How are BYE requests routed?
Since a Contact header MUST be present in INVITE and 200, the BYE will go directly to the user agent if there is no Record-Route header. If there is a Record-Route, it will traverse the list of proxies indicated there. If the caller decides to send a BYE before receiving a 200 from the callee, the BYE is being handled by the proxies just as the corresponding INVITE was handled, i.e., it may be forked.