Am I to naive to think that these ACKs to negatives always (callid masking and whether topoh is active or not) need to use the Call-ID from the negative (in this case 488) response? Call-ID has only to be rewritten in forwarding the negative response towards the endpoint that triggered it (which is done correctly in my call trace)
Attached is a diff to topoh_mod.c that implements above (with my limited knowledge). Locally generated ACKs don't get masked Call-IDs to downstream. Works for my 488, will test some more to see if nothing else is broken. But maybe somebody more in touch with kamailio source code could take a look to see it this patch looks alright?