free_user_env is never called when (env == &rtems_global_user_env). It is possible that this path is impossible but that will require analysis of the callers. Since this is static, it is quite possible this is covered by the callers.