Reference STUN servers?

Hello,

I have been testing my STUN client library against the two public STUN 
servers I know of, stun01.sipphone.com, and larry.gloo.net. However, I 
am not getting the results I expect - when I send a binding request to 
the server and get back a CHANGED-ADDRESS, and then send a second 
binding request to the CHANGED-ADDRESS, the servers reply to the binding 
request from a different port (i.e. not the one from the 
CHANGED-ADDRESS). I am not setting any CHANGE-REQUEST flags.

ex:
sending request to stun01.sipphone.com (69.0.208.27:3478)
received reply from 609.0.208.27:3478
source address = 69.0.208.27:3478
changed address = 69.0.209.22:3479

sending request to 69.0.209.22:3479
received reply from 69.0.209.22:3478 <----------- BAD
source address = 69.0.209.22:3479
changed address = 69.0.209.27:3478

I assume this is not the correct behavior, as it causes the NAT 
detection flow proposed in the STUN RFC to detect port-restricted-cone 
NATs as symmetric NATs. Does anyone know of any running 'reference' 
servers that are known to behave correctly?

Thanks in advance,
Justin Uberti