XG210 18.0.3 crash: system system_modules sip unload

Hi,

I've got 2 XG210 in HA running 18.0.3.
Telecom provider asked to disable sip module, i did this mayby a hunderd times with other models/firmware versions. But this HA gaves me:

console> system system_modules sip unload
[ 136.748318] BUG: unable to handle kernel NULL pointer dereference at 00000000000000b8
[ 136.771822] IP: nf_ct_helper_expectfn_find_by_symbol+0x36/0x70 [nf_conntrack]
[ 136.793243] PGD 800000025681f067 P4D 800000025681f067 PUD 242bdf067 PMD 0
[ 136.813887] Oops: 0000 [#1] SMP PTI
[ 136.824384] Modules linked in: nf_conntrack_ipslb nfnetmap_queue(O) xt_svp xt_xfrmpolicy ah4 xt_addrtype nf_nat_ftp nf_conntrack_ftp xt_CT ebt_vlan ebt_arp arpt_arpreply_proxy arpt_arpreq_proxy ebtable_filter ebtable_nat ebtables ip6t_MASQUERADE xt_muser xt_conntrack xt_RCV_AUX_DATA ip6t_ADVERTISEMENT ip6t_SOLICITATION xt_LBS ip6table_filter iptable_filter xt_DNAT xt_SNAT nf_nat_masquerade_ipv6 xt_nat_lookup xt_UST xt_ust xt_firewall nat_rules sfos_rules_framework firewall ip_set_hash_mlmwsticky ip_set_hash_sslvpn iptable_mangle ip_set_hash_mac ip_set_hash_bw nf_conntrack_dns nf_conntrack_sip(-) nf_nat_irc nf_conntrack_irc nf_nat_tftp nf_conntrack_tftp nf_nat_h323 nf_conntrack_h323 nf_nat_pptp nf_conntrack_pptp cfg80211 usbhid hid_generic hid ohci_pci ohci_hcd xhci_pci xhci_hcd uhci_hcd ehci_pci
[ 137.035473] ehci_hcd fw_handle_ngfw_notification fp2sp_api fp_notifier bonding lzo lzo_compress lzo_decompress cifs red red2 appdev nf_conntrack_netlink nf_nat_proto_gre nf_conntrack_proto_gre set_sessiontbl sessiontbl ip_gre gre ipcomp xfrm_ipcomp esp4 xfrm4_mode_transport xfrm4_mode_tunnel xfrm4_tunnel xfrm_user af_key xfrm_algo aesni_intel glue_helper aes_x86_64 crypto_simd cryptd cls_u32 act_mirred sch_ingress ifb sch_hfsc sch_leafprio sch_headprio sch_sfq sch_htb xt_MULTISET xt_MLM xt_SRCNETMAP xt_MARKROUTE xt_CONTINUE xt_LOGDROP xt_ULOG xt_TCPMSS xt_REDIRECT nf_nat_redirect ipt_MASQUERADE nf_nat_masquerade_ipv4 xt_OUT_OUTDEV ip6t_rpfilter ipt_rpfilter ebt_nflog ebt_pkttype xt_serviceset xt_appset xt_hostset xt_pkttype xt_recent xt_state xt_status xt_cet xt_OUTDEV xt_iprange xt_limit xt_hashlimit
[ 137.248456] xt_tcpudp xt_multiport nf_conntrack_relate xt_IPMACFILTER xt_RANGENAT xt_VHDNAT ip_set_bitmap_vhost xt_FWSET xt_set ip_set_hash_maciface_fp ip_set_hash_ipiface_fp ip_set_bitmap_hotspotuser ip_set_hash_hotspotmac ip_set_bitmap_tlsrule ip_set_bitmap_appset ip_set_bitmap_fwrule ip_set_bitmap_ctrxss ip_set_bitmap_user sp2fp_api ip_set_bitmap_userpolicy ip_set_hash_ipuser ip_set_bitmap_service ip_set_bitmap_host ip_set_hash_ipmaciface ip_set_hash_l2mac ip_set_hash_ipmac ip_set_hash_ip ip_set arptable_filter arp_tables caswell_bpgen3(O) network_bypass(O) e1000e_nm(O) igb_nm(O) i2c_algo_bit ixgbe_nm(O) i40e_nm(O) vxlan udp_tunnel ip6_udp_tunnel ptp pps_core mdio i2c_i801 i2c_dev i2c_core netmap(O) ip6table_nat nf_nat_ipv6 ip6table_mangle ip6table_raw iptable_nat iptable_raw nf_nat_ipv4 xt_dscp
[ 137.460747] nf_nat ip6_tables ip_tables tun af_packet 8021q nf_conntrack_ipv6 nf_defrag_ipv6 nf_conntrack_ipv4 ip6_tunnel tunnel6 sit ip_tunnel tunnel4 ppdev parport_pc parport nf_conntrack lineartable bitmap_api br_netfilter bridge nf_defrag_ipv4 ipv6 stp llc x_tables nfnetlink button evdev [last unloaded: nf_nat_sip]
[ 137.545711] CPU: 0 PID: 8678 Comm: rmmod Tainted: G O 4.14.38 #2
[ 137.567144] Hardware name: Sophos XG/XG, BIOS 5.11 07/20/2018
[ 137.584407] task: ffff8802630ecd00 task.stack: ffffc90001834000
[ 137.602193] RIP: 0010:nf_ct_helper_expectfn_find_by_symbol+0x36/0x70 [nf_conntrack]
[ 137.625191] RSP: 0018:ffffc90001837e90 EFLAGS: 00010246
[ 137.640904] RAX: 0000000000000000 RBX: ffff880241362700 RCX: 0000000000000000
[ 137.662332] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff880241362700
[ 137.683755] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000002
[ 137.705179] R10: ffffc90001837de0 R11: 0000000000003655 R12: ffffffffa00e09e0
[ 137.726604] R13: 0000000000000000 R14: 0000000000000287 R15: 0000000000000000
[ 137.748026] FS: 00007efc0de7e740(0000) GS:ffff88026dc00000(0000) knlGS:0000000000000000
[ 137.772325] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 137.789597] CR2: 00000000000000b8 CR3: 0000000242c58003 CR4: 00000000000606f0
[ 137.811025] Call Trace:
[ 137.818404] nf_ct_expect_iterate_destroy+0x57/0xb0 [nf_conntrack]
[ 137.836974] nf_conntrack_helper_unregister+0x57/0x70 [nf_conntrack]
[ 137.856055] nf_conntrack_helpers_unregister+0x2a/0x40 [nf_conntrack]
[ 137.875402] SyS_delete_module+0x168/0x1d0
[ 137.887719] do_syscall_64+0x5b/0x100
[ 137.898745] entry_SYSCALL_64_after_hwframe+0x3d/0xa2
[ 137.913928] RIP: 0033:0x7efc0e180749
[ 137.924691] RSP: 002b:00007ffee1ce7248 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0
[ 137.947435] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007efc0e180749
[ 137.968871] RDX: 000000000000000f RSI: 0000000000000880 RDI: 00007ffee1ce7280
[ 137.990295] RBP: 0000000000407010 R08: 0000000000000000 R09: 00000880e1ce8b19
[ 138.011717] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000406fe0
[ 138.033143] R13: 00007ffee1ce74f0 R14: 0000000000000000 R15: 0000000000000000
[ 138.054566] Code: 0f a0 74 19 48 3b 78 18 75 08 eb 14 48 39 78 18 74 0d 48 8b 00 48 3d 80 07 0f a0 75 ef 31 c0 c3 c3 0f 1f 40 00 48 8b 47 70 31 d2 <48> 8b 80 b8 00 00 00 48 85 c0 74 0f 44 0f b6 40 10 4c 01 c0 45
[ 138.111168] RIP: nf_ct_helper_expectfn_find_by_symbol+0x36/0x70 [nf_conntrack] RSP: ffffc90001837e90
[ 138.138588] CR2: 00000000000000b8
[ 138.148575] ---[ end trace 76fd8a0f7cb73ca0 ]---
[ 138.162460] Kernel panic - not syncing: Fatal exception in interrupt
[ 138.181551] Kernel Offset: disabled
[ 138.192048] Rebooting in 3 seconds..
[ 141.223902] ACPI MEMORY or I/O RESET_REG.

After reboot, sip module is stil loaded. Anyone knows a way arround?

Thanks.