But for this kind of application, wouldn't you just panic and do a soft restart on malloc failure anyway? Actually recovering from an out-of-memory situation is incredibly fraught and unreliable; most of the realtime operating systems I've used don't even bother to try.
That depends on when a failure were to occur. If we have a failure while the spacecraft is en route to its destination, perhaps we can recover because we may have enough time.
If we have a failure during rendezvous with our target, it could be a very bad day.
You always need to be able to recover from a soft reboot, even during maneuvers; you're in a high radiation environment and any passing high energy particle or cosmic ray can trigger this.
Dynamic memory allocation is extremely frowned-upon in embedded/real-time systems such as flight systems for exactly that reason.
You simply cannot handle out-of-memory and fragmentation issues in a safe manner.
