Like others, I will have to re-read this article a few more times to fully digest it. A few comments I'd like to bring (too bad Tim won't get the chance to test these theories):
1) Both Asuswrt-Merlin and Tomato (Shibby build) have recently switched to a much newer version of Miniupnpd (the uPNP server they use). Would have been interesting to see if this new build resolved any of the noted issues (altho Tomato Shibby's latest release has a broken config file for miniupnpd)
As for DD-WRT, it uses a completely different uPNP daemon (I forgot its name).
2) By default both Asuswrt and Asuswrt-Merlin (don't know about Tomato's default state) have a SIP helper enabled by default, which is meant to help in the routing of SIP clients toward a remote (outside of your network) PBX. Disabling the helper is possible in Tomato and Asuswrt-Merlin (and possible in Asuswrt through a manual nvram setting change). I wonder if having this helped enabled by default might not be responsible for at least some of these failures.
Very nice article. As I said, I'll have to re-digest it a few times.