diff -Nur openbsc.new/src/gsm_04_08.c openbsc.newer/src/gsm_04_08.c
--- openbsc.new/src/gsm_04_08.c	2009-05-23 09:54:35.000000000 +0200
+++ openbsc.newer/src/gsm_04_08.c	2009-05-23 19:29:47.000000000 +0200
@@ -1654,7 +1656,7 @@
 		rel.callref = trans->callref;
 		rel.cause = 1;
 		rel.cause_location = 1;
-		rel.cause_value = 47;
+		rel.cause_value = 47; /* Ressource unavailable */
 		mncc_recvmsg(trans->network, trans, MNCC_REL_IND, &rel);
 	}
 
@@ -1685,15 +1687,19 @@
 	struct gsm_lchan *lchan = _lchan;
 	struct gsm_subscriber *subscr = param;
 	struct gsm_trans *transt, *tmp;
-	struct gsm_network *net = bts->network;
+	struct gsm_network *net;
 	struct gsm_mncc rel;
 
 	if (hooknum != GSM_HOOK_RR_PAGING)
 		return -EINVAL;
 
-	/* check all tranactions for subscriber */
+	if (!subscr || !subscr->current_bts)
+		return -EINVAL;
+	net = subscr->current_bts->network;
+
+	/* check all tranactions (without lchan) for subscriber */
 	llist_for_each_entry_safe(transt, tmp, &net->trans_list, entry) {
-		if (transt->subscr == subscr) {
+		if (transt->subscr == subscr && !transt->lchan) {
 			switch (event) {
 			case GSM_PAGING_SUCCEEDED:
 				if (!lchan) // paranoid
@@ -1721,7 +1727,7 @@
 				rel.callref = transt->callref;
 				rel.cause = 1;
 				rel.cause_location = 1;
-				rel.cause_value = 27;
+				rel.cause_value = 27; /* Temporarily out of order */
 				mncc_recvmsg(transt->network, transt, MNCC_REL_IND, &rel);
 				transt->callref = 0;
 				free_trans(transt);
@@ -2039,7 +2045,7 @@
 		rel.callref = trans->callref;
 		rel.cause = 1;
 		rel.cause_location = 1;
-		rel.cause_value = 47;
+		rel.cause_value = 47; /* Temporarily out of order */
 		rc = mncc_recvmsg(trans->network, trans, MNCC_REL_IND, &rel);
 		trans->callref = 0;
 		free_trans(trans);
@@ -2059,7 +2065,7 @@
 		rel.callref = trans->callref;
 		rel.cause = 1;
 		rel.cause_location = 1;
-		rel.cause_value = 47;
+		rel.cause_value = 47; /* Temporarily out of order */
 		rc = mncc_recvmsg(trans->network, trans, MNCC_REL_IND, &rel);
 		trans->callref = 0;
 		free_trans(trans);
@@ -3374,19 +3380,29 @@
 					get_mncc_name(msg_type), data->callref);
 			rel.cause = 1;
 			rel.cause_location = 1;
-			rel.cause_value = 81;
+			rel.cause_value = 81; /* Invalid call reference */
 			return mncc_recvmsg(net, NULL, MNCC_REL_IND, &rel);
 		}
 		/* New transaction due to setup, find subscriber */
 		subscr = subscr_get_by_extension(data->called_number);
-		/* if subscriber is not found */
+		/* If subscriber is not found */
 		if (!subscr) {
 			DEBUGP(DCC, "(bts - trx - ts - ti -- sub %s) Received '%s' from MNCC with "
 					"unknown subscriber %s\n", data->called_number,
 					get_mncc_name(msg_type), data->called_number);
 			rel.cause = 1;
 			rel.cause_location = 1;
-			rel.cause_value = 1;
+			rel.cause_value = 1; /* Unknown subscriber */
+			return mncc_recvmsg(net, NULL, MNCC_REL_IND, &rel);
+		}
+		/* If subscriber is not "attached" */
+		if (!subscr->lac) {
+			DEBUGP(DCC, "(bts - trx - ts - ti -- sub %s) Received '%s' from MNCC with "
+					"detached subscriber %s\n", data->called_number,
+					get_mncc_name(msg_type), data->called_number);
+			rel.cause = 1;
+			rel.cause_location = 1;
+			rel.cause_value = 27; /* Temporarily out of order */
 			return mncc_recvmsg(net, NULL, MNCC_REL_IND, &rel);
 		}
 		/* Create transaction */
@@ -3395,7 +3411,7 @@
 			subscr_put(subscr);
 			rel.cause = 1;
 			rel.cause_location = 1;
-			rel.cause_value = 47;
+			rel.cause_value = 47; /* Ressource unavailable */
 			mncc_recvmsg(net, NULL, MNCC_REL_IND, &rel);
 			return -ENOMEM;
 		}
@@ -3435,16 +3451,23 @@
 					return 0;
 				}
 			}
-			/* page subscriber */
-			bts = &net->bts[0]; // TODO: get bts from subscr
-			DEBUGP(DCC, "(bts %d trx - ts - ti -- sub %s) Received '%s' from MNCC with "
-					"unallocated channel, paging.\n", bts->nr, data->called_number,
-					get_mncc_name(msg_type));
 			/* store setup informations until paging was successfull */
 			memcpy(&trans->cc_msg, data, sizeof(struct gsm_mncc));
-			/* start paging of the receiving end of the call */
-			paging_request(bts, subscr, RSL_CHANNEED_TCH_F,
+			/* start paging subscriber on all BTS with her location */
+			bts = NULL;
+			do {
+				bts = gsm_bts_by_lac(net, subscr->lac, bts);
+				if (!bts)
+					break;
+				DEBUGP(DCC, "(bts %d trx - ts - ti -- sub %s) Received '%s' from MNCC with "
+					"unallocated channel, paging.\n", bts->nr, data->called_number,
+					get_mncc_name(msg_type));
+				/* Store BTS pointer */
+				subscr->current_bts = bts;
+				/* Trigger paging */
+				paging_request(bts, subscr, RSL_CHANNEED_TCH_F,
 					setup_trig_pag_evt, subscr);
+			} while (1);
 			return 0;
 		}
 		/* Assign lchan */
@@ -3461,7 +3484,7 @@
 				get_mncc_name(msg_type));
 		rel.cause = 1;
 		rel.cause_location = 1;
-		rel.cause_value = 16;
+		rel.cause_value = 16; /* Normal call clearing */
 		if (msg_type == MNCC_REL_REQ)
 			rc = mncc_recvmsg(net, trans, MNCC_REL_CNF, &rel);
 		else
