Replace the 50 KB static BSS _hotGroupBuf array with a heap pointer allocated once per font (ensureHotGroupBuf). The buffer is sized to the largest group in the active font — 6 KB for small fonts, ~50 KB for 18pt — so no memory is wasted when rendering body text at typical sizes. The buffer persists across pages (freed only in freeHotGroup/deinit), so there is exactly one malloc per font session rather than one per page. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>