Apologies if i have not kept with the reporting standard.
Insertion attempts of out-of-credit replies from resume_on_initial_ccr callback, are corrupting the ro_session list. i.e. they nullify the first and last fields, which under certain conditions the first entry gets restored but not the last.This then crashes the process at ro_session_hash.c (link_ro_session), where the first entry has a valid address but the last does not. Solution: ro_session_hash.h - unlink_unsafe_ro_session - check if the session to be linked is actually part of list i.e
if ((ro_session->next == 0x00) && (ro_session->prev == 0x00) && (ro_session != ro_session_entry->first) ) { ro_session, &(ro_session->ro_tl), ro_session->callid.len, ro_session->callid.len, ro_session->callid.s); return; } rest of the code ....