I've been staring as this test case, and I cannot find any dereference of a wrong-typed pointer value. The only oddity I can find is that at

if (n->prev == (void *)h)

n == &node, n->prev == (struct node *)&heads[2] (so wrong-typed), h == &heads[2], so there is a '==' being applied to a wrong-typed pointer. Is that undefined behaviour? I'll note that changing the test to

if ((void *)n->prev == (void *)h)

still reproduces the wrong-code while looking technically Ok.

I've been staring as this test case, and I cannot find any dereference of a wrong-typed pointer value. The only oddity I can find is that at

if (n->prev == (void *)h)

n == &node, n->prev == (struct node *)&heads[2] (so wrong-typed), h == &heads[2], so there is a '==' being applied to a wrong-typed pointer. Is that undefined behaviour? I'll note that changing the test to

if ((void *)n->prev == (void *)h)

still reproduces the wrong-code while looking technically Ok.

Also, there is no out-of-bounds error.