(gdb) bt full
#0  0x080aa527 in put_unaligned_uint32 (p=0xfffffff4, datum=768114816)
    at include/asterisk/unaligned.h:49
        pp = (struct {...} *) 0xfffffff4
#1  0x080aa20a in ast_rtp_raw_write (rtp=0x97c5978, f=0x974cc6c, codec=0)
    at rtp.c:1299
        rtpheader = (
    unsigned char *) 0xfffffff4 <Address 0xfffffff4 out of bounds>
        iabuf = "\000\000\000\000\000\000\000\000l?t\t??\005\b"
        hdrlen = 12
        res = -1214047032
        ms = 1459
        pred = 800
        mark = 1
        __PRETTY_FUNCTION__ = "ast_rtp_raw_write"
#2  0x080aa946 in ast_rtp_write (rtp=0x97c5978, _f=0x974cc6c) at rtp.c:1395
        f = (struct ast_frame *) 0x974cc6c
        codec = 0
        hdrlen = 12
        subclass = 4
        __PRETTY_FUNCTION__ = "ast_rtp_write"
#3  0x002a1a92 in sip_write (ast=0x97f3130, frame=0x974cc6c) at chan_sip.c:2596
        p = (struct sip_pvt *) 0x97cf118
        res = 0
        __PRETTY_FUNCTION__ = "sip_write"
#4  0x080658e2 in ast_write (chan=0x97f3130, fr=0x974cc6c) at channel.c:2336
        res = -1
        f = (struct ast_frame *) 0x974cc6c
        __PRETTY_FUNCTION__ = "ast_write"
#5  0x08068995 in ast_generic_bridge (c0=0x97f3540, c1=0x97f3130, 
    config=0xb7a32290, fo=0xb7a3210c, rc=0xb7a32108, bridge_end=
      {tv_sec = 0, tv_usec = 0}) at channel.c:3423
        cs = {0x97f3130, 0x97f3540, 0x97f3540}
        f = (struct ast_frame *) 0x974cc6c
        who = (struct ast_channel *) 0x97f3540
        res = AST_BRIDGE_COMPLETE
        o0nativeformats = 68
        o1nativeformats = 4
        watch_c0_dtmf = 0
        watch_c1_dtmf = 2
        pvt0 = (void *) 0x974c8f8
        pvt1 = (void *) 0x97cf118
        to = -1
        __PRETTY_FUNCTION__ = "ast_generic_bridge"
#6  0x080697b1 in ast_channel_bridge (c0=0x97f3540, c1=0x97f3130, 
    config=0xb7a32290, fo=0xb7a3210c, rc=0xb7a32108) at channel.c:3655
        now = {tv_sec = 0, tv_usec = 0}
        to = -1
        who = (struct ast_channel *) 0x0
        res = AST_BRIDGE_COMPLETE
        nativefailed = 0
        firstpass = 1
        o0nativeformats = 68
        o1nativeformats = 4
        time_left_ms = 0
        nexteventts = {tv_sec = 0, tv_usec = 0}
        caller_warning = 0 '\0'
        callee_warning = 0 '\0'
        __PRETTY_FUNCTION__ = "ast_channel_bridge"
#7  0x001274cb in ast_bridge_call (chan=0x97f3540, peer=0x97f3130, 
    config=0xb7a32290) at res_features.c:1325
        f = (struct ast_frame *) 0x0
        who = (struct ast_channel *) 0x927d70
        chan_featurecode = '\0' <repeats 11 times>
        peer_featurecode = '\0' <repeats 11 times>
        res = 134575357
        diff = -1214045976
        hasfeatures = 0
        hadfeatures = 0
        aoh = (struct ast_option_header *) 0x6e1ba0
        backup_config = {features_caller = {flags = 0}, features_callee = {
    flags = 0}, start_time = {tv_sec = 0, tv_usec = 0}, feature_timer = 0, 
  timelimit = 0, play_warning = 0, warning_freq = 0, warning_sound = 0x0, 
  end_sound = 0x0, start_sound = 0x0, firstpass = 0, flags = 0}
        monitor_exec = 0x0
        __PRETTY_FUNCTION__ = "ast_bridge_call"
#8  0x0091f9fc in try_calling (qe=0xb7a32580, options=0xb7a3272a "", 
    announceoverride=0xb7a3272c "", url=0xb7a3272b "", go_on=0xb7a326fc)
    at app_queue.c:2419
        cur = (struct member *) 0x0
        outgoing = (struct localuser *) 0x0
        tmp = (struct localuser *) 0x97f4140
        to = 26980
        restofit = "@5\177\t\234K?\000`?o\t7\000\000\000??\222\000?\037n\000HZh\t\033?\221\000?$??", '\0' <repeats 24 times>, "\001\000\000\000\200%??\224?\222\000\030%??\b?\221"
        oldexten = "o", '\0' <repeats 78 times>
        oldcontext = "oakland-incoming", '\0' <repeats 63 times>
        queuename = "operator", '\0' <repeats 247 times>
        newnum = 0x0
        monitorfilename = 0xb7a32388 ""
        peer = (struct ast_channel *) 0x97f3130
        which = (struct ast_channel *) 0x0
        backup_config = {features_caller = {flags = 0}, features_callee = {
    flags = 0}, start_time = {tv_sec = 0, tv_usec = 0}, feature_timer = 0, 
  timelimit = 0, play_warning = 0, warning_freq = 0, warning_sound = 0x0, 
  end_sound = 0x0, start_sound = 0x0, firstpass = 0, flags = 0}
        monitor_exec = 0x0
        __PRETTY_FUNCTION__ = "ast_bridge_call"
#8  0x0091f9fc in try_calling (qe=0xb7a32580, options=0xb7a3272a "", 
    announceoverride=0xb7a3272c "", url=0xb7a3272b "", go_on=0xb7a326fc)
    at app_queue.c:2419
        cur = (struct member *) 0x0
        outgoing = (struct localuser *) 0x0
        tmp = (struct localuser *) 0x97f4140
        to = 26980
        restofit = "@5\177\t\234K?\000`?o\t7\000\000\000??\222\000?\037n\000HZh\t\033?\221\000?$??", '\0' <repeats 24 times>, "\001\000\000\000\200%??\224?\222\000\030%??\b?\221"
        oldexten = "o", '\0' <repeats 78 times>
        oldcontext = "oakland-incoming", '\0' <repeats 63 times>
        queuename = "operator", '\0' <repeats 247 times>
        newnum = 0x0
        monitorfilename = 0xb7a32388 ""
        peer = (struct ast_channel *) 0x97f3130
        which = (struct ast_channel *) 0x0
        backup_config = {features_caller = {flags = 0}, features_callee = {
    flags = 0}, start_time = {tv_sec = 0, tv_usec = 0}, feature_timer = 0, 
  timelimit = 0, play_warning = 0, warning_freq = 0, warning_sound = 0x0, 
  end_sound = 0x0, start_sound = 0x0, firstpass = 0, flags = 0}
        monitor_exec = 0x0
        __PRETTY_FUNCTION__ = "ast_bridge_call"
#8  0x0091f9fc in try_calling (qe=0xb7a32580, options=0xb7a3272a "", 
    announceoverride=0xb7a3272c "", url=0xb7a3272b "", go_on=0xb7a326fc)
    at app_queue.c:2419
        cur = (struct member *) 0x0
        outgoing = (struct localuser *) 0x0
        tmp = (struct localuser *) 0x97f4140
        to = 26980
        restofit = "@5\177\t\234K?\000`?o\t7\000\000\000??\222\000?\037n\000HZh\t\033?\221\000?$??", '\0' <repeats 24 times>, "\001\000\000\000\200%??\224?\222\000\030%??\b?\221"
        oldexten = "o", '\0' <repeats 78 times>
        oldcontext = "oakland-incoming", '\0' <repeats 63 times>
        queuename = "operator", '\0' <repeats 247 times>
        newnum = 0x0
        monitorfilename = 0xb7a32388 ""
        peer = (struct ast_channel *) 0x97f3130
        which = (struct ast_channel *) 0x0
        lpeer = (struct localuser *) 0x97f4020
        member = (struct member *) 0x97b41d0
        res = 0
        bridge = 0
        numbusies = 0
        x = 7
        announce = 0x0
        digit = 0 '\0'
        callstart = 1171482440
        now = 1171482437
        bridge_config = {features_caller = {flags = 0}, features_callee = {
    flags = 2}, start_time = {tv_sec = 1171482440, tv_usec = 700535}, 
  feature_timer = 0, timelimit = 0, play_warning = 0, warning_freq = 0, 
  warning_sound = 0x0, end_sound = 0x0, start_sound = 0x0, firstpass = 0, 
  flags = 2}
        nondataquality = 1 '\001'
        __PRETTY_FUNCTION__ = "try_calling"
#9  0x00922c72 in queue_exec (chan=0x97f3540, data=0xb7a36b60)
    at app_queue.c:3154
        stat = QUEUE_NO_MEMBERS
        makeannouncement = 1
        res = 0
        ringing = 0
        u = (struct localuser *) 0x980f7e0
        queuename = 0xb7a32720 "operator"
        info = "operator\000t\000\000\000120", '\0' <repeats 456 times>, "8)???/\n\bp>\177\tpk??@", '\0' <repeats 22 times>
        info_ptr = 0xb7a3272d "120"
        options = 0xb7a32729 "t"
        url = 0xb7a3272b ""
        announceoverride = 0xb7a3272c ""
        user_priority = 0x0
        prio = 0
        queuetimeoutstr = 0xb7a3272d "120"
        reason = QUEUE_UNKNOWN
        go_on = 0
        qe = {parent = 0x97b3c28, moh = "operator", '\0' <repeats 71 times>, 
  announce = '\0' <repeats 79 times>, context = '\0' <repeats 79 times>, 
  digits = '\0' <repeats 79 times>, pos = 1, prio = 0, last_pos_said = 0, 
  last_periodic_announce_time = 1171482437, last_pos = 0, opos = 1, 
  handled = 1, start = 1171482437, expire = 1171482557, chan = 0x97f3540, 
  next = 0x0}
        __PRETTY_FUNCTION__ = "queue_exec"
#10 0x08083d4f in pbx_exec (c=0x97f3540, app=0x9773340, data=0xb7a36b60, 
    newstack=1) at pbx.c:554
        res = 159331648
[snip]