I (wrongly) assumed SIP trunks.
Just so I'm clear, you have a HTC phone running a SIP client registered as a user on the 3300, connecting internally through some wifi bridge. If you call from that phone to another IP set on the internal network, it works fine. But if you call from the HTC out a trunk, you get one way audio. Is that correct?
If so, then it's again, most likely a router issue. In the first scenario, the RTP data is being sent from the IP phone, most likely using port 9000. When you call out a trunk, the RTP stream gets terminated on the controller, which uses a different port range. So I'm guessing your routers are configured to allow one, but not the other.
If it were me, I'd just start sniffing the call. Eliminates the guess-work.