Hi Harald,
If you have a better understanding of them and can propose a fix, I'm happy to simply test and merge that, rather than again diving into this topic and wasting more than the days I have already put into it :(
I don't have a deep understanding of the spec but all the state description and diagram I saw indicated that once you have the RP-ACK, it's over: nothing else to do, so freeing the transaction there makes sense.
It's the patch I sent on the list a few days ago, along with the encryption fixes (4 patches submitted for merging in total). And it works with my setup (nanoBTS + tested 3 phones iPhone & cheap nokia & old T610).
Sylvain