Hi,
In wireshark trace (from OpenBTS, attached) I see that MS sends LURequest (packet 359) and BTS responds with LUAccept (packet 440) but MS never receive this message because of error.
Can you send a gsmtap trace from the mobile side as well ? (using the -i 127.0.0.1 option).
Cheers,
Sylvain