I stumbled across once and could never reproduced it again. It was on the first Doom 2 level near the end attacked by two imps.
hope it helps, cheers.
./doomretro -iwad ~/Contribs/DOOM2.WAD
=================================================================
==8782==ERROR: AddressSanitizer: heap-use-after-free on address 0x5150000ce9f0 at pc 0x55c764e53526 bp 0x7ffcda3afa80 sp 0x7ffcda3afa78
READ of size 4 at 0x5150000ce9f0 thread T0
#0 0x55c764e53525 in S_AdjustSoundParms /home/dcarlier/Contribs/doomretro/src/s_sound.c:435:33
#1 0x55c764e53280 in S_UpdateSounds /home/dcarlier/Contribs/doomretro/src/s_sound.c:569:22
#2 0x55c764bd94c2 in D_DoomLoop /home/dcarlier/Contribs/doomretro/src/d_main.c:482:13
#3 0x55c764bd2bfd in D_DoomMain /home/dcarlier/Contribs/doomretro/src/d_main.c:2836:5
#4 0x55c764bde759 in main /home/dcarlier/Contribs/doomretro/src/doomretro.c:214:5
#5 0x7fb0fb4c0c89 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#6 0x7fb0fb4c0d44 in __libc_start_main csu/../csu/libc-start.c:360:3
#7 0x55c764a2fb90 in _start (/home/dcarlier/Contribs/doomretro/build/doomretro+0x108b90) (BuildId: c4a68aca4e070dbd7c957650aadaad07394d6934)
0x5150000ce9f0 is located 112 bytes inside of 480-byte region [0x5150000ce980,0x5150000ceb60)
freed by thread T0 here:
#0 0x55c764aca53a in free (/home/dcarlier/Contribs/doomretro/build/doomretro+0x1a353a) (BuildId: c4a68aca4e070dbd7c957650aadaad07394d6934)
#1 0x55c764e9879a in Z_Free /home/dcarlier/Contribs/doomretro/src/z_zone.c:147:5
#2 0x55c764de242d in P_RemoveThinkerDelayed /home/dcarlier/Contribs/doomretro/src/p_tick.c:143:9
#3 0x55c764de2c8c in P_Ticker /home/dcarlier/Contribs/doomretro/src/p_tick.c:242:9
#4 0x55c764bf5116 in G_Ticker /home/dcarlier/Contribs/doomretro/src/g_game.c:1098:13
#5 0x55c764bcd9e1 in TryRunTics /home/dcarlier/Contribs/doomretro/src/d_loop.c:84:9
#6 0x55c764bd94a6 in D_DoomLoop /home/dcarlier/Contribs/doomretro/src/d_main.c:476:9
#7 0x55c764bd2bfd in D_DoomMain /home/dcarlier/Contribs/doomretro/src/d_main.c:2836:5
#8 0x55c764bde759 in main /home/dcarlier/Contribs/doomretro/src/doomretro.c:214:5
#9 0x7fb0fb4c0c89 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
previously allocated by thread T0 here:
#0 0x55c764aca7e2 in malloc (/home/dcarlier/Contribs/doomretro/build/doomretro+0x1a37e2) (BuildId: c4a68aca4e070dbd7c957650aadaad07394d6934)
#1 0x55c764e97c2e in Z_Malloc /home/dcarlier/Contribs/doomretro/src/z_zone.c:78:22
#2 0x55c764e982e2 in Z_Calloc /home/dcarlier/Contribs/doomretro/src/z_zone.c:113:39
#3 0x55c764d62a2e in P_SpawnMobj /home/dcarlier/Contribs/doomretro/src/p_mobj.c:778:25
#4 0x55c764d6ebcd in P_SpawnMissile /home/dcarlier/Contribs/doomretro/src/p_mobj.c:1660:10
#5 0x55c764cf01b8 in A_TroopAttack /home/dcarlier/Contribs/doomretro/src/p_enemy.c:1164:5
#6 0x55c764d587c7 in P_SetMobjState /home/dcarlier/Contribs/doomretro/src/p_mobj.c:84:17
#7 0x55c764d5b000 in P_MobjThinker /home/dcarlier/Contribs/doomretro/src/p_mobj.c:751:13
#8 0x55c764de2c8c in P_Ticker /home/dcarlier/Contribs/doomretro/src/p_tick.c:242:9
#9 0x55c764bf5116 in G_Ticker /home/dcarlier/Contribs/doomretro/src/g_game.c:1098:13
#10 0x55c764bcd9e1 in TryRunTics /home/dcarlier/Contribs/doomretro/src/d_loop.c:84:9
#11 0x55c764bd94a6 in D_DoomLoop /home/dcarlier/Contribs/doomretro/src/d_main.c:476:9
#12 0x55c764bd2bfd in D_DoomMain /home/dcarlier/Contribs/doomretro/src/d_main.c:2836:5
#13 0x55c764bde759 in main /home/dcarlier/Contribs/doomretro/src/doomretro.c:214:5
#14 0x7fb0fb4c0c89 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
SUMMARY: AddressSanitizer: heap-use-after-free /home/dcarlier/Contribs/doomretro/src/s_sound.c:435:33 in S_AdjustSoundParms
Shadow bytes around the buggy address:
0x5150000ce700: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x5150000ce780: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x5150000ce800: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x5150000ce880: fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa
0x5150000ce900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x5150000ce980: fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd
0x5150000cea00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x5150000cea80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x5150000ceb00: fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa
0x5150000ceb80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x5150000cec00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==8782==ABORTING
I stumbled across once and could never reproduced it again. It was on the first Doom 2 level near the end attacked by two imps. hope it helps, cheers.