That's too complex. I thought about something like this:

if (i != cached_count) {
   prev = s;
} else if (s-type == O_LIMIT_PARENT && s->limit_count != 0) {
   prev = s;
} else {
   remove(s);
}

That's not longer true after removal of the element.
"prev" stays as it is, when "s" is removed,.

This loop in computationally expensive and invariant to the test "s->type == VAL && s->limit->count != 0".

So for the sake of efficiency, the code should be reordered.

 SLIST_FOREACH... {
    if (s->type ....) { del = s; continue; }
    for (i = 0; ...) ...
    if (i != cache_count) { del = s; continue; }
    remove(s);
}

Too bad, that we cant's jump directly out of the inner loop.

 expire_loop_##name:
 SLIST_FOREACH... {
    if (s->type ....) { del = s; continue; }
    for (i = 0; ...)
       if (dyn_hp_cache ...
           continue expire_loop_##name;
    remove(s);
}

Because the temp pointers "sXt" are never used to access member elements, it's possible to avoid them completely.

Just define a temp pointer in the DYN_FREE_STATES macro itself:

#define DYN...   do { \
    void * del = NULL; \