Initial attempt at fixing bug #17922, calling for reviewers. This seems to work for me, more or less, but it looks like it breaks TCP.

src/core/mem.c

@@ -228,6 +228,11 @@ mem_realloc(void *rmem, mem_size_t newsize)
   return rmem;
 }
 
+#if 1
+/**
+ * Adam's mem_malloc(), suffers from bug #17922
+ * Set if to 0 for alternative mem_malloc().
+ */
 void *
 mem_malloc(mem_size_t size)
 {
@@ -298,3 +303,102 @@ mem_malloc(mem_size_t size)
   sys_sem_signal(mem_sem);
   return NULL;
 }
+#else
+/**
+ * Adam's mem_malloc() plus changes made by Christiaan.
+ * Work in progress based on bug #17922 report by Tom Hennen.
+ *
+ * @note this passes the supplied testcase but we suspect more bugs.
+ *   Therefore we call for more brains, reviewers and testers!
+ */
+void *
+mem_malloc(mem_size_t size)
+{
+  mem_size_t ptr, ptr2;
+  struct mem *mem, *mem2;
+
+  if (size == 0) {
+    return NULL;
+  }
+
+  /* Expand the size of the allocated memory region so that we can
+     adjust for alignment. */
+  if ((size % MEM_ALIGNMENT) != 0) {
+    size += MEM_ALIGNMENT - ((size + SIZEOF_STRUCT_MEM) % MEM_ALIGNMENT);
+  }
+
+  if (size > MEM_SIZE) {
+    return NULL;
+  }
+
+  sys_sem_wait(mem_sem);
+
+  /* @todo is the change from MEM_SIZE to MEM_SIZE - size correct? */
+  for (ptr = (u8_t *)lfree - ram; ptr < MEM_SIZE - size; ptr = ((struct mem *)&ram[ptr])->next) {
+    mem = (struct mem *)&ram[ptr];
+
+    if (!mem->used) {
+
+      ptr2 = ptr + SIZEOF_STRUCT_MEM + size;
+      if (mem->next - (ptr + SIZEOF_STRUCT_MEM) == size) {
+        /* exact fit, do not split, no mem2 creation */
+        mem->next = ptr2;
+        mem->used = 1;
+      }
+      else if (mem->next - (ptr + (2*SIZEOF_STRUCT_MEM)) > size) {
+        /* split large block, create empty remainder */
+        /* @todo do we need to ensure the remainder can
+           house a  minimal sized (aligned) unit? */
+        mem->next = ptr2;
+        mem->used = 1;
+        /* create mem2 struct */
+        mem2 = (struct mem *)&ram[ptr2];
+        mem2->used = 0;
+        mem2->next = mem->next;
+        mem2->prev = ptr;
+
+        if (mem2->next != MEM_SIZE) {
+          ((struct mem *)&ram[mem2->next])->prev = ptr2;
+        }
+
+      }
+      else
+      {
+        /* @todo: what if we have a near fit
+           (block > size && block < size + SIZEOF_STRUCT_MEM).
+           Round size up? Or do we need to continue to next block for "first fit"? */
+      }
+
+      if (mem->used) {
+#if MEM_STATS
+        lwip_stats.mem.used += (size + SIZEOF_STRUCT_MEM);
+        if (lwip_stats.mem.max < ptr2) {
+          lwip_stats.mem.max = ptr2;
+        }
+#endif /* MEM_STATS */
+        if (mem == lfree) {
+          /* Find next free block after mem */
+          while (lfree->used && lfree != ram_end) {
+            lfree = (struct mem *)&ram[lfree->next];
+          }
+          LWIP_ASSERT("mem_malloc: !lfree->used", !lfree->used);
+        }
+        sys_sem_signal(mem_sem);
+        LWIP_ASSERT("mem_malloc: allocated memory not above ram_end.",
+         (mem_ptr_t)mem + SIZEOF_STRUCT_MEM + size <= (mem_ptr_t)ram_end);
+        LWIP_ASSERT("mem_malloc: allocated memory properly aligned.",
+         (unsigned long)((u8_t *)mem + SIZEOF_STRUCT_MEM) % MEM_ALIGNMENT == 0);
+        mem_dump("mem_malloc");
+        return (u8_t *)mem + SIZEOF_STRUCT_MEM;
+      }
+    }
+  }
+  LWIP_DEBUGF(MEM_DEBUG | 2, ("mem_malloc: could not allocate %"S16_F" bytes\n", (s16_t)size));
+#if MEM_STATS
+  ++lwip_stats.mem.err;
+#endif /* MEM_STATS */
+  sys_sem_signal(mem_sem);
+  return NULL;
+}
+#endif
+