(gdb) bt
#0  0x40143d89 in free () from /lib/tls/libc.so.6
#1  0x0805a74d in ast_frfree (fr=0x40203f40) at frame.c:277
#2  0x080604be in ast_channel_spy_free (spy=0x40bb3fd0) at channel.c:1111
#3  0x40a2f7e2 in channel_spy (chan=0x820b5c8, spyee=0x8150e08,
    volfactor=0x40bb4104, fd=-557481797) at app_chanspy.c:341
#4  0x40a2f0e2 in chanspy_exec (chan=0x820b5c8, data=0x8150e08)
    at app_chanspy.c:508
#5  0x0808dd25 in pbx_extension_helper (c=0x820b5c8, con=0xdec580bb,
    context=0x820b718 "from-spy-phone", exten=0x820b80c "007", priority=1,
    label=0x0, callerid=0x0, action=0) at pbx.c:553
#6  0x0808e8ca in __ast_pbx_run (c=0x820b5c8) at pbx.c:2230
#7  0x0808f5bf in pbx_thread (data=0xdec580bb) at pbx.c:2517
#8  0x40022b63 in start_thread () from /lib/tls/libpthread.so.0
#9  0x401aa18a in clone () from /lib/tls/libc.so.6


(gdb) bt full
#0  0x40143d89 in free () from /lib/tls/libc.so.6
No symbol table info available.
#1  0x0805a74d in ast_frfree (fr=0x40203f40) at frame.c:277
No locals.
#2  0x080604be in ast_channel_spy_free (spy=0x40bb3fd0) at channel.c:1111
        f = (struct ast_frame *) 0x0
#3  0x40a2f7e2 in channel_spy (chan=0x820b5c8, spyee=0x8150e08,
    volfactor=0x40bb4104, fd=-557481797) at app_chanspy.c:341
        csth = {spy = {list = {next = 0x0}, lock = {__m_reserved = 0,
      __m_count = 0, __m_owner = 0x0, __m_kind = 1, __m_lock = {__status = 0,
        __spinlock = 0}}, trigger = {__c_lock = {__status = 0,
        __spinlock = 0}, __c_waiting = 0x0,
      __padding = "\000\000\000\000äG\002@", '\0' <repeats 12 times>, "\001\000\000\000\030@»@", __align = 1073891936}, chan = 0x806804c, read_queue = {
      head = 0x8118b98, samples = 4000, format = 64}, write_queue = {
      head = 0xff4e75c0, samples = 0, format = 64}, flags = 57,
    status = CHANSPY_DONE,
    type = 0x40bb4048 "`@»@b®\b\b \217\021\bP\226\024\bhE»@",
    read_vol_adjustment = 1073891936, write_vol_adjustment = 1086013536},
  fd = 134786658, volfactor = 135368608}
        running = 0
        res = 0
        x = 0
---Type <return> to continue, or q <return> to quit---
        inp = '\0' <repeats 23 times>
        name = 0x0
        f = (struct ast_frame *) 0xdec580bb
        attr = {__mutexkind = 1}
#4  0x40a2f0e2 in chanspy_exec (chan=0x820b5c8, data=0x8150e08)
    at app_chanspy.c:508
        x = 1086013700
        group = 0xdec580bb <Address 0xdec580bb out of bounds>
        u = (struct localuser *) 0x815c610
        peer = (struct ast_channel *) 0x8150e08
        prev = (struct ast_channel *) 0x8150e08
        name = '\0' <repeats 188 times>, "ËÖ\026\b8Ö\026\b\f¸ \b\000\000\000\000\2047\b\bȵ \b\000\000\000\000ËÖ\026\b\f¸ \b@\207»@\000 \000\000ȵ \bÔ\020\t\b(×\026\bÞ\235\017\b\000 \000\000äG\002@"
        peer_name = "spy-iax2\000911-8", '\0' <repeats 246 times>
        args = 0x8150e08 "IAX2/911-8"
        ptr = 0x40bb4349 "911-8"
        options = 0x0
        spec = 0x0
        argv = {0x40bb4098 "", 0x40bb4099 "q", 0x0, 0x0, 0x0}
        mygroup = 0x0
        recbase = 0x40bb4104 ""
        res = 1086013700
---Type <return> to continue, or q <return> to quit---
        volfactor = 0
        silent = 1
        argc = -557481797
        bronly = 0
        chosen = 0
        count = 2
        waitms = 100
        oldrf = 4
        oldwf = 4
        fd = 0
        flags = {flags = 1}
        zero_volume = 0 '\0'
#5  0x0808dd25 in pbx_extension_helper (c=0x820b5c8, con=0xdec580bb,
    context=0x820b718 "from-spy-phone", exten=0x820b80c "007", priority=1,
    label=0x0, callerid=0x0, action=0) at pbx.c:553
        e = (struct ast_exten *) 0x40a2ea30
        sw = (struct ast_switch *) 0x0
        data = 0x0
        foundcontext = 0x816d6cb "ext-spy-custom"
        newstack = 1
        res = 0
        status = 5
        incstack = {0x816d620 "from-spy-phone", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
---Type <return> to continue, or q <return> to quit---
  0x0, 0x40140434 "\201Ã\f;\f", 0x0, 0x0, 0x40203f40 "H\036\023",
  0x40bba7c0 "\001\200­ûð¨»@ð¨»@ð¨»@ð¨»@þ¨»@?©»@ð¨»@?©»@",
  0x40bba79c "¬¨»@\020°\023@À§»@c\222\017\b䨻@ð¨»@",
  0x40141980 "\211~\020\213E\024\211~\f\211~\004\205Àt$\213U\024\213}ð\211V\024\211~\030\211V\b1É\211\216\230",
  0x40bba7c0 "\001\200­ûð¨»@ð¨»@ð¨»@ð¨»@þ¨»@?©»@ð¨»@?©»@",
  0x40bba8f0 "\"device\" <911>", 0x40bba93f "", 0x0, 0x40bba93f "",
  0x40203f40 "H\036\023", 0x80f9263 "\"%s\" <%s>",
  0x40bba8dc "°Ý\025\bØ\001\023\b", 0x40bba8ac "Ȩ»@\004ù\021@ð¨»@P",
  0x4013b010 "\213\215\fÿÿÿ\211Â9\2150ÿÿÿt\t\213µ(ÿÿÿÆ\006",
  0x40bba7c0 "\001\200­ûð¨»@ð¨»@ð¨»@ð¨»@þ¨»@?©»@ð¨»@?©»@",
  0x80f9263 "\"%s\" <%s>", 0x40bba8e4 "", 0x40bba8f0 "\"device\" <911>", 0x0,
  0x40bba860 "", 0x40bba7c0 "\001\200­ûð¨»@ð¨»@ð¨»@ð¨»@þ¨»@?©»@ð¨»@?©»@",
  0xfbad8001 <Address 0xfbad8001 out of bounds>,
  0x40bba8f0 "\"device\" <911>", 0x40bba8f0 "\"device\" <911>",
  0x40bba8f0 "\"device\" <911>", 0x40bba8f0 "\"device\" <911>", 0x40bba8fe "",
  0x40bba93f "", 0x40bba8f0 "\"device\" <911>", 0x40bba93f "",
  0x0 <repeats 14 times>, 0xffffffff <Address 0xffffffff out of bounds>,
  0x0 <repeats 13 times>, 0x401fcac0 "", 0x0 <repeats 18 times>,
  0x40203f40 "H\036\023", 0x815f378 "\"device\" <911>", 0x81301d8 "911",
  0x40bba8c8 "ȵ \brø\t\bð¨»@P",
  0x4011f904 "\213]ü\211ì]Ã\220\220\220\220\220U\211å\203ì\020\211]ü\213U\f\215M\020èy~üÿ\201Ã\034F\016", 0x40bba8f0 "\"device\" <911>",
---Type <return> to continue, or q <return> to quit---
  0x50 <Address 0x50 out of bounds>, 0x80f9263 "\"%s\" <%s>",
  0x40bba8dc "°Ý\025\bØ\001\023\b", 0x40bba8f0 "\"device\" <911>",
  0x820b5c8 "IAX2/911-11", 0x809f872 "\017¶D$ \211ò\215L$ »P",
  0x40bba8f0 "\"device\" <911>", 0x50 <Address 0x50 out of bounds>,
  0x80f9263 "\"%s\" <%s>", 0x815ddb0 "device", 0x81301d8 "911", 0x0, 0x0,
  0x40204b80 "xK @xK @\200K @\200K @ð\204!\bð\204!\b\220K @\220K @\230K @\230K @ K @ K @¨K @¨K @°K @°K @¸K @¸K @ÀK @ÀK @ÈK @ÈK @ÐK @ÐK @ØK @ØK @àK @àK @èK @èK @ðK @ðK @øK @øK @", 0x76656422 <Address 0x76656422 out of bounds>,
  0x22656369 <Address 0x22656369 out of bounds>,
  0x31393c20 <Address 0x31393c20 out of bounds>,
  0x3e31 <Address 0x3e31 out of bounds>, 0x0 <repeats 11 times>,
  0x809f2ed "\213T$\030\213L$\034\211\223\200\002",
  0x40bba948 "²½\016E°©»@ȵ \b\030· \b\f¸ \bÊè\b\bȵ \b", 0x0, 0x0, 0x0}
        passdata = "|q", '\0' <repeats 8189 times>
        stacklen = 1
        tmp = "ChanSpy", '\0' <repeats 72 times>
        tmp2 = "IAX2/911-11", '\0' <repeats 68 times>
        tmp3 = "|q", '\0' <repeats 8189 times>
        atmp = '\0' <repeats 79 times>
        atmp2 = '\0' <repeats 8291 times>
#6  0x0808e8ca in __ast_pbx_run (c=0x820b5c8) at pbx.c:2230
        digit = 0
        exten = '\0' <repeats 255 times>
---Type <return> to continue, or q <return> to quit---
        pos = 0
        waittime = 1086040496
        res = 0
#7  0x0808f5bf in pbx_thread (data=0xdec580bb) at pbx.c:2517
No locals.
#8  0x40022b63 in start_thread () from /lib/tls/libpthread.so.0
No symbol table info available.
#9  0x401aa18a in clone () from /lib/tls/libc.so.6
No symbol table info available.

(gdb) thread apply all bt

Thread 18 (process 29743):
#0  0x401a1523 in poll () from /lib/tls/libc.so.6
#1  0x080b53ee in main (argc=0, argv=0xbffffd84) at asterisk.c:2440

Thread 17 (process 29745):
#0  0x401a1523 in poll () from /lib/tls/libc.so.6
#1  0x080b9cb6 in listener (unused=0x0) at asterisk.c:594
#2  0x40022b63 in start_thread () from /lib/tls/libpthread.so.0
#3  0x401aa18a in clone () from /lib/tls/libc.so.6

Thread 16 (process 29746):
#0  0x40025295 in pthread_cond_wait@@GLIBC_2.3.2 ()
   from /lib/tls/libpthread.so.0
#1  0x080c8f85 in do_devstate_changes (data=0x0) at lock.h:635
#2  0x40022b63 in start_thread () from /lib/tls/libpthread.so.0
#3  0x401aa18a in clone () from /lib/tls/libc.so.6

Thread 15 (process 29747):
#0  0x4017b99c in nanosleep () from /lib/tls/libc.so.6
#1  0x401a428a in usleep () from /lib/tls/libc.so.6
#2  0x4038e8cb in monmp3thread (data=0x81309b8) at res_musiconhold.c:512
#3  0x40022b63 in start_thread () from /lib/tls/libpthread.so.0
---Type <return> to continue, or q <return> to quit---
#4  0x401aa18a in clone () from /lib/tls/libc.so.6

Thread 14 (process 29749):
#0  0x401a3a27 in select () from /lib/tls/libc.so.6
#1  0x403f83e1 in do_parking_thread (ignore=0x0) at channel.h:1149
#2  0x40022b63 in start_thread () from /lib/tls/libpthread.so.0
#3  0x401aa18a in clone () from /lib/tls/libc.so.6

Thread 13 (process 29750):
#0  0x4017b99c in nanosleep () from /lib/tls/libc.so.6
#1  0x4017b7af in sleep () from /lib/tls/libc.so.6
#2  0x4044e44c in scan_thread (unused=0x0) at pbx_spool.c:364
#3  0x40022b63 in start_thread () from /lib/tls/libpthread.so.0
#4  0x401aa18a in clone () from /lib/tls/libc.so.6

Thread 12 (process 29751):
#0  0x401a1523 in poll () from /lib/tls/libc.so.6
#1  0x080557b4 in ast_io_wait (ioc=0x8141620, howlong=-4) at io.c:271
#2  0x4049bc4f in network_thread (ignore=0x0) at pbx_dundi.c:2106
#3  0x40022b63 in start_thread () from /lib/tls/libpthread.so.0
#4  0x401aa18a in clone () from /lib/tls/libc.so.6

Thread 11 (process 29752):
---Type <return> to continue, or q <return> to quit---
#0  0x4017b99c in nanosleep () from /lib/tls/libc.so.6
#1  0x4017b7af in sleep () from /lib/tls/libc.so.6
#2  0x4049bd78 in process_precache (ign=0x0) at pbx_dundi.c:2146
#3  0x40022b63 in start_thread () from /lib/tls/libpthread.so.0
#4  0x401aa18a in clone () from /lib/tls/libc.so.6

Thread 10 (process 29753):
#0  0x401a1523 in poll () from /lib/tls/libc.so.6
#1  0x080557b4 in ast_io_wait (ioc=0x8153120, howlong=-4) at io.c:271
#2  0x4057c6b9 in do_monitor (data=0x0) at chan_sip.c:11536
#3  0x40022b63 in start_thread () from /lib/tls/libpthread.so.0
#4  0x401aa18a in clone () from /lib/tls/libc.so.6

Thread 9 (process 29754):
#0  0x401a1523 in poll () from /lib/tls/libc.so.6
#1  0x080557b4 in ast_io_wait (ioc=0x8153e10, howlong=-4) at io.c:271
#2  0x40607514 in do_monitor (data=0x0) at chan_mgcp.c:3441
#3  0x40022b63 in start_thread () from /lib/tls/libpthread.so.0
#4  0x401aa18a in clone () from /lib/tls/libc.so.6

Thread 8 (process 29755):
#0  0x401a1523 in poll () from /lib/tls/libc.so.6
#1  0x080557b4 in ast_io_wait (ioc=0x8156f08, howlong=-4) at io.c:271
---Type <return> to continue, or q <return> to quit---
#2  0x40663011 in network_thread (ignore=0x0) at chan_iax2.c:8091
#3  0x40022b63 in start_thread () from /lib/tls/libpthread.so.0
#4  0x401aa18a in clone () from /lib/tls/libc.so.6

Thread 7 (process 29756):
#0  0x400278ae in accept () from /lib/tls/libpthread.so.0
#1  0x407f858b in accept_thread (ignore=0x0) at chan_skinny.c:2944
#2  0x40022b63 in start_thread () from /lib/tls/libpthread.so.0
#3  0x401aa18a in clone () from /lib/tls/libc.so.6

Thread 6 (process 29757):
#0  0x401a1523 in poll () from /lib/tls/libc.so.6
#1  0x080557b4 in ast_io_wait (ioc=0x8162780, howlong=-4) at io.c:271
#2  0x407f87f4 in do_monitor (data=0x0) at chan_skinny.c:2994
#3  0x40022b63 in start_thread () from /lib/tls/libpthread.so.0
#4  0x401aa18a in clone () from /lib/tls/libc.so.6

Thread 5 (process 29758):
#0  0x401a3a27 in select () from /lib/tls/libc.so.6
#1  0x40888f11 in sound_thread (arg=0x8164a40) at channel.h:1149
#2  0x40022b63 in start_thread () from /lib/tls/libpthread.so.0
#3  0x401aa18a in clone () from /lib/tls/libc.so.6

---Type <return> to continue, or q <return> to quit---
Thread 4 (process 29759):
#0  0x401a3a27 in select () from /lib/tls/libc.so.6
#1  0x408da2e8 in do_monitor (data=0x0) at channel.h:1149
#2  0x40022b63 in start_thread () from /lib/tls/libpthread.so.0
#3  0x401aa18a in clone () from /lib/tls/libc.so.6

Thread 3 (process 29761):
#0  0x401a1523 in poll () from /lib/tls/libc.so.6
#1  0x080ba763 in netconsole (vconsole=0x812b740) at asterisk.c:543
#2  0x40022b63 in start_thread () from /lib/tls/libpthread.so.0
#3  0x401aa18a in clone () from /lib/tls/libc.so.6

Thread 2 (process 29763):
#0  0x401a1523 in poll () from /lib/tls/libc.so.6
#1  0x08060ef7 in ast_waitfor_nandfds (c=0x40b6bf20, n=2, fds=0x0, nfds=0,
    exception=0x0, outfd=0x0, ms=0x40b6bf14) at channel.c:1628
#2  0x08068c01 in ast_generic_bridge (c0=0x8150e08, c1=0x815d8a8,
    config=0x40b6c5f0, fo=0x40b6c0b8, rc=0x40b6c0bc, bridge_end=
      {tv_sec = 0, tv_usec = 0}) at channel.c:1705
#3  0x08065362 in ast_channel_bridge (c0=0x8150e08, c1=0x815d8a8,
    config=0x40b6c5f0, fo=0x40b6c0b8, rc=0x40b6c0bc) at channel.c:3644
#4  0x403f5c69 in ast_bridge_call (chan=0x8150e08, peer=0x815d8a8,
    config=0x40b6c5f0) at res_features.c:1329
---Type <return> to continue, or q <return> to quit---
#5  0x409203e1 in dial_exec_full (chan=0x8150e08, data=0x40b6c5f0,
    peerflags=0x40b6cca8) at app_dial.c:1607
#6  0x4091eea5 in dial_exec (chan=0xfffffffc, data=0xfffffffc)
    at app_dial.c:1649
#7  0x0808dd25 in pbx_extension_helper (c=0x8150e08, con=0xfffffffc,
    context=0x8150f58 "macro-dialout-trunk", exten=0x815104c "s", priority=14,
    label=0x0, callerid=0x40b77740 "dialout-trunk|6|0041612719506|",
    action=136022840) at pbx.c:553
#8  0x0808c444 in ast_spawn_extension (c=0xfffffffc,
    context=0xfffffffc <Address 0xfffffffc out of bounds>,
    exten=0xfffffffc <Address 0xfffffffc out of bounds>, priority=-4,
    callerid=0xfffffffc <Address 0xfffffffc out of bounds>) at pbx.c:2230
#9  0x409a4a8d in macro_exec (chan=0x8150e08, data=0xe) at app_macro.c:215
#10 0x0808dd25 in pbx_extension_helper (c=0x8150e08, con=0xfffffffc,
    context=0x8150f58 "macro-dialout-trunk", exten=0x815104c "s", priority=1,
    label=0x0, callerid=0x0, action=0) at pbx.c:553
#11 0x0808e8ca in __ast_pbx_run (c=0x8150e08) at pbx.c:2230
#12 0x0808f5bf in pbx_thread (data=0xfffffffc) at pbx.c:2517
#13 0x40022b63 in start_thread () from /lib/tls/libpthread.so.0
#14 0x401aa18a in clone () from /lib/tls/libc.so.6

Thread 1 (process 29768):
#0  0x40143d89 in free () from /lib/tls/libc.so.6
---Type <return> to continue, or q <return> to quit---
#1  0x0805a74d in ast_frfree (fr=0x40203f40) at frame.c:277
#2  0x080604be in ast_channel_spy_free (spy=0x40bb3fd0) at channel.c:1111
#3  0x40a2f7e2 in channel_spy (chan=0x820b5c8, spyee=0x8150e08,
    volfactor=0x40bb4104, fd=-557481797) at app_chanspy.c:341
#4  0x40a2f0e2 in chanspy_exec (chan=0x820b5c8, data=0x8150e08)
    at app_chanspy.c:508
#5  0x0808dd25 in pbx_extension_helper (c=0x820b5c8, con=0xdec580bb,
    context=0x820b718 "from-spy-phone", exten=0x820b80c "007", priority=1,
    label=0x0, callerid=0x0, action=0) at pbx.c:553
#6  0x0808e8ca in __ast_pbx_run (c=0x820b5c8) at pbx.c:2230
#7  0x0808f5bf in pbx_thread (data=0xdec580bb) at pbx.c:2517
#8  0x40022b63 in start_thread () from /lib/tls/libpthread.so.0
#9  0x401aa18a in clone () from /lib/tls/libc.so.6