acl_list was set to prev->tl_data_contents and its value is freed but then is is freed again outside of the if(). Just reset acl_list pointer as prev->tl_data_contents is removed unconditionally outside of the RBCD ACL removal.

This can be reproduced by setting an RBCD ACL on a principal and then running kadmin.local getprincs:

# kinit admin
# ipa service-add cifs/server.ipa.test
# kadmin.local getprincs
double free or corruption (fasttop)
Aborted (core dumped)
#