Index: main/dsp.c =================================================================== --- main/dsp.c (revision 114105) +++ main/dsp.c (working copy) @@ -1495,7 +1495,12 @@ dsp->f.subclass = AST_CONTROL_BUSY; ast_frfree(af); ast_log(LOG_DEBUG, "Requesting Hangup because the busy tone was detected on channel %s\n", chan->name); - return &dsp->f; + /* When ast_read() is called to get a frame from a channel, if we get an AST_CONTROL_BUSY frame, the reaction + * will be to hang up the channel and then later free the frame. The problem is that hanging up the channel + * will mean freeing the dsp, which means that dsp->f is now invalid memory to reference. So, instead of + * passing a reference to it specifically, we duplicate the frame and pass it instead. + */ + return ast_frdup(&dsp->f); } if ((dsp->features & DSP_FEATURE_DTMF_DETECT)) { digit = __ast_dsp_digitdetect(dsp, shortdata, len, &writeback);