alt Hacker NewsMS-DOS doesn’t have memory protection, so another option is that the running program[1] or something like a TSR or driver could have corrupted the headers.
[1] I guess in a modern system a process can still trash its own malloc, but not the kernel’s page allocation data.
Oh sure, and that happened a lot, but you'd usually see a gp fault before you would anything obscure...