Speedfusion 10.0 possible weird bug

Has anyone else seen an odd issue with SIP registrations over speedfusion since upgrading to 8.6?
After upgrading some of our data center routers to 8.6 we are seeing an issue what I am 95% sure is a speedfusion bug. Going to be a bitch to pin down.
In a nutshell - where a remote location has say 5 IP phones with speedfusion vpn to data center, 2 or 3 phones fail registration.
The odd thing is that the phone says reg failed, but the phone system says they are registered.
When an IP phone registeres there are 4 packets exchanged:
phone => asterisk “register”
asterisk => phone “ok, here is a nonce”
phone => asterisk “register” (with encrypted PW using the nonce)
asterisk => phone “200 OK”

now…asterisk says it succeeded. I see packet leaving asterisk.
phone did not receive LAST “ok” (but did receive first one). That is the really odd thing.
If I was not using a vpn with routed IPs, this would smell like a NAT issue. but there is no NAT involved.
note that we see this on remote usint running 8.6 (speedfusion 1.0) and 8.5.4 and 8.5.3. but ONLY when speedfusion is connected to data center router running 8.6. remotes connecting to other data center routers still on 8.5.4 do NOT show the issue.

Also - disable/enable of the vpn corrects the issue, at least for a while.
out of 2,000+ remote locations we are seeing this on 5-10 per day
Anyone else seeing this? I am putting in a ticket but wanted to see if anyone seeing odd things.