I apologize for the incomplete report so far. I was tracing the SIP traffic with `sngrep` and unfortunately did not save the pcap file while I was testing something else. The registrations with an alternate source port are in fact hard to reproduce and appear to occur, if at all, only right after (re)starting kamailio. kamailio sends out one (or multiple, in the configured interval of 600-60 seconds) registrations with sport != 5060 and eventually switches to sport 5060 for all subsequent registrations.
The registration dialogs were absolutely normal apart from the source port, e.g., ``` 1.2.3.4:1026 -> 5.6.7.8:5060 REGISTER sip:sip.example.org SIP/2.0.
5.6.7.8:5060 -> 1.2.3.4:1026 SIP/2.0 401 Unauthorized.
1.2.3.4:1026 -> 5.6.7.8:5060 REGISTER sip:sip.example.org SIP/2.0.
5.6.7.8:5060 -> 1.2.3.4:1026 SIP/2.0 200 OK. ```
Can there be a race between obtaining the listening sockets and sending out the first registration?