As there can be multiple unacknowledged reliable responses within an INVITE transaction, B2buaInviteFSM has a machine array of HandlePrackFSM. However, HandlePrackFSM does not check that a received response to PRACK matches the PRACK it sent out in the following transitions:
110 transition AWAIT_PRACK_RESPONSE - callee ? PrackSuccessResponse / {
116 transition AWAIT_PRACK_RESPONSE - callee ? PrackErrorResponse / {
These transitions should have guards to check that the CSeq in response matches the CSeq in the PRACK sent earlier on the callee port.
Actually before the response to PRACK, this machine fragment should also match a received PRACK to the reliable provisional response sent in the following transition:
101 transition INIT - caller ? Prack / {
The RAck header in the PRACK should match the RSeq, CSeq and method in the reliable response. See RFC3262 bottom of page 4.