Index: channels/chan_iax2.c
===================================================================
--- channels/chan_iax2.c	(revision 150685)
+++ channels/chan_iax2.c	(working copy)
@@ -1650,9 +1650,17 @@
 		/* This will occur on the first response to a message that we initiated,
 		 * such as a PING. */
 		if (callno && dcallno && iaxs[dcallno] && !iaxs[dcallno]->peercallno && match(sin, callno, dcallno, iaxs[dcallno], check_dcallno)) {
-			iaxs[dcallno]->peercallno = callno;
-			res = dcallno;
-			store_by_peercallno(iaxs[dcallno]);
+			ast_mutex_lock(&iaxsl[dcallno]);
+			/* I know we just checked it, but it can disappear that fast, when we
+			 * don't have a lock on it. */
+			if (iaxs[dcallno]) {
+				iaxs[dcallno]->peercallno = callno;
+				res = dcallno;
+				store_by_peercallno(iaxs[dcallno]);
+			}
+			if (!res || !return_locked) {
+				ast_mutex_unlock(&iaxsl[dcallno]);
+			}
 			return res;
 		}