So it is during tls connect, no much done by kamailio there (I mean, no content specifically set by kamailio for sending out). Can you list the code at frames 0 and 1?
``` frame 0 list frame 1 list ```
Is it easy to reproduce? Or, eventually any convenient way to get access to the system that exposes the crash so I can investigate the core file?