Can’t you steal one frequency, for few minutes ? Nobody would know… 🙂
IMO, the problem clearly comes from the MS : it doesn’t send the SABM on the SDCCH channel !
SABM is a layer 2 message ! could you check the layer 2 window in your drive test, and check if MS did send the SABM on the SDCCH channel or not ?