Juha Heinanen writes:
pcap shows that kamailio receives from the uas two "180 ringing" replies 30 secs apart after which fr_inv_timeout hits. at that point kamailio sends "408 request timeout" to uac and gets back ack. then 45 secs later, kamailio gets one more "180 ringing" reply from the uas followed by several 480 replies. one of them crashes kamailio.
pcap also shows that when fr_inv_timeout fired and kamailio send 408 to uac, it did not send cancel to uas. it send 408 to uac at 17:44:44 and cancel to uas at 18:00:23, i.e. about 15 minutes later!
-- juha