Puck.js Crashes w/ Custom Firmware

Yeah, using malloc itself is iffy. If you use it, it'll pull in malloc and everything it needs (adding a few kB flash usage) and will take the data it needs out of stack. Allocate too much and you get stack overflow, which might be the instability.

For mbedtls we actually use jsvMalloc and jsvFree which allocate memory like malloc/free, but out of JsVars instead: https://github.com/espruino/Espruino/blob/master/libs/crypto/mbedtls/config.h#L115-L116

That's the main difference between PC and embedded (apart from total stack size) so I'd say it's good thing to look into.

If you look at other Espruino functions we tend to use alloca to allocate data on the stack if it's just for use within as function call. In fact, as pkeystr/outputbuf are fixed size, I'd say you should just define them as an array? char outputbuf[80]. Much faster and safer