After an extension registers, FreePBX is sending NOTIFY to a random port, not the port that the IP phone registered from.
You can see in the screenshot that the IP phone registers from port 27035, then the FreePBX correctly sends OPTIONS to the IP phone on port 27035, but then incorrectly sends NOTIFY to the IP phone on port 52882.
Where did port 52882 come from? How can I fix this so that FreePBX sends NOTIFY to the correct port? This is causing MWI to not work.