I'm into my 4th or 5th day of working on bug #981. I know that part of the problem is that the fixup routine is called in chan_sip.c. Well in there is a line that says p=newchan->pvt->pvt. Problem is, that doesn't exist in this case. I see "pvt" described as "private lock" but that doesn't mean I have any clue what the ramifications are in this instance. Of course I can easily put a check into fixup that says if p is NULL then return success. But what does it *mean* if newchan->pvt->pvt is NULL? What should be done in this case? This situation happens (sometimes) when the "dual redirect" is used and it's in the process of transferring the original receipient. i.e. A calls B, then you do the dual redirect. Regardless of which parameter goes into "Channel" or "ExtraChannel", "B" is the one that will cause the crash, as it's going through the masquerade process. Yes it is updated to cvs.