asterisk users - Nov 2003 - SIP nat not working with budgetone (long)

I've been looking at how our budgetone's have been failing and have
found the following:

A quick layout -- 
Latest CVS as of tonight. 
Sip phone behind NAT. 
* server with public IP address.

-------from sip.conf for my phone:
[1747xxxxxxx]
username=xxxxx
secret=xxxxx
host=dynamic
type=friend
nat=yes
-------

-------from the * log messages 
Nov  6 01:50:07 DEBUG[4101]: File chan_sip.c, Line 3908 (check_user): Setting
NAT on RTP to -1
Nov  6 01:50:07 DEBUG[4101]: File chan_sip.c, Line 559 (__sip_ack): Stopping
retransmission on '93161d54-1d74-7515-1fba-b6c8db18e466@192.168.0.100'
of Response 32119: Found
Nov  6 01:50:07 DEBUG[4101]: File chan_sip.c, Line 3908 (check_user): Setting
NAT on RTP to -1
Nov  6 01:50:07 DEBUG[4101]: File chan_sip.c, Line 4962 (handle_request): Check
for res for 1747xxxxxx
Nov  6 01:50:07 DEBUG[4101]: File chan_sip.c, Line 985 (find_user): Call from
user '1747xxxxxxx' is 1 out of 0
Nov  6 01:50:07 DEBUG[4101]: File chan_sip.c, Line 3355 (build_route):
build_route: Contact hop: <sip:1747xxxxxxx@192.168.0.100:51332>
Nov  6 01:50:14 WARNING[4101]: File chan_sip.c, Line 456 (retrans_pkt): Maximum
retries exceeded on call 93161d54-1d74-7515-1fba-b6c8db18e466@192.168.0.100 for
seqno 32120 (Response)
Nov  6 01:50:14 DEBUG[9226]: File chan_sip.c, Line 1062 (sip_hangup):
find_user(xxxxx) - decrement inUse counter
Nov  6 01:50:14 DEBUG[4101]: File chan_sip.c, Line 559 (__sip_ack): Stopping
retransmission on '93161d54-1d74-7515-1fba-b6c8db18e466@192.168.0.100'
of Request 102: Found
Nov  6 01:50:14 DEBUG[4101]: File chan_sip.c, Line 886 (__sip_destroy):
Destorying call '93161d54-1d74-7515-1fba-b6c8db18e466@192.168.0.100
-------

Let me stress that the following interface is configured as a world-visible
public IP. On a hunch I thought I'd listen for my private budgetone address
on it.

-------from a TCP dump on the public * server ethernet interface
debian:/home# tcpdump dst 192.168.0.100
tcpdump: listening on eth0
01:50:08.354012 xxxxxty.net.18356 > 192.168.0.100.29684:  udp 172 (DF)
01:50:08.373734 xxxxxty.net.18356 > 192.168.0.100.29684:  udp 172 (DF)
01:50:08.393644 xxxxxty.net.18356 > 192.168.0.100.29684:  udp 172 (DF)
01:50:08.413661 xxxxxty.net.18356 > 192.168.0.100.29684:  udp 172 (DF)
01:50:08.433646 xxxxxty.net.18356 > 192.168.0.100.29684:  udp 172 (DF)
01:50:08.453649 xxxxxty.net.18356 > 192.168.0.100.29684:  udp 172 (DF)
<snip>
01:50:14.354377 xxxxxty.net.18356 > 192.168.0.100.29684:  udp 172 (DF)

301 packets received by filter

-------

Then I thought I'd look for traffic bound for the public IP of my NAT-router
attached to the budgetone

-------from a TCP dump on the public * server ethernet interface
tcpdump: listening on eth0
02:00:07.126157 xxxxxxty.net.5060 > 12-210-xxx-xxx.client.attbi.com.32386: 
udp 478 (DF)
02:00:07.209787 xxxxxxty.net.5060 > 12-210-xxx-xxx.client.attbi.com.32386: 
udp 413 (DF)
02:00:08.460978 xxxxxxty.net.5060 > 12-210-xxx-xxx.client.attbi.com.32386: 
udp 622 (DF)
02:00:09.477194 xxxxxxty.net.5060 > 12-210-xxx-xxx.client.attbi.com.32386: 
udp 622 (DF)
02:00:10.477193 xxxxxxty.net.5060 > 12-210-xxx-xxx.client.attbi.com.32386: 
udp 622 (DF)
02:00:11.477194 xxxxxxty.net.5060 > 12-210-xxx-xxx.client.attbi.com.32386: 
udp 622 (DF)
02:00:12.477202 xxxxxxty.net.5060 > 12-210-xxx-xxx.client.attbi.com.32386: 
udp 622 (DF)
02:00:13.477190 xxxxxxty.net.5060 > 12-210-xxx-xxx.client.attbi.com.32386: 
udp 622 (DF)
02:00:14.478325 xxxxxxty.net.5060 > 12-210-xxx-xxx.client.attbi.com.32386: 
udp 386 (DF)

9 packets received by filter
-------

It looks like the audio packets aren't being sent to the right IP address in
the latest sip code. I dug around a little in chan_sip.c but couldn't find
where the wrong IP was passed on.

Sorry if this is long winded. Just trying to help get to the bottom of this.

Jon