Index: channels/chan_sip.c
===================================================================
--- channels/chan_sip.c	(revision 342013)
+++ channels/chan_sip.c	(working copy)
@@ -25027,6 +25027,7 @@
 		peer_mailboxes_to_str(&mailbox_str, peer);
 		ast_app_inboxcount(mailbox_str->str, &newmsgs, &oldmsgs);
 	}
+	ref_peer(peer, "sip_send_mwi_to_peer");
 	ao2_lock(peer);
 
 	if (peer->mwipvt) {
@@ -25036,6 +25037,7 @@
 		/* Build temporary dialog for this message */
 		if (!(p = sip_alloc(NULL, NULL, 0, SIP_NOTIFY, NULL))) {
 			ao2_unlock(peer);
+			unref_peer(peer, "sip_send_mwi_to_peer");
 			return -1;
 		}
 
@@ -25050,11 +25052,13 @@
 			dialog_unref(p, "unref dialog p just created via sip_alloc");
 			/* sip_destroy(p); */
 			ao2_unlock(peer);
+			unref_peer(peer, "sip_send_mwi_to_peer");
 			return 0;
 		}
 		/* Recalculate our side, and recalculate Call ID */
 		ast_sip_ouraddrfor(&p->sa, &p->ourip, p);
 		build_via(p);
+		dialog_ref(p, "change callid ref");
 		ao2_t_unlink(dialogs, p, "About to change the callid -- remove the old name");
 		build_callid_pvt(p);
 		if (!ast_strlen_zero(peer->mwi_from)) {
@@ -25063,6 +25067,7 @@
 			ast_string_field_set(p, mwi_from, default_mwi_from);
 		}
 		ao2_t_link(dialogs, p, "Linking in under new name");
+		dialog_unref(p, "change callid ref");
 		/* Destroy this session after 32 secs */
 		sip_scheddestroy(p, DEFAULT_TRANS_TIMEOUT);
 	}
@@ -25078,6 +25083,7 @@
 	sip_pvt_unlock(p);
 	dialog_unref(p, "unref dialog ptr p just before it goes out of scope at the end of sip_send_mwi_to_peer.");
 	ao2_unlock(peer);
+	unref_peer(peer, "sip_send_mwi_to_peer");
 	return 0;
 }