The LIKE clause is supposed to evaluate to NULL if the optional ESCAPE character is set to NULL. Instead, Derby treats this condition as equivalent to omitting the ESCAPE clause. This violates part 2 of the SQL Standard, section 8.5 <like predicate>, general rule 3.a.ii.
Thanks to Knut for disclosing this problem via the following script:
prepare ps as 'select tablename from sys.systables where tablename like ''SYSD%'' escape ?';
– should return no rows, but actually returns 2
execute ps using 'values cast( null as char(1) )';