My phone is located behind a NAT, 172.16.0.0/21. Asterisk 16 is on a public IP. PJSIP has the config below:
force_rport=yes direct_media=yes disable_direct_media_on_nat = yes direct_media_method=invite

But when I send a call I see the RTP being sent to my private address, vs the public IP. This only happens when Asterisk has dialed the call to another carrier. If instead of Dial I choose Answer() and MusicOnHold, then the RTP gets shipped to the right address. This is a sample of the erroneous behavior:
Got RTP packet from XX.XX.XX.XX:17510 (type 00, seq 024786, ts 017440, len 000160)
Sent RTP packet to 172.16.7.254:50798 (type 00, seq 010736, ts 017440, len 000160)

172.16.7.254 is my private address. What am I missing? Should I open a bug?
Asterisk should never, ever send RTP to a private address when Asterisk itself is on a public IP. Before you ask, the dialplan is 3 lines,
‘_X.’ => 1. NoOP()
2. Dial(PJSIP/${EXTEN}@carrier)
3. Hangup()