Thanks for the feedback and sorry for the delay.
I reproduced the crash today by importing the dump of the db I made when the crash originally occurred.
I got 3 core dumps. Two have the backtrace as above, with `free_str_list_all` at the top of the call stack, thus neither of those is (if I understand correctly) the process from which the problem originated.
The third coredump has the following backtrace:
``` (gdb) bt full #0 0x00007ffa4c365840 in dialog_publish_multi (state=state@entry=0x7ffa4c36c267 "terminated", ruris=0x2e656c706d617865, entity=entity@entry=0x7ffd855c6440, peer=peer@entry=0x7ffd855c6450, callid=callid@entry=0x7ffa5077cdf0, initiator=initiator@entry=1, lifetime=10, localtag=0x0, remotetag=0x0, localtarget=0x7ffa5077ce20, remotetarget=0x7ffd855c6430, do_pubruri_localcheck=0, uuid=0x7ffa5077ce50) at /usr/local/src/pkg/src/modules/pua_dialoginfo/dialog_publish.c:410 __llevel = 3 __func__ = "dialog_publish_multi" #1 0x00007ffa4c366f70 in __dialog_sendpublish (dlg=<optimized out>, type=<optimized out>, _params=<optimized out>) at /usr/local/src/pkg/src/modules/pua_dialoginfo/pua_dialoginfo.c:402 tag = {s = 0x0, len = 0} uri = { s = 0x7ffa5077ce7c "sip:*9001*0039123456@example.voismart.commsowdcchfzrlapg@localhostmsfvzsip:*9001*0039123456@example.voismart.comsip:101_example_voismart_com@172.23.42.1:5065;alias=192.168.1.201~32878~1padi-1-65d7243e"..., len = 41} identity_local = { s = 0x7ffa5077ce60 "sip:101@example.voismart.comsip:*9001*0039123456@example.voismart.commsowdcchfzrlapg@localhostmsfvzsip:*9001*0039123456@example.voismart.comsip:101_example_voismart_com@172.23.42.1:5065;alias=192.168."..., len = 28} target = {s = 0x0, len = 0} dlginfo = 0x7ffa5077cdc8 request = 0x0 __func__ = "__dialog_sendpublish" #2 0x00007ffa4f0b5867 in run_dlg_callbacks (type=64, dlg=0x7ffa500318a0, req=<optimized out>, rpl=<optimized out>, dir=<optimized out>, dlg_data=<optimized out>) at /usr/local/src/pkg/src/modules/dialog/dlg_cb.c:269 cb = 0x7ffa5077d050 __func__ = "run_dlg_callbacks" #3 0x00007ffa4f115df7 in dlg_bye_all (dlg=0x7ffa500318a0, hdrs=0x0) at /usr/local/src/pkg/src/modules/dialog/dlg_req_within.c:858 all_hdrs = {s = 0x0, len = 0} ret = <optimized out> __func__ = "dlg_bye_all" #4 0x00007ffa4f0e6669 in dlg_ontimeout (tl=0x7ffa50031900) at /usr/local/src/pkg/src/modules/dialog/dlg_handlers.c:1670 dlg = 0x7ffa500318a0 new_state = 22098 old_state = 72604856 unref = 22098 fmsg = <optimized out> timeout_cb = 0x0 keng = <optimized out> evname = {s = 0x4b <error: Cannot access memory at address 0x4b>, len = 72378941} __func__ = "dlg_ontimeout" #5 0x00007ffa4f109460 in dlg_timer_routine (ticks=<optimized out>, attr=<optimized out>) at /usr/local/src/pkg/src/modules/dialog/dlg_timer.c:281 tl = 0x0 ctl = 0x7ffa50031900 __func__ = "dlg_timer_routine" #6 0x000056520433e01b in compat_old_handler (ti=<optimized out>, tl=<optimized out>, data=<optimized out>) at core/timer.c:980 t = <optimized out> #7 0x0000565204353c29 in slow_timer_main () at core/timer.c:1103 n = <optimized out> ret = <optimized out> tl = 0x7ffa4ff1f428 i = <optimized out> __func__ = "slow_timer_main" #8 0x00005652040c2fec in main_loop () at /usr/local/src/pkg/src/main.c:1490 i = <optimized out> pid = <optimized out> --Type <RET> for more, q to quit, c to continue without paging-- si = <optimized out> si_desc = "udp receiver child=31 sock=172.23.42.2:9999\000RV\000\000\000 \034X\372\177\000\000\003\000\000\000\377\377\377\377\004`P\004RV\000\000\004\000\000\000\372\177\000\000\003\000\000\000\000\000\000\000\t\000\000\000\000\000\000\000Thu Feb \000qv1\335c\376\356:54 2024\005\000\000\000\000\000\000" nrprocs = <optimized out> woneinit = 1 error = <optimized out> __func__ = "main_loop" #9 0x00005652040b6ffc in main (argc=<optimized out>, argv=<optimized out>) at /usr/local/src/pkg/src/main.c:3212 cfg_stream = <optimized out> c = <optimized out> r = <optimized out> tmp = 0x7ffd855c8db4 "" tmp_len = 0 port = 32765 proto = -2057539472 ahost = 0x0 aport = 0 options = 0x565204509300 ":f:cm:M:dVIhEeb:l:L:n:vKrRDTN:W:w:t:u:g:P:G:SQ:O:a:A:x:X:Y:" ret = -1 seed = 1294483928 rfd = <optimized out> debug_save = <optimized out> debug_flag = <optimized out> dont_fork_cnt = <optimized out> n_lst = <optimized out> p = <optimized out> st = {st_dev = 198, st_ino = 827616256, st_nlink = 1, st_mode = 16872, st_uid = 101, st_gid = 101, __pad0 = 0, st_rdev = 0, st_size = 6, st_blksize = 4096, st_blocks = 0, st_atim = {tv_sec = 1708594589, tv_nsec = 533404421}, st_mtim = {tv_sec = 1708598142, tv_nsec = 117863927}, st_ctim = {tv_sec = 1708598142, tv_nsec = 117863927}, __glibc_reserved = {0, 0, 0}} tbuf = '\000' <repeats 32 times>, '/' <repeats 16 times>, "\230\r", '\000' <repeats 14 times>, "`", '\000' <repeats 15 times>, "\001", '\000' <repeats 145 times>... option_index = 12 __func__ = "main" long_options = {{name = 0x565204508fe2 "help", has_arg = 0, flag = 0x0, val = 104}, {name = 0x565204510dc8 "version", has_arg = 0, flag = 0x0, val = 118}, {name = 0x565204520731 "alias", has_arg = 1, flag = 0x0, val = 1024}, {name = 0x565204508fe7 "subst", has_arg = 1, flag = 0x0, val = 1025}, {name = 0x565204508fed "substdef", has_arg = 1, flag = 0x0, val = 1026}, {name = 0x565204508ff6 "substdefs", has_arg = 1, flag = 0x0, val = 1027}, {name = 0x565204509000 "server-id", has_arg = 1, flag = 0x0, val = 1028}, {name = 0x56520450900a "loadmodule", has_arg = 1, flag = 0x0, val = 1029}, {name = 0x565204509015 "modparam", has_arg = 1, flag = 0x0, val = 1030}, {name = 0x56520450901e "log-engine", has_arg = 1, flag = 0x0, val = 1031}, {name = 0x565204510ee5 "debug", has_arg = 1, flag = 0x0, val = 1032}, {name = 0x565204509029 "cfg-print", has_arg = 0, flag = 0x0, val = 1033}, {name = 0x565204509033 "atexit", has_arg = 1, flag = 0x0, val = 1034}, {name = 0x56520450903a "all-errors", has_arg = 0, flag = 0x0, val = 1035}, {name = 0x0, has_arg = 0, flag = 0x0, val = 0}} (gdb) (gdb) (gdb) info locals __llevel = 3 __func__ = "dialog_publish_multi" (gdb) list 405 in /usr/local/src/pkg/src/modules/pua_dialoginfo/dialog_publish.c
```
Let me know if there is anything else I can provide.