i got rid of the crash by changing xavp_rm(xavp, xavp_list); calls to xavp_rm(xavp, NULL); where xavp_list is xavp_list = xavp_get(&contacts_avp, NULL); i.e., pointer to the first xavp with the given name, and xavp is also pointer to the first xavp in the list. looks like the first version of xavp_rm caused _xavp_list_crt to point to already removed xavp. what i try to accomplish is to pop xavps from the head of the list one at a time. -- juha