PCAP breakdown:

127.0.0.1:5060 kamailio
127.0.21.1:5080/127.0.0.1:5080 asterisk
192.168.89.145 rtpengine

Frame 1: ingress INVITE from kamailio to asterisk - RTP source 192.168.89.145:20254
Frame 3: 183 reply - RTP source 127.0.0.1:11788
Frame 6: egress INVITE from asterisk to kamailio - RTP source 127.0.0.1:13154
Frame 8: 183 reply - RTP source 192.168.89.145:20270

At this point, there is a single RTP stream:
192.168.89.145:20270 -> 127.0.0.1:13154 SSRC 0x7aca9aca (rtpengine -> asterisk)

Frames 96/97: first RTP packets sent by asterisk back to rtpengine, causing rtpengine to switch destination to match source of RTP

At this point there are the two egress media streams:
192.168.89.145:20270 -> 192.168.89.145:13154 SSRC 0x7aca9aca (rtpengine -> asterisk)
192.168.89.145:20270 <- 192.168.89.145:13154 SSRC 0x4fcafe60 (rtpengine <- asterisk)

Frame 220: rtpengine changes SSRC
192.168.89.145:20270 -> 192.168.89.145:13154 SSRC 0xd48335f9 (rtpengine -> asterisk)
192.168.89.145:20270 <- 192.168.89.145:13154 SSRC 0x4fcafe60 (rtpengine <- asterisk)

Frame 249: asterisk changes SSRC
192.168.89.145:20270 -> 192.168.89.145:13154 SSRC 0xd48335f9 (rtpengine -> asterisk)
192.168.89.145:20270 <- 192.168.89.145:13154 SSRC 0x57a63f93 (rtpengine <- asterisk)

Frame 964: ingress re-INVITE to put call on hold (Media Attribute (a): inactive)

At this point we still have the two egress media streams (regular media from rtpengine and asterisk playing music-on-hold), but asterisk has changed SSRC (back to previous SSRC):
192.168.89.145:20270 -> 192.168.89.145:13154 SSRC 0xd48335f9 (rtpengine -> asterisk)
192.168.89.145:20270 <- 192.168.89.145:13154 SSRC 0x4fcafe60 (rtpengine <- asterisk)

Frame 2109: new ingress INVITE from kamailio to asterisk (to new destination) - RTP source 192.168.89.145:20254
Frame 2116: 183 reply - RTP source 127.0.0.1:11630
Frame 2210: additional 183 reply - RTP source 127.0.0.1:11630
Frame 2211: egress INVITE from asterisk to kamailio - RTP source 127.0.0.1:17416
Frame 2317: 183 reply - RTP source 192.168.89.145:20296

At this point, there is a single RTP stream:
192.168.89.145:20296 -> 127.0.0.1:17416 SSRC 0x47473691 (rtpengine -> asterisk)

Frame 2596: first RTP packet sent by asterisk back to rtpengine, causing rtpengine to switch destination to match source of RTP

At this point there are the two egress media streams:
192.168.89.145:20296 -> 192.168.89.145:17416 SSRC 0x47473691 (rtpengine -> asterisk)
192.168.89.145:20296 <- 192.168.89.145:17416 SSRC 0x2823cdb1 (rtpengine <- asterisk)

Frame 2969: rtpengine changes SSRC
192.168.89.145:20296 -> 192.168.89.145:17416 SSRC 0x38002049 (rtpengine -> asterisk)
192.168.89.145:20296 <- 192.168.89.145:17416 SSRC 0x2823cdb1 (rtpengine <- asterisk)

Frame 3282: asterisk changes SSRC
192.168.89.145:20296 -> 192.168.89.145:17416 SSRC 0x38002049 (rtpengine -> asterisk)
192.168.89.145:20296 <- 192.168.89.145:17416 SSRC 0xc19cd8dd (rtpengine <- asterisk)

At this point we have the original call on hold, with asterisk playing music-on-hold on the egress channel and the second replacement call with bi-direction media.

Frame 5707: new ingress INVITE from kamailio that replaces the original ingress INVITE - RTP source 192.168.89.145:20312
Frame 5709: 200 reply - RTP source 127.0.0.1:11850
Frame 5711: BYE from asterisk to drop original original call ingress leg
Frame 5723: 200 reply from kamailio

At this point the issue occurs on the original call egress leg.

Frame 5743: asterisk begins a new media stream after the ingress call has been replaced
192.168.89.145:20270 <- 192.168.89.145:13154 SSRC 0x7006951b Seq 23124 Time 161144710 (rtpengine <- asterisk)

BUT, asterisk continues to send music on hold in this stream (along with the the replacement call's media)
e.g. Frame 5746 continues the Seq and Time from frame 5742
192.168.89.145:20270 <- 192.168.89.145:13154 SSRC 0x7006951b Seq 27801 Time 13883048 (rtpengine <- asterisk)

There are now TWO media streams (the original music on hold and the new replacement call's media stream), both on the same SSRC (0x7006951b) and same UDP ports, but with different sequence numbering and timestamps.