Index: channels/chan_iax2.c
===================================================================
--- channels/chan_iax2.c	(revision 324299)
+++ channels/chan_iax2.c	(working copy)
@@ -5266,10 +5266,6 @@
 		/* these two cannot be sent, because they require a result */
 		errno = ENOSYS;
 		return -1;
-	case AST_OPTION_FORMAT_READ:
-	case AST_OPTION_FORMAT_WRITE:
-	case AST_OPTION_MAKE_COMPATIBLE:
-		return -1;
 	case AST_OPTION_OPRMODE:
 		errno = EINVAL;
 		return -1;
@@ -5286,7 +5282,16 @@
 		ast_mutex_unlock(&iaxsl[callno]);
 		return 0;
 	}
-	default:
+	/* These options are sent to the other side across the network where
+	 * they will be passed to whatever channel is bridged there. Don't
+	 * do anything silly like pass an option that transmits pointers to
+	 * memory on this machine to a remote machine to use */
+	case AST_OPTION_TONE_VERIFY:
+	case AST_OPTION_TDD:
+	case AST_OPTION_RELAXDTMF:
+	case AST_OPTION_AUDIO_MODE:
+	case AST_OPTION_DIGIT_DETECT:
+	case AST_OPTION_FAX_DETECT:
 	{
 		unsigned short callno = PTR_TO_CALLNO(c->tech_pvt);
 		struct chan_iax2_pvt *pvt;
@@ -5314,7 +5319,12 @@
 		ast_free(h);
 		return res;
 	}
+	default:
+		return -1;
 	}
+
+	/* Just in case someone does a break instead of a return */
+	return -1;
 }
 
 static int iax2_queryoption(struct ast_channel *c, int option, void *data, int *datalen)
Index: include/asterisk/frame.h
===================================================================
--- include/asterisk/frame.h	(revision 324299)
+++ include/asterisk/frame.h	(working copy)
@@ -404,45 +404,51 @@
 #define AST_OPTION_FLAG_WTF		6
 
 /*! Verify touchtones by muting audio transmission 
-	(and reception) and verify the tone is still present */
+ * (and reception) and verify the tone is still present
+ * Option data is a single signed char value 0 or 1 */
 #define AST_OPTION_TONE_VERIFY		1		
 
-/*! Put a compatible channel into TDD (TTY for the hearing-impared) mode */
+/*! Put a compatible channel into TDD (TTY for the hearing-impared) mode
+ * Option data is a single signed char value 0 or 1 */
 #define	AST_OPTION_TDD			2
 
-/*! Relax the parameters for DTMF reception (mainly for radio use) */
+/*! Relax the parameters for DTMF reception (mainly for radio use)
+ * Option data is a single signed char value 0 or 1 */
 #define	AST_OPTION_RELAXDTMF		3
 
-/*! Set (or clear) Audio (Not-Clear) Mode */
+/*! Set (or clear) Audio (Not-Clear) Mode
+ * Option data is a single signed char value 0 or 1 */
 #define	AST_OPTION_AUDIO_MODE		4
 
 /*! Set channel transmit gain 
- * Option data is a single signed char
-   representing number of decibels (dB)
-   to set gain to (on top of any gain
-   specified in channel driver)
-*/
+ * Option data is a single signed char representing number of decibels (dB)
+ * to set gain to (on top of any gain specified in channel driver) */
 #define AST_OPTION_TXGAIN		5
 
 /*! Set channel receive gain
- * Option data is a single signed char
-   representing number of decibels (dB)
-   to set gain to (on top of any gain
-   specified in channel driver)
-*/
+ * Option data is a single signed char representing number of decibels (dB)
+ * to set gain to (on top of any gain specified in channel driver) */
 #define AST_OPTION_RXGAIN		6
 
-/* set channel into "Operator Services" mode */
+/* set channel into "Operator Services" mode 
+ * Option data is a struct oprmode
+ *
+ * \note This option should never be sent over the network */
 #define	AST_OPTION_OPRMODE		7
 
-/*! Explicitly enable or disable echo cancelation for the given channel */
+/*! Explicitly enable or disable echo cancelation for the given channel
+ * Option data is a single signed char value 0 or 1
+ *
+ * \note This option appears to be unused in the code. It is handled, but never
+ * set or queried. */
 #define	AST_OPTION_ECHOCAN		8
 
 /*! \brief Handle channel write data
  * If a channel needs to process the data from a func_channel write operation
  * after func_channel_write executes, it can define the setoption callback
  * and process this option. A pointer to an ast_chan_write_info_t will be passed.
- * */
+ *
+ * \note This option should never be passed over the network. */
 #define AST_OPTION_CHANNEL_WRITE 9
 
 /* !
@@ -451,28 +457,38 @@
  */
 #define AST_OPTION_T38_STATE		10
 
-/*! Request that the channel driver deliver frames in a specific format */
+/*! Request that the channel driver deliver frames in a specific format
+ * Option data is a format_t */
 #define AST_OPTION_FORMAT_READ          11
 
-/*! Request that the channel driver be prepared to accept frames in a specific format */
+/*! Request that the channel driver be prepared to accept frames in a specific format
+ * Option data is a format_t */
 #define AST_OPTION_FORMAT_WRITE         12
 
-/*! Request that the channel driver make two channels of the same tech type compatible if possible */
+/*! Request that the channel driver make two channels of the same tech type compatible if possible
+ * Option data is an ast_channel
+ *
+ * \note This option should never be passed over the network */
 #define AST_OPTION_MAKE_COMPATIBLE      13
 
-/*! Get or set the digit detection state of the channel */
+/*! Get or set the digit detection state of the channel
+ * Option data is a single signed char value 0 or 1 */
 #define AST_OPTION_DIGIT_DETECT		14
 
-/*! Get or set the fax tone detection state of the channel */
+/*! Get or set the fax tone detection state of the channel
+ * Option data is a single signed char value 0 or 1 */
 #define AST_OPTION_FAX_DETECT		15
 
-/*! Get the device name from the channel */
+/*! Get the device name from the channel (Read only)
+ * Option data is a character buffer of suitable length */
 #define AST_OPTION_DEVICE_NAME		16
 
-/*! Get the CC agent type from the channel */
+/*! Get the CC agent type from the channel (Read only) 
+ * Option data is a character buffer of suitable length */
 #define AST_OPTION_CC_AGENT_TYPE    17
 
-/*! Get or set the security options on a channel */
+/*! Get or set the security options on a channel
+ * Option data is an integer value of 0 or 1 */
 #define AST_OPTION_SECURE_SIGNALING        18
 #define AST_OPTION_SECURE_MEDIA            19
 
Index: main/features.c
===================================================================
--- main/features.c	(revision 324299)
+++ main/features.c	(working copy)
@@ -3707,10 +3707,21 @@
 				break;
 			case AST_CONTROL_OPTION:
 				aoh = f->data.ptr;
-				/* Forward option Requests */
+				/* Forward option Requests, but only ones we know are safe
+				 * These are ONLY sent by chan_iax2 and I'm not convinced that
+				 * they are useful. I haven't deleted them entirely because I
+				 * just am not sure of the ramifications of removing them. */
 				if (aoh && aoh->flag == AST_OPTION_FLAG_REQUEST) {
-					ast_channel_setoption(other, ntohs(aoh->option), aoh->data, 
-						f->datalen - sizeof(struct ast_option_header), 0);
+				   	switch (ntohs(aoh->option)) {
+					case AST_OPTION_TONE_VERIFY:
+					case AST_OPTION_TDD:
+					case AST_OPTION_RELAXDTMF:
+					case AST_OPTION_AUDIO_MODE:
+					case AST_OPTION_DIGIT_DETECT:
+					case AST_OPTION_FAX_DETECT:
+						ast_channel_setoption(other, ntohs(aoh->option), aoh->data, 
+							f->datalen - sizeof(struct ast_option_header), 0);
+					}
 				}
 				break;
 			}