Alice meet rabit hole. There is a leak here on every invite that comes back from a status 180 when the other side is not FS, but you have presence enabled. Thanks to Coverity scan for location this condition. This 'might' not have been leaking if sofia was automatically freeing this when the sofia object was destroyed, but all other locations where sip_header_as_string where called they were all followed by a su_free, so I assume not.
Possible leak if someone were to try and add extra headers to a channel that had either an inbound info on that session or the session were to be deflected. I don't see a way that these extra headers could be added outside of a C module subscribing to the session states, but just to make sure I'm adding these so that just like other extra header locations it's cleaned up.
Edge case for when you are subscribing to presence on a valet parking lot. In which case there would be a small leak.