diff -ur ../clean/asterisk-1.4.24.1/channels/chan_sip.c asterisk-1.4.24.1/channels/chan_sip.c
--- ../clean/asterisk-1.4.24.1/channels/chan_sip.c	2009-04-02 19:20:22.000000000 +0200
+++ asterisk-1.4.24.1/channels/chan_sip.c	2009-05-19 15:28:03.000000000 +0200
@@ -14027,8 +14027,12 @@
 	if (!oneleggedreplace)
 		ast_channel_unlock(c);
 
-	/* Unlock PVT */
-	ast_mutex_unlock(&p->refer->refer_call->lock);
+	/* Unlock PVT And Channel*/
+	if (p->refer->refer_call) {
+		ast_mutex_unlock(&p->refer->refer_call->lock);
+		if (p->refer->refer_call->owner)
+			ast_channel_unlock(p->refer->refer_call->owner);
+	}
 
 	/* Make sure that the masq does not free our PVT for the old call */
 	if (! earlyreplace && ! oneleggedreplace )
Only in asterisk-1.4.24.1/channels: chan_sip.c~
diff -ur ../clean/asterisk-1.4.24.1/main/channel.c asterisk-1.4.24.1/main/channel.c
--- ../clean/asterisk-1.4.24.1/main/channel.c	2009-05-19 15:29:19.000000000 +0200
+++ asterisk-1.4.24.1/main/channel.c	2009-05-19 15:28:03.000000000 +0200
@@ -2039,12 +2039,6 @@
 		usleep(1);
 	}
 
-	if (chan->fdno == -1) {
-		ast_log(LOG_ERROR, "ast_read() called with no recorded file descriptor.\n");
-		f = &ast_null_frame;
-		goto done;
-	}
-
 	if (chan->masq) {
 		if (ast_do_masquerade(chan))
 			ast_log(LOG_WARNING, "Failed to perform masquerade\n");
@@ -2053,6 +2047,12 @@
 		goto done;
 	}
 
+	if (chan->fdno == -1) {
+		ast_log(LOG_ERROR, "ast_read() called with no recorded file descriptor.\n");
+		f = &ast_null_frame;
+		goto done;
+	}
+
 	/* Stop if we're a zombie or need a soft hangup */
 	if (ast_test_flag(chan, AST_FLAG_ZOMBIE) || ast_check_hangup(chan)) {
 		if (chan->generator)