While looking at the t_continue() I discovered that it may overwrite a previous set faked environment, which can happen if the function is used in failure_route, as a result xavps/avps lists can be lost without being freed. With the commit 9ff4dd36ad63f60905a49f8c0e437f997e54ae70, this situation should be solved.
I am not sure this is solving your case, but it would be good if you test with this patch.
I am also going to look at the registrar module to see if I spot something wrong there. Deleting the xavps in the module as proposed by this pull request is not the proper solution, it may be a workaround for some specific case, but not fixing the real cause.