"Resolver::processReferences()" collects "<use>" elements with the XPath predicate "use[@href or @xlink:href]", which is case sensitive. A "<use>" element written as "xlink:HrEf" is therefore never added to the reference graph, so the nesting-DoS nullification never marks it for removal. "Sanitizer::cleanHrefAttributes()" then runs later in the same pass and rewrites "xlink:HrEf" back to the canonical "xlink:href". The sanitizer hands back a fully live nesting bomb that it would have stripped completely had the input used canonical casing. This is the mirror image of CVE-2025-55166: that fix made href value checking case insensitive, but the "<use>" reference graph still selects nodes case sensitively.