Security mode command in LTE

Question

In LTE, when a new security mode comes at NAS, when does the overflow and count get reset ? (Any spec ref please).

In the log, the scenario is that, when the new security mode is sent with SN=0, but Overflow=1 (i.e after sending the previous one with SN=256), the new one gets rejected. The UE is sending the Security Mode Reject.
But if we reset the overflow, the UE accepts the Security Mode Command.

Does anybody know special case when the Overflow is reset ? (any spec ref is helpful)

Currently the SecMode Reject is being sent, I think it may be because the overflow is not reset. Trying to debug this, as I have not much worked on this are earlier. (I had worked on 3G security, i remember we need to reset the count, on receipt of new keys)

Comments

The first security mode command is :
                            ProtocolIE-Field
                                id: id-NAS-PDU (26)
                                criticality: reject (0)
                                value
                                    NAS-PDU: 370d0071a4ff075d010605f070c04070
                                    Non-Access-Stratum (NAS)PDU
                                        0011 .... = Security header type: Integrity protected with new EPS security context (3)
                                        .... 0111 = Protocol discriminator: EPS mobility management messages (0x7)
                                        Message authentication code: 0x0d0071a4
                                        Sequence number: 255
                                        0000 .... = Security header type: Plain NAS message, not security protected (0)
                                        .... 0111 = Protocol discriminator: EPS mobility management messages (0x7)
                                        NAS EPS Mobility Management Message Type: Security mode command (0x5d)
                                        NAS security algorithms - Selected NAS security algorithms
                                            0... .... = Spare bit(s): 0x00
                                            .000 .... = Type of ciphering algorithm: EPS encryption algorithm EEA0 (null ciphering algorithm) (0)
                                            .... 0... = Spare bit(s): 0x00
                                            .... .001 = Type of integrity protection algorithm: EPS integrity algorithm 128-EIA1 (1)
                                        0000 .... = Spare half octet: 0
                                        .... 0... = Type of security context flag (TSC): Native security context (for KSIasme)
                                        .... .110 = NAS key set identifier:  (6) ASME
                                        UE security capability - Replayed UE security capabilities

The second one is :
                            ProtocolIE-Field
                                id: id-NAS-PDU (26)
                                criticality: reject (0)
                                value
                                    NAS-PDU: 370d0071a4ff075d010605f070c04070
                                    Non-Access-Stratum (NAS)PDU
                                        0011 .... = Security header type: Integrity protected with new EPS security context (3)
                                        .... 0111 = Protocol discriminator: EPS mobility management messages (0x7)
                                        Message authentication code: 0x0d0071a4
                                        Sequence number: 255
                                        0000 .... = Security header type: Plain NAS message, not security protected (0)
                                        .... 0111 = Protocol discriminator: EPS mobility management messages (0x7)
                                        NAS EPS Mobility Management Message Type: Security mode command (0x5d)
                                        NAS security algorithms - Selected NAS security algorithms
                                            0... .... = Spare bit(s): 0x00
                                            .000 .... = Type of ciphering algorithm: EPS encryption algorithm EEA0 (null ciphering algorithm) (0)
                                            .... 0... = Spare bit(s): 0x00
                                            .... .001 = Type of integrity protection algorithm: EPS integrity algorithm 128-EIA1 (1)
                                        0000 .... = Spare half octet: 0
                                        .... 0... = Type of security context flag (TSC): Native security context (for KSIasme)
                                        .... .110 = NAS key set identifier:  (6) ASME
                                        UE security capability - Replayed UE security capabilities

---

I think I was told UE is still in idle mode. But in the logs, I can see that the "Ue context Release Req" after the 1st security mode procedure. Does the "Ue context release Req" trigger the reset of Security context ? (I guess so)