When reported by the initiator, they say it usually happens when the recipient answers. When reported by the recipient, they always say it happens when answering an incoming call. Never happens with an idle phone. After the reboot, the phones work fine.
here is what we found in the error log in one location:
Log Type: Software
Log Number: 1172
Severity: Warning
Date: 2008/Dec/10
Time: 15:10:40
Source: Call Control - Software
Description: call ann. buffer audit recovered buffer 170 owned by non-existent process hex 741E
Module: Main
File Name and Line Number: log_outputs_util_en.c;1595
This is from the log file in the other location:
Log Type: Software
Log Number: 590
Severity: Warning
Date: 2008/Dec/10
Time: 15:10:20
Source: CCC_Ipsw
Description: CompleteFsmRequest: MID:8f787119 CID: 7786e04 PCC[ 0x7786E04 ]: Tx[ IP_TRUNK, PortId:4003, CompId:2, DN:IPTrk ] Rx[ IP_PHONE, PortId=1379, CompId=1, DN:102 ] completed in [ 10060 ] msec in state [ RX_CLOSED ] with a failure [ FSM_RX_CLOSE_TIMEDOUT ]
Module: Main
File Name and Line Number: IPSwSP_fsm.cpp;5176
The first one was the initiator, the second was the recipient. When that fatal exception error shows on the display, a countdown starts from 18 to 0, then the phone reboots.
The two locations are connected via a Point-to-point T1 circuit. Each location has its own ICP. Each location is on a different subnet. It doesn't happen to everyone, just a small select group of users. I've tried replacing several of the phones in the past few days, and am waiting to see if it occurs again at those desk locations.