In rclcpp/include/rclcpp/subscription_options.hpp and rclcpp/include/rclcpp/publisher_options.hpp, the conversion to RCL options ("to_rcl_publisher_options") passes a reference to a C++ allocator that goes out of scope at the end of the function:

auto message_alloc = std::make_shared<MessageAllocatorT>(*this->get_allocator().get());
result.allocator = get_rcl_allocator(*message_alloc);

This could cause unexpected problems for users of custom allocators when they reference the allocator in an overload of get_rcl_allocator. Standard ROS code is not affected, because neither std::allocator nor tlsf_allocator carry internal state. This is hard to fix, because neither rcl_publisher_options_t nor rcl_allocator_t have destructors (so they can't just create their own reference to the shared_ptr).