based on more tests, it appears that tm.t_uac_wait does not use advertise address (if given on listen line) when it substitutes !! (SUBST_CHARs) in request headers. i'll open a bug report on it. -- juha