Did you figure this out?

If not -- save a PCAP of each leg + the FS log for us to look at.

Also.. since you've been looking at this: can I somehow use spandsp_start_dtmf to just strip the DTMF from inband? I've got an uncooperative carrier who's been sending rfc2833 and usually inband also and that messes up when I bridge to a remote system... I already have the dtmf in rfc2833, I don't want it duplicated, just removed.