Why does malloc work right after flashing cortex-m3?

I am trying to dynamically allocate memory using newlib malloc running on cortex-m3 (bare-metal), and I ran into a perplexing problem. Immediately after blinking, the malloc devices and work for free as expected. However, as soon as I reset, the malloc device returns NULL. Everything else works except malloc. Any hints on what might cause this behavior?

Here is my linker script:

MEMORY
{
    FLASH (rx) : ORIGIN = 0x00000000, LENGTH = 512K
    SRAM (rwx) : ORIGIN = 0x10000000, LENGTH = 32K
}

/* Section Definitions */
SECTIONS
{
   .text :
  {
    KEEP(*(.isr_vector .isr_vector.*))
    *(.text .text.*)
    *(.gnu.linkonce.t.*)
    *(.glue_7)
    *(.glue_7t)
    *(.gcc_except_table)
    *(.rodata .rodata*)
    *(.gnu.linkonce.r.*)
    _etext = .;
  } > FLASH

  __exidx_start = .;
  .ARM.exidx   : { *(.ARM.exidx* .gnu.linkonce.armexidx.*) } > FLASH
  __exidx_end = .;

  /*.data : AT (_etext)*/
  .data : AT (__exidx_end)
  {
    _data = .;
    *(vtable vtable.*)
    *(.data .data.*)
    *(.gnu.linkonce.d*)
    . = ALIGN(4);
    _edata = . ;
  } > SRAM

  /* .bss section which is used for uninitialized data */
  .bss (NOLOAD) :
  {
    _bss = . ;
    *(.bss .bss.*)
    *(.gnu.linkonce.b*)
    *(COMMON)
    . = ALIGN(4);
    _ebss = . ;
  } > SRAM

  .stackarea (NOLOAD) :
  {
    . = ALIGN(8);
    *(.stackarea .stackarea.*)
    . = ALIGN(8);
  } > SRAM

  . = ALIGN(4);
  _end = . ;
  PROVIDE (end = .);

}

And this is from my memory card:

.stackarea      0x10000d3c        0x4
                0x10000d40                . = ALIGN (0x8)
 *fill*         0x10000d3c        0x4 00
 *(.stackarea .stackarea.*)
                0x10000d40                . = ALIGN (0x8)
                0x10000d40                . = ALIGN (0x4)
                0x10000d40                _end = .
                0x10000d40                PROVIDE (end, .)

When malloc succeeds, it begins to allocate the value 0x10000d48.