Another Bug? OpenAT 3.03 ADL, RTE, wm_sndTonePlay

Hi,

This very simple program crashes the RTE:

#include "adl_global.h"
#include "wm_snd.h"

u32 wm_apmCustomStack [ 256 ];
const u16 wm_apmCustomStackSize = sizeof ( wm_apmCustomStack );

void Cmd_TONE_Handler ( adl_atCmdPreParser_t * paras )
{
    switch ( paras->Type )
    {
        case ADL_CMD_TYPE_TEST :
            adl_atSendResponse ( ADL_AT_PORT_TYPE ( paras->Port, ADL_AT_RSP ), "\r\n+TONE: (1-3999),(1-255),(0-15)\r\n" );
            adl_atSendStdResponse ( ADL_AT_PORT_TYPE ( paras->Port, ADL_AT_RSP ), ADL_STR_OK );
        break;

	case ADL_CMD_TYPE_PARA :
        {
            ascii *p;
	    s32 result;
            u16 Frequency; u8 Duration; u8 Gain;
            
            p = ADL_GET_PARAM ( paras, 0 );
            Frequency = (u16)wm_atoi((void*)p);
            p = ADL_GET_PARAM ( paras, 1 );
            Duration = (u8)wm_atoi((void*)p);
            p = ADL_GET_PARAM ( paras, 2 );
            Gain = (u8)wm_atoi((void*)p);

	    if ( (Frequency>0) && (Frequency<4000) && (Duration>0) && (Gain<16) ) {
              result = wm_sndTonePlay ( WM_SND_DEST_SPEAKER, Frequency, Duration, Gain );
	      if (result>=0)
                adl_atSendStdResponse ( ADL_AT_PORT_TYPE ( paras->Port, ADL_AT_RSP ), ADL_STR_OK );
	      else
                adl_atSendResponse ( ADL_AT_PORT_TYPE ( paras->Port, ADL_AT_RSP ), "\r\n+TONE ERROR\r\n" );
	    } else
              adl_atSendResponse ( ADL_AT_PORT_TYPE ( paras->Port, ADL_AT_RSP ), "\r\n+CME ERROR: 3\r\n" );
        }    
        break;
    }
}

void adl_main ( adl_InitType_e  InitType )
{
    TRACE (( 1, "Embedded : Appli Init" ));
    adl_atCmdSubscribe("at+tone", Cmd_TONE_Handler, ADL_CMD_TYPE_TEST | ADL_CMD_TYPE_PARA | 0x0033 );
}

with this error

after I enter the last line here

+WIND: 13

+WIND: 0

+WIND: 7

+CGREG: 0

+CREG: 0

+CGREG: 0
at+tone=?

+TONE: (1-3999),(1-255),(0-15)

OK
at+tone=2000,5,0

I checked with the debugger, the crash is in the line with the wm_sndTonePlay call! Everything else including the extraction of the parameters works fine.

What is going on here?

Best Regards,
Jan