[Serusers] UAS Cancel handling

Hello, after setting fr_timer and fr_inv_timer to lower values than default: modparam("tm", "fr_timer", 12) modparam("tm", "fr_inv_timer", 24) noticed that some SIP phones continues to ring even if a caller hangs up the phone. After a callee receives CANCEL message it responds either with 481 ir 487 (transaction does not exists). If fr_inv_timer is not expired, callee responds with 481 and cancels INVITE request. If timer, by the time caller sends CANCEL, is expired, callee returns 487 and does not stop ringing. After comparing CANCEL messages in both cases (using algorithm described in 3261, 17.2.3) i didn't find any difference between them (Branch, sent-by, to tagm from tag, call-id, cseq - all matches). How UAS distinguishes these CANCEL messages and how SER changes CANCEL message after fr_inv_timer is exeeded? Antanas