Now that the redirect hangup problem is fixed, I retested receiving a fax. I received a segfault. I'm hoping someone from Digium is monitoring this so that they can look into the bug. Or perhaps someone can tell me where this should be posted. It's not an Asterisk bug.
Problem: After the fax is received (successfully I might add), the Digium code calls __ast_manager_event_multichan(), a variadic function (which is in asterisk/main/manager.c). I believe this function sends manager events. If there are any manager hooks registered, then this code builds the event to send to that hook.
This function takes a format string in the printf style. The beginning of the string, which is rather long, contains "Channel: %s\r\n" indicating that the first variable to substitute should be a string. However, the first value sent into the variable argument portion of __ast_manager_event_multichan() appears to be a 1. The third through fifth arguments are strings that appear to match the format string. Just this one (the first) value is wrong.
Without source for the digium fax module, I can't determine why this is happening.