Ok, apologies to Nokia, it was an Asterisk bug. It had to do with how SDP negotiates the packet type to be used for DTMF; the SofiaSIP stack on the n900 tried for 99, and Asterisk came back with 101. SofiaSIP switched to 101, but Asterisk was not accepting packets of that type.

This is a bug with Ubuntu Trusty's current version of Asterisk, 11.7.0. -current of the -11 series (11.13.1) works OK.

If somebody's about to build Asterisk from source, one little gotcha I'll warn you about to save you some time. If you don't have the ssl-dev package installed, Asterisk will config and build and install--but will have no SIP support. Duh. Hope that saves somebody a few minutes.