It seems as if the return value of mem.malloc is never used in your code, as t is immediately set to `token.next` in the respective branch.

I haven't touched that part of DMD in a while, but what is supposed to happen here is that the next token is copied into the space for the currently processed one, and then the allocation for the former is discarded. Discarded here means adding it to the manually maintained free list (as we have to avoid allocation overhead here at all costs for performance).

In case `token.next` can point to garbage, this obviously is a problem that needs to be fixed.