The bug was in the whole handling of the internal buffer for the P-Charging-Vector handler. One buffer for the original and the rewritten header, but handled in similar but different ways. Took some time to find that!
I have added a new buffer when creating a new PCV header. The original buffer is for the header's body as it is put there in `sip_parse_charging_vector`. Additionally I have altered the lump handling. It should have worked the way it was, but now the lumps are chained in case the PCV is replaced.
The code is tested and works in a test environment. Night's calling, PR will come the next days.