d35ff2c added a X509_V_FLAG_NO_CHECK_TIME check into check_crl_time, but placed it after this code:

    if (notify)
        ctx->current_crl = crl;

This looks like a bug. notify is about a verify callback, but X509_V_FLAG_NO_CHECK_TIME skips all that. In particular, check_crl_time ends by undoing that state at the bottom, yet X509_V_FLAG_NO_CHECK_TIME skips that cleanup, and leaves a stray current_crl in there. Instead, the X509_V_FLAG_NO_CHECK_TIME check should have been placed at the beginning of the function.