
@@ -126,6 +131,11 @@
     </failure>
   </testcase>
   <testcase classname='MSC_Tests_Iu' name='TC_iu_lu_imsi_auth3g_tmsi' time='MASKED'/>
+  <testcase classname='MSC_Tests_Iu' name='TC_iu_lu_imsi_timeout_tmsi_realloc' time='MASKED'>
+    <failure type='fail-verdict'>Timeout waiting for ClearCommand/Release
+      MSC_Tests_Iu.ttcn:MASKED TC_iu_lu_imsi_timeout_tmsi_realloc testcase
+    </failure>
+  </testcase>
   <testcase classname='MSC_Tests_Iu' name='TC_iu_cmserv_imsi_unknown' time='MASKED'>
     <failure type='fail-verdict'>Tguard timeout
       MSC_Tests_Iu.ttcn:MASKED MSC_Tests_Iu control part