SPA122 running Beta FW 1.2.0 (Although this bug is present all the way back to 1.0.1)
Start with a completely defaulted ATA. Configure proxy address, sip user, and sip password.
Originate a call from the FXS port. After call is answered by far end, dial with the touch tone pad on the phone. If you dial too quickly, the SPA locks up, and inhibits the forward audio path from the FSX port towards the called party - at least that's how it appears because the called party can't hear you, but you can hear them on the analog phone connected to the FXS port.
I say appears because examining the packet capture - attached - the ATA actually is getting confused into sending a continuous stream of RFC2811 events with an ever increasing event duration. Hanging up and making another call results in normal conversation...until you dial too quickly for it's liking.
It's not possible to duplicate this with a "senderized" phone, like a cordless phone, or any other phone that doesn't let you dial fast, and buffers the digits so they are like 100 ms long. Use a "nomal" 2500 set with a "real" touch tone pad, and all you have to do is dial fast, and it locks the ATA up in this condition. Simple way duplicate this is to dial a call, and rake rapidly down the "2 5 8 0" and the ATA will lock up instantly.
In the attached cap file, I make a call, and answer it. I then dial 1 2 3 4 5 6 slowly. The ATA actually misses the one and the two that I dialed, and doesn't translate them to RFC2833. It does send the 3 4 5 ,and 6 correctly without issue. I then dialed 2 5 8 0 rapidly. It got locked up on the digit 2.
We use these for home based users to dial into our conference bridge, so RFC2833 has to work. We didn't have this problem with the now discontinued SPA-2102s. We saw this issue as soon as we started using the SPA-122's though.