Dispatcher crashes everytime guaranteed if there is a single dead host kamailio exits with a core dump (see below). If there are two dead hosts entire kamailio locks up (no core dump). Any ideas on this one? The invalid flag is never marked in the DB btw.

Crashes at ds_select_dst having never reached "COMPLETED FIRST DST LOOKUP"
 
# -------------------------  request routing logic -------------------
# main routing logic
# ------------------
route{
        # initial checks
        if (!mf_process_maxfwd_header("10")) {
                sl_send_reply("483","Too Many Hops");
                exit;
        };
        if (msg:len >=  2048 ) {
                sl_send_reply("513", "Message too big");
                exit;
        };
        xlog("[$TF] VALID RECV $rm\n     $fu ($si:$sp) to $ru\n");
        $avp(orig_du) = $du;
        if($(fU{s.select,1,-})){
                # from a user-formed message
                $avp(user) = $(fU{s.select,0,-});
                xlog("     USER $avp(user) DETECTED\n");
        }
        if(pv_isset("$avp(user)") && !ds_is_from_list()){
                # from client
                # route to client PBX
                if(method == "REGISTER"){
                        route(3);
                } else {
                        route(1);
                }
        }
        if(ds_is_from_list()){
                # from client, outbound from pbx
                xlog("     IS FROM PBX\n");
                if(is_e164($rU)){
                        xlog("     IS E164");
                        # all pbx-pbx traffic should be in user format
                        # since this is pbx-non-pbx send it to gateway
                        # gateway only takes E164
                        route(2);
                }
                if($(rU{s.select,0,-})){
                        # send directly from pbx to client
                        route(4);
                }
        }
        if($si == "GATEWAY_IP_ADDRESS"){
                # lookup enum
                # route to appropriate pbx via DISPATCHER based on user returned
                xlog("     CALL FROM GATEWAY\n");
        }
}
route[1]{
        route(3);
        xlog("     ROUTED to $avp(user) PBX\n");
        ds_select_dst($avp(user),"7");
        xlog("     COMPLETED FIRST DST LOOKUP\n");
        if($avp(orig_rd) == $rd){
                exec("kamctl dispatcher reload");
                ds_select_dst($avp(user),"9");
        }
        xlog("     host is now $rd; all is $ru || $du\n");
        if($avp(orig_du) != $du){
                t_on_failure("1");
                if(!t_relay()){
                        xlog("     T_RELAY() FAILED\n");
                        sl_reply_error();
                }
        } else {
                xlog("     RELOAD STILL YIELDED NOTHING\n");
        }
}
route[2]{
        xlog("     Sending to gateway...");
        #$rd = "GATEWAY";
}
route[3]{
        #register
        if(!www_authorize("domain.net","subscriber")){
                www_challenge("domain.net","0");
                return;
        } else {
                xlog("     AUTHENTICATED $avp(user)\n");
                save("location");
                return;
        }
}
route[4]{
        $rU = "2-1";
        #$rd = "10.1.40.7";
        #$rp = "16314";
        lookup("location");
        xlog("     ROUTING TO USER $rU\n");
        forward();
}
failure_route[1]{
        xlog("     FAILED FAILURE_ROUTE[1]\n");
        if(t_any_timeout()){
                xlog("     MARKING DEAD HOST $du\n");
                ds_mark_dst();
                xlog("     TIMEOUT!\n");
        }
}

 
 0(2934) ERROR: <script>: [Thu Dec  2 20:15:34 2010] VALID RECV REGISTER
     sip:3-1@domain.com (10.1.40.7:43899) to sip:domain.com
 0(2934) ERROR: <script>:      USER 3 DETECTED
 0(2934) ERROR: <script>:      ROUTED to 3 PBX
 0(2934) ERROR: <script>: mark#1
 0(2934) ERROR: <script>:      host is now domain.com; all is sip:domain.com || sip:xxx.xxx.xxx.166:5060
 0(2934) ERROR: <script>: [Thu Dec  2 20:15:35 2010] VALID RECV REGISTER
     sip:3-1@domain.com (10.1.40.7:43899) to sip:domain.com
 0(2934) ERROR: <script>:      USER 3 DETECTED
 0(2934) ERROR: <script>:      ROUTED to 3 PBX
 0(2934) ERROR: <script>: mark#1
 0(2934) ERROR: <script>:      host is now domain.com; all is sip:domain.com || sip:xxx.xxx.xxx.166:5060
 1(2935) ERROR: <script>:      FAILED FAILURE_ROUTE[1]
 1(2935) ERROR: <script>:      MARKING DEAD HOST sip:xxx.xxx.xxx.166:5060
 1(2935) ERROR: <script>:      TIMEOUT!
 0(2934) ERROR: <script>: [Thu Dec  2 20:15:50 2010] VALID RECV REGISTER
     sip:3-1@domain.com (10.1.40.7:29372) to sip:domain.com
 0(2934) ERROR: <script>:      USER 3 DETECTED
 0(2934) ERROR: <script>:      ROUTED to 3 PBX
 0(2934) ERROR: <script>: mark#1
 0(2934) ERROR: <script>:      host is now domain.com; all is sip:domain.com || sip:xxx.xxx.xxx.165:5060
 0(2934) ERROR: <script>: [Thu Dec  2 20:15:50 2010] VALID RECV REGISTER
     sip:3-1@domain.com (10.1.40.7:29372) to sip:domain.com
 0(2934) ERROR: <script>:      USER 3 DETECTED
 0(2934) ERROR: <script>:      ROUTED to 3 PBX
 0(2934) ERROR: <script>: mark#1
 0(2934) ERROR: <script>:      host is now domain.com; all is sip:domain.com || sip:xxx.xxx.xxx.165:5060
 1(2935) ERROR: <script>:      FAILED FAILURE_ROUTE[1]
 1(2935) ERROR: <script>:      MARKING DEAD HOST sip:xxx.xxx.xxx.165:5060
 1(2935) ERROR: <script>:      TIMEOUT!
 0(2934) ERROR: <script>: [Thu Dec  2 20:15:55 2010] VALID RECV REGISTER
     sip:3-1@domain.com (10.1.40.7:29373) to sip:domain.com
 0(2934) ERROR: <script>:      USER 3 DETECTED
 0(2934) ERROR: <script>:      ROUTED to 3 PBX
 
 
:::::Core file from crash with 1 invalid host:::::
Program terminated with signal 8, Arithmetic exception.
#0  0x0069e92b in ds_select_dst (msg=0x82ffb00, set=2, alg=7, mode=0)
    at dispatch.c:1720
1720                            i = (i+1)%(idx->nr-1);
 
 
 
Thanks for any help on this one!
-Eric