If I didn't know any better, it would appear that particular B2F forward session that Charles gave me the debug info for, received a message with a header containing NO 'To:' field. Looking at the existing code, that's very likely why JNOS crashed. Anyways, thanks for the gdb dump Charles. Maiko