Over the past few months, I've seen a smattering of kamailio crashes on various systems with identical backtraces: SIGSEGV in tcp_read_headers(), at tcp_read.c line 628. Example here:

Note that in frame 0, print *c shows that req->parsed is pointing to an address exactly 8GB lower than req->buf.  That req->parsed is pointing to an invalid memory location, crashing kamailio when the location is dereferenced.  In other coredumps, I see that req->parsed is pointing to an address exactly 4GB lower than req->buf.

Other info: This is Kamailio 4.4.4 on x86_64.  I've not had success trying to reproduce this yet.  Also worth noting that the crashes seem to be consistently associated with processing traffic from a UA connected over SIP/TCP; I've seen no other transport associated with this crash.

Thoughts are welcome.  Thanks!

Armen