A couple of issues/suggestions:
- I would not allocate msg, declaring it as a local sip_msg_t should enough - no matter if msg is pointer or sip_msg_t, free_sip_msg() has to be used to clean up allocated memory by parsing - I would not run the event route with a faked message, either the cancel is built/parsed fine and run the event route, or throw an error message - the condition to execute the event route should be useless, there are some returns before that should ensure that either there is a proper event_route block or a kemi callback event name.