In create_wall_timer() in create_timer.hpp, if a bad period duration is passed (either < 0 or > nanoseconds::max()) then rcl will throw an error. During the destructor of WallTimer, it will call cancel, which results in a double free. I haven't found exactly where.
This issue is to track the several PRs I think will be necessary to resolve the cascade of errors present.