There is a stack buffer overflow in Shannon Baseband when processing the Via header in the SIP protocol decoder (IMSPL_SipDecode.c according to the debug strings in the firmware image).
0afa5f6ef5d703a73b0521ecca5d80bc302663f045296001e5c9f592b245d7f9