If the device is doing NAT, it already keeps track of whether a TCP connection is new or not. It feels like it should be easy enough to check that state when applying the ALG rule.

Or can a SIP REGISTER happen in a packet after the first?