Index: /pjproject/trunk/pjsip-apps/src/pjsua/pjsua_app.c
===================================================================
--- /pjproject/trunk/pjsip-apps/src/pjsua/pjsua_app.c	(revision 2379)
+++ /pjproject/trunk/pjsip-apps/src/pjsua/pjsua_app.c	(revision 2380)
@@ -2188,4 +2188,7 @@
     ring_start(call_id);
 
+    if (current_call==PJSUA_INVALID_ID)
+	current_call = call_id;
+
     if (app_config.auto_answer > 0) {
 	pjsua_call_answer(call_id, app_config.auto_answer, NULL, NULL);
Index: /pjproject/trunk/pjsip/src/pjsip-ua/sip_inv.c
===================================================================
--- /pjproject/trunk/pjsip/src/pjsip-ua/sip_inv.c	(revision 2379)
+++ /pjproject/trunk/pjsip/src/pjsip-ua/sip_inv.c	(revision 2380)
@@ -2815,4 +2815,9 @@
 		    inv_set_state(inv, PJSIP_INV_STATE_EARLY, e);
 		break;
+	    case PJSIP_TSX_STATE_TERMINATED:
+		/* there is a failure in sending response. */
+		inv_set_cause(inv, tsx->status_code, &tsx->status_text);
+		inv_set_state(inv, PJSIP_INV_STATE_DISCONNECTED, e);
+		break;
 	    default:
 		inv_on_state_incoming(inv, e);
Index: /pjproject/trunk/pjsip/src/pjsip/sip_dialog.c
===================================================================
--- /pjproject/trunk/pjsip/src/pjsip/sip_dialog.c	(revision 2379)
+++ /pjproject/trunk/pjsip/src/pjsip/sip_dialog.c	(revision 2380)
@@ -541,4 +541,5 @@
     if (tsx) {
 	pjsip_tsx_terminate(tsx, 500);
+	pj_assert(dlg->tsx_count>0);
 	--dlg->tsx_count;
     }
@@ -1412,4 +1413,12 @@
     /* Ask transaction to send the response */
     status = pjsip_tsx_send_msg(tsx, tdata);
+
+    /* This function must decrement transmit data request counter 
+     * regardless of the operation status. The transaction only
+     * decrements the counter if the operation is successful.
+     */
+    if (status != PJ_SUCCESS) {
+	pjsip_tx_data_dec_ref(tdata);
+    }
 
     pjsip_dlg_dec_lock(dlg);
@@ -1899,5 +1908,12 @@
 
 
-    if (tsx->state == PJSIP_TSX_STATE_TERMINATED) {
+    /* It is possible that the transaction is terminated and this function
+     * is called while we're calling on_tsx_state(). So only decrement
+     * the tsx_count if we're still attached to the transaction.
+     */
+    if (tsx->state == PJSIP_TSX_STATE_TERMINATED &&
+	tsx->mod_data[dlg->ua->id] == dlg) 
+    {
+	pj_assert(dlg->tsx_count>0);
 	--dlg->tsx_count;
 	tsx->mod_data[dlg->ua->id] = NULL;
Index: /pjproject/trunk/pjsip/src/pjsip/sip_transport.c
===================================================================
--- /pjproject/trunk/pjsip/src/pjsip/sip_transport.c	(revision 2379)
+++ /pjproject/trunk/pjsip/src/pjsip/sip_transport.c	(revision 2380)
@@ -569,6 +569,15 @@
     /* Allocate buffer if necessary. */
     if (tdata->buf.start == NULL) {
-	tdata->buf.start = (char*) 
-			   pj_pool_alloc( tdata->pool, PJSIP_MAX_PKT_LEN);
+	PJ_USE_EXCEPTION;
+
+	PJ_TRY {
+	    tdata->buf.start = (char*) 
+			       pj_pool_alloc(tdata->pool, PJSIP_MAX_PKT_LEN);
+	}
+	PJ_CATCH_ANY {
+	    return PJ_ENOMEM;
+	}
+	PJ_END
+
 	tdata->buf.cur = tdata->buf.start;
 	tdata->buf.end = tdata->buf.start + PJSIP_MAX_PKT_LEN;
Index: /pjproject/trunk/pjsip/src/pjsip/sip_util.c
===================================================================
--- /pjproject/trunk/pjsip/src/pjsip/sip_util.c	(revision 2379)
+++ /pjproject/trunk/pjsip/src/pjsip/sip_util.c	(revision 2380)
@@ -1674,6 +1674,10 @@
     /* Send! */
     status = pjsip_endpt_send_response( endpt, &res_addr, tdata, NULL, NULL );
-
-    return status;
+    if (status != PJ_SUCCESS) {
+	pjsip_tx_data_dec_ref(tdata);
+	return status;
+    }
+
+    return PJ_SUCCESS;
 }
 
Index: /pjproject/trunk/pjsip/src/pjsua-lib/pjsua_call.c
===================================================================
--- /pjproject/trunk/pjsip/src/pjsua-lib/pjsua_call.c	(revision 2379)
+++ /pjproject/trunk/pjsip/src/pjsua-lib/pjsua_call.c	(revision 2380)
@@ -910,10 +910,4 @@
     }
 
-    /* Create and attach pjsua_var data to the dialog: */
-    call->inv = inv;
-
-    dlg->mod_data[pjsua_var.mod.id] = call;
-    inv->mod_data[pjsua_var.mod.id] = call;
-
     /* If account is locked to specific transport, then lock dialog
      * to this transport too.
@@ -926,5 +920,11 @@
     }
 
-    /* Must answer with some response to initial INVITE.
+    /* Must answer with some response to initial INVITE. We'll do this before
+     * attaching the call to the invite session/dialog, so that the application
+     * will not get notification about this event (on another scenario, it is
+     * also possible that inv_send_msg() fails and causes the invite session to
+     * be disconnected. If we have the call attached at this time, this will
+     * cause the disconnection callback to be called before on_incoming_call()
+     * callback is called, which is not right).
      */
     status = pjsip_inv_initial_answer(inv, rdata, 
@@ -944,6 +944,14 @@
 	if (status != PJ_SUCCESS) {
 	    pjsua_perror(THIS_FILE, "Unable to send 100 response", status);
-	}
-    }
+	    PJSUA_UNLOCK();
+	    return PJ_TRUE;
+	}
+    }
+
+    /* Create and attach pjsua_var data to the dialog: */
+    call->inv = inv;
+
+    dlg->mod_data[pjsua_var.mod.id] = call;
+    inv->mod_data[pjsua_var.mod.id] = call;
 
     ++pjsua_var.call_cnt;
@@ -3726,7 +3734,14 @@
 					    pjsip_event *e)
 {
-    pjsua_call *call = (pjsua_call*) inv->dlg->mod_data[pjsua_var.mod.id];
+    pjsua_call *call;
 
     PJSUA_LOCK();
+
+    call = (pjsua_call*) inv->dlg->mod_data[pjsua_var.mod.id];
+
+    if (call == NULL) {
+	PJSUA_UNLOCK();
+	return;
+    }
 
     /* Notify application callback first */
