The cc65 doc explicitly states that the return value of _heapmaxavail() can be used as parameter of malloc(). To actually allow for that the size of HEAP_ADMIN_SPACE has to be substracted from the raw size of the largest free heap block.