Found by Claude Code
In upstream's verilator_shim.cpp, Cosim_setup() declares the Verilator context as a local std::unique_ptr<verilatedcontext>. When the function returns, the unique_ptr destructor deletes the context — but the Verilog model object outlives the function and keeps a raw pointer to it. On the --timing code path, step() later calls topp->contextp(), dereferencing freed memory. That is a use-after-free in shipped ngspice code, independent of anything we added. Our patch releases ownership from the unique_ptr so the context lives for the whole process; we needed it anyway because the trace setup also uses the context.</verilatedcontext>