Snom M100/M10 SC one way audio after taking off hold

Hello.

I have a Snom M100/M10 combination with two M10s registered to the base station. I'm behind NAT with all the SIP and RTP ports forwarded, that the M100 is configured to use. All outgoing and incoming calls work perfectly fine, however when I put an outgoing call on hold and take it off hold, I can hear the other person but they can't hear me - they only hear the on-hold bleeps continuing. Putting incoming calls on hold seems to work OK.

Oddly, I did manage with one attempt to transfer the call to the other M10 handset and it resumed working from there, but I can't remember exactly what I did to make that work.

I have a pcap trace from the phone and nothing looks untoward. I can see RTP traffic flowing both ways before putting the call on hold. I can see the SDP re-invite with sendonly when putting on hold, and while on hold I see only incoming RTP traffic. I see the sendrecv re-invite and then outgoing RTP traffic resumes. There are no ICMP responses from the destination RTP port. By looking at the hex dump of the incoming and outgoing RTP data I can even see what looks like periods of silence followed by periods of me speaking. Everything looks fine as far as I understand it. I'm not confident publishing a pcap trace in a public forum however.

I have another Snom phone (D140) on the same network with the same configuration and the same SIP server (separate SIP port and RTP port ranges) and the hold function works fine.

Any idea what this could be? I read some other M-series SNOM phones had similar problems before, although that was a few years ago.

I'm on the latest firmware:
Base: 1.0.5.11-0, hardware version R1A
Handset: 1.4.5.21-0, hardware version 01