[Users] avp_db_load() generates core dump

Using the (g)lobal flag together with avp_db_load() crashes my OpenSER in a reproducible manner. The config works if I don't use the g flag and I tested it on CVS current. I try to give as much information as possible here: from openser.cfg: ... # check for Call Forwarding Unconditional (CFU) if (avp_db_load("$ruri/username", "$avp(s:cfu)")) { avp_print(); # replace R-URI with CFU URI, g will fetch all CFU URIs --> request will fork avp_pushto("$ru", "$avp(s:cfu)/g"); # avp_pushto("$ru", "$avp(s:cfu)"); --> this works sl_send_reply("181", "Call is being forwarded (CFU)"); route(ROUTE_DEFAULT_RELAY); exit; } ... from openser.log: ... openser[31411]: INFO:avpops:print_avp: p=0xb5770dc8, flags=103 openser[31411]: INFO: name=<cfu> openser[31411]: INFO: val_str=<sip:vm-admin@xx.xx.xx.xx / 25> openser[31411]: INFO:avpops:print_avp: p=0xb5770d98, flags=2 openser[31411]: INFO: id=<34> openser[31411]: INFO: val_str=<sip:cschlatt@unc.edu / 20> openser[31403]: child process 31411 exited by a signal 11 ... from core dump: #0 ops_pushto_avp (msg=0x8123bb0, dst=0x8123130, src=0x8123160) at avpops_impl.c:1111 1111 flags = avp->flags; Thanks Christian