Description of problem:
Trying to play music from my T60 laptop to a Motorola DC800 audio gateway.  I am able to successfully pair to the device using the bluetooth applet.  Using the alsa device directly (either through "speaker-test -D bluetooth" or "mplayer -ao alsa:device=bluetooth") works great.

When I do "pactl load-module module-alsa-sink device=bluetooth", I get a segfault in module-alsa-sink.so.  Here's the end of the log and backtrace from running "pulseaudio --log-level debug" under gdb:

I: client.c: Created 1 "Native client (UNIX socket client)"
I: protocol-native.c: Got credentials: uid=500 gid=500 success=1
I: module-alsa-sink.c: Successfully opened device bluetooth.
I: module-alsa-sink.c: Successfully enabled mmap() mode.
I: module-alsa-sink.c: Successfully enabled timer-based scheduling mode.
I: (alsa-lib)control.c: Invalid CTL bluetooth
I: alsa-util.c: Unable to attach to mixer bluetooth: No such file or directory
I: sink.c: Created sink 1 "alsa_output.bluetooth" with sample spec s16le 2ch 44100Hz and channel map front-left,front-right
I: source.c: Created source 2 "alsa_output.bluetooth.monitor" with sample spec s16le 2ch 44100Hz and channel map front-left,front-right
I: module-alsa-sink.c: Using 3 fragments of size 8192 bytes, buffer time is 139.32ms
I: module-alsa-sink.c: Time scheduling watermark is 20.00ms
[New Thread 0x7fd2b97c2950 (LWP 2329)]

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fd2b97c2950 (LWP 2329)]
0x00007fd2bc62274f in thread_func (userdata=0x13aac10) at modules/module-alsa-sink.c:1123
1123	        if (PA_SINK_IS_OPENED(u->sink->thread_info.state)) {
(gdb) bt
#0  0x00007fd2bc62274f in thread_func (userdata=0x13aac10) at modules/module-alsa-sink.c:1123
#1  0x000000300388254d in internal_thread_func (userdata=0x13990a0) at pulsecore/thread-posix.c:72
#2  0x00000030018073da in start_thread (arg=<value optimized out>) at pthread_create.c:297
#3  0x0000003000ce62bd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112
(gdb) 


I've stepped through the thread in gdb and it looks like u->sink is getting corrupted somewhere in the thread_func loop, but I can't figure out where.  It'll sometimes get through the loop successfully once, and then previously-valid pointers in the struct will be invalid or null.  The location of of the segv also moves around, but is often at PA_SINK_IS_OPENED().  If you'd like a core dump or more detailed info from gdb right before/after the segv, let me know.

I get this in /var/log/messages whenever I access the "bluetooth" alsa device, both successfully and unsuccessfully, so I don't think they're relevant:

Feb 19 19:23:58 maunalani bluetoothd[2269]: link_key_request (sba=00:19:7E:F2:0F:02, dba=00:07:A4:D6:27:B9)
Feb 19 19:24:07 maunalani bluetoothd[2269]: AVCTP connect(00:07:A4:D6:27:B9): Connection refused (111)
Feb 19 19:24:11 maunalani kernel: l2cap_recv_acldata: Unexpected continuation frame (len 0)
Feb 19 19:24:11 maunalani kernel: l2cap_recv_acldata: Unexpected continuation frame (len 0)
...



Version-Release number of selected component (if applicable):
Fully up-to-date F10 packages

pulseaudio-0.9.14-1.fc10.x86_64
bluez-alsa-4.22-2.fc10.x86_64

How reproducible:
Always

Steps to Reproduce:
1. pactl load-module module-alsa-sink device=bluetooth
2.
3.
  
Actual results:
segfault and silence

Expected results:
no segfault and dulcet tones emanating from my speakers

Additional info:
"pactl load-module module-alsa-source device=bluetooth" works fine.

It's possible this is a problem with bluez-alsa as well, but I stepped through the libasound_module_pcm_bluetooth.so module and couldn't find anywhere it even had access to the u->sink struct, so it looks more likely to be a pulseaudio issue.