If a message body is modified by both force_rtp_proxy() and replace( "^Content-Length:", "l:" ) then the resulting message is corrupted.
The message size is updated but the header field name appear in both the short and long form. Here it is an example:
l:Content-Length: 403
The result is the same if I reverse the order of the two operations too.
BTW, I use that replace call (and others) when the message is large to prevent it to fragment.
Bye.