Why do many embedded/safety-critical projects forbid malloc after startup?

Three reasons. Fragmentation: repeated malloc/free of varying sizes leaves non-contiguous free gaps, so eventually a large request fails even though total free memory is sufficient, and there's no OS to compact the heap. Non-determinism: malloc's timing depends on heap state and free-list traversal, which hard-real-time code can't tolerate; you need bounded, predictable execution time. No recovery: there's no virtual memory, no swap, no OOM killer, heap exhaustion is fatal, and a leak slowly starves the device. The standard alternatives are allocating everything statically at init (so memory use is known and fixed at link time) or using a fixed-size block/pool allocator, which hands out uniform chunks in constant time with no fragmentation. MISRA C and DO-178C-style standards codify this restriction.