Found in debug of #4134 https://github.com/esp8266/Arduino/blob/0fe725909e118982e25e3810386316ed3923380c/cores/esp8266/umm_malloc/umm_malloc.c#L1688 UMM_CALLOC does an alloc then memset(0), but doesn't check the malloc succeeded, leading to a crash in UMM.