lysc_node_case_free will release the child nodes of other cases, causing dangling wild pointers in other cases.

[Gokouneko]

static void
lysc_node_case_free(const struct ly_ctx *ctx, struct lysc_node_case *node)
{
    struct lysc_node *child, *child_next;

    FREE_ARRAY(ctx, node->when, lysc_when_free);
    LY_LIST_FOR_SAFE(node->child, child_next, child) {
        lysc_node_free_(ctx, child);
    }
}

struct lysc_node *child;         /**< first child node of the case (linked list). Note that all the children of all the sibling cases are linked
                                          each other as siblings with the parent pointer pointing to appropriate case node. */

All the children of all the sibling cases are linked each other as siblings. When free one case node, LY_LIST_FOR_SAFE will free all the child and child->next, including the child node of other cases from the same choice.