It is broken a little bit. Well, not exactly app_fax, but as it is the only foss component using chan_sip/udptl one might conclude that app_fax is the broken one. In fact it is chan_sip T.38 negotiation that is broken. It does not take in account that udptl does not have one very important variable initialized and relies on optional attribute in sdp to set that variable. If this attribute is not sent by far end, udptl spits out warning and goes on allocating buffer of size -1. Which leads to segfault mentioned in my previous post.