To follow up on this issue: it apparently had to do with ForkCDR()'ing multiple times in a call. I'll take this to asterisk-dev to see what's really going on under the hood.