Rune Torgersen wrote:

The heap data structure gets filled in by the compiler on compile time, and it puts its next/prev pointers to point to flash. malloc_bin_reloc() normally takes care of this, but since gd->reloc_off is 0, they stay in flash.

Ah, I get it now.

I've been talking to Grant on IRC. I have some things I can try to narrow down the problem.