[BUG] dialog:dlg_onreq_out: wrongfully increasing callee_leg

[FlyingDutchfrog]

OpenSIPS version you are running

version: opensips 3.6.7 (x86_64/linux)
flags: STATS: On, DISABLE_NAGLE, USE_MCAST, SHM_MMAP, PKG_MALLOC, Q_MALLOC, F_MALLOC, HP_MALLOC, F_PARALLEL_MALLOC, DBG_MALLOC, FAST_LOCK-ADAPTIVE_WAIT
ADAPTIVE_WAIT_LOOPS=1024, MAX_RECV_BUFFER_SIZE 262144, MAX_LISTEN 16, MAX_URI_SIZE 1024, BUF_SIZE 65535
poll method support: poll, epoll, sigio_rt, select.
git revision: 6c392ee7c0
main.c compiled on 11:20:08 Jun 22 2026 with cc 10

Describe the bug

While processing a call with multiple legs this CRITICAL log appears at the end of or immediately after branch_route{}. It doesn't seem to affect the calls themselves, but the log also directly told me to open a ticket here...

To Reproduce

Have a call that opens more than one call leg, usually due to one of the next hops replying with 100 and 480/488, therefore opening a new call leg and trying the next gateway.

Expected behavior

Not wrongfully increasing the callee_leg.

Relevant System Logs

opensips[183721]: Jun 23 09:12:22 [183721] NOTICE::: 6c3ed577-e986-123f-9fa2-a8a159689b8d :: Sending Call from Socket udp:123.456.123.456:5060 with Timeout 1800
opensips[183721]: Jun 23 09:12:22 [183721] CRITICAL:dialog:dlg_onreq_out:
opensips[183721]: >>> wrongfully increasing callee_leg 3/7
opensips[183721]: It seems you have hit a programming bug.
opensips[183721]: Please help us make OpenSIPS better by reporting it at https://github.com/OpenSIPS/opensips/issues

That first NOTICE log is the very last thing happening in branch_route {}

OS/environment information

• Operating System: Linux 5.10.0-43-cloud-amd64 #1 SMP Debian 5.10.251-5 (2026-05-15) x86_64 GNU/Linux
• OpenSIPS installation: git clone https://github.com/OpenSIPS/opensips.git --recursive -b 3.6 opensips-3.6, make menuconfig
• other relevant information: this seems to be the file in question, at line 1579.

[bogdan-iancu]

Hi @FlyingDutchfrog , can you detail a bit more on how you do cseq changes in your script ? Maybe a minimal script showing the issue will be very helpful.

[FlyingDutchfrog]

Hi @bogdan-iancu ,
I'd gladly provide you with a stripped down config, but this will take some time as my schedule is somewhat full atm.

[bogdan-iancu]

Hi @FlyingDutchfrog , no rush, you will find me here :)

[ovidiusas]

There’s no need for special config. This is happening on serial call forking if one intermediate leg is replying with a non 100 provisional reply (180 or 183) followed by a negative final reply, then the final leg is successful. The intermediate failed leg that had a 18x response is creating an internal dialog leg, hence the error log.

[FlyingDutchfrog]

i can confirm that there were non-100-responses like 180/183 in those calls before opensips received a 408 triggering the use_next_gw()

[bogdan-iancu]

So something like this:

• INVITE comes in
• INVITE sent to dst A
• dst A generates 180
• dst A generates 486/408
• in failure route, you send the INVITE to dst B
• you get the error

Is this correct ?

[FlyingDutchfrog]

yes that is correct. if we want to be über-correct: there was a 100 trying before the 180:

• INVITE comes in
• INVITE sent to dst A
• dst A generates 100
• dst A generates 180/181/183
• dst A generates 486/408/488
• in failure route, we send the INVITE to dst B
• you get the error <- happens at the very end or immediately after branch_route{}

[bogdan-iancu]

ok, let me try to re-produce this

[bogdan-iancu]

btw, as dialog support, you just create the dialog, nothing more than that, right ?

[FlyingDutchfrog]

yes, with create_dialog("B"). for replys we use match_dialog(), but that doesnt apply for this issue i think.