When establishing an RTP session, unless the endpoint has a defined media_address, pjsip will bind the local socket to a wildcard address. This works fine where we can rely on the OS routing table to determine the correct interface, however it doesn't necessarily provide the correct behaviour in situations where there are multiple interfaces - especially if the host has multiple IP addresses on the same subnet (common in HA deployments).
If the endpoint is bound to a transport which is then bound to a specific local IP address, I would expect that the RTP socket should follow the behaviour of the SIP socket and ensure that all traffic is sent/received from this address. Unfortunately this is not what happens.
Attached is a patch which attempts to fix this. In short, in the absence of a media_address on the endpoint, and if the transport has a bound IP address - it will use this address for the local end of the RTP socket.
Note: This issue is probably a duplicate of that logged in the closed ticket: ASTERISK-26656.