I wrongly assumed the brk syscall would set errno, but on failure it returns the old value of the brk rather than an error code.
@@ -177,6 +177,7 @@ static struct chunk *expand_heap(size_t n)
return w;
fail:
unlock(mal.brk_lock);
+ errno = ENOMEM;
return 0;
}