Core dump in ast_channel_destructor()?

I am writing a custom channel driver. To get the ball rolling, I have stubbed out foo_hangup() as

static int foo_hangup()
{
    return -1;
}

…and created a dial plan in which SIP phones that dial 500 try to make a call over the new channel.

I get a core dump in method ast_channel_destructor(), when it attempts to free the tech_pvt data:

if (chan->tech_pvt) {
    ast_log(LOG_WARNING, "Channel '%s' may not have been hung up properly\n", chan->name);
    ast_free(chan->tech_pvt);
}

I’m pretty sure that what is happening is that the heap used by ast_channel_destructor is not the same as the heap used to allocate tech_pvt, and I think that would usually be the case.

Isn’t this code pretty much guaranteed to dump core every time that the block is entered? (Which, presumably, would be hardly ever…)

I’m working around the issue by having my stub hangup method reduce the ref count on tech_pvt, and then setting
chan->tech_pvt to NULL.

I’m a total noob to asterisk, so my apologies if this is dumb or wrong-headed. If you could point me to any study materials on channel drivers, I’d be grateful.

You need to take this to the developer mailing list, and also need to be precise about the version used.

It may well be that this is code left over from the move to the, reference counted, ao2 memory management system, which will only be reached as a secondary error.