Daniel, i will shrink the script as much as possible and then i can surely provide a full test case incl. sipp scenarios. Give me a few days, though. By now i can say that this is the only place where i used a "@hf_value" selector. Maybe the segfault occurs also if one uses it in a request instead of a reply, this would simplify the test case greatly (e.g. can then maybe use sipsak).