Crash in ISM rate switching with BINAURAL_ROOM_REVERB

Using the one second shortened ltv testvectors from https://forge.3gpp.org/rep/ivas-codec-pc/ivas-pc-testfiles/-/tree/knj/tmp-branch-with-shortened-files?ref_type=heads and running

./IVAS_cod -ism 3 NULL NULL NULL -max_band fb scripts/switchPaths/sw_32k_384k.bin 48 ltv48_3ISM.wav bit
./IVAS_dec BINAURAL_ROOM_REVERB 48 bit out.wav

the decoder crashes after finishing the decoding:

==================================================================================================
 IVAS Codec Baseline
 
 Based on EVS Codec (Floating Point) 3GPP TS26.443 Nov 04, 2021,
 Version 12.14.0 / 13.10.0 / 14.6.0 / 15.4.0 / 16.3.0
==================================================================================================

Input bitstream file:   bit
Output synthesis file:  out.wav

Output sampling rate:   48000 Hz
Bitrate:                48.00 kbps
Input configuration:    ISM: 3 transport channel(s)
Output configuration:   Binaural: room with reverb

------ Running the decoder ------

Frames processed:       50      

Decoder+renderer delay: 3.25 ms   (156 samples at timescale 48000)
HRIR/BRIR delay:        0.02 ms   (  1 samples at timescale 48000)
Total delay:            3.27 ms   (157 samples at timescale 48000)

Decoding of 50 frames finished

IVAS_dec(10172,0x10ba5f600) malloc: *** error for object 0x7f7946890600: pointer being freed was not allocated
IVAS_dec(10172,0x10ba5f600) malloc: *** set a breakpoint in malloc_error_break to debug
fish: Job 1, './IVAS_dec BINAURAL_ROOM_REVERB…' terminated by signal SIGABRT (Abort)

Does not happen with other output formats. Also does not happen with the full length signal, one needs to use the shortened version as linked to above! I also happens in the smoke test on this branch https://forge.3gpp.org/rep/ivas-codec-pc/ivas-codec/-/jobs/151645. There, the testvector is cut from second 1 to second 2.