SpaceX pays significantly higher than NASA if you believe levels.fyi, so I think it depends what industry average you are using. If you compare to general software engineering then it certainly pays less, but that is because there are many talented engineers happy to take a pay cut to work on something they find personally motivating (space exploration).

To be clear, removing the bounds checks led to the observed performance degradation. Your statement beginning with "I am a Rust fan, but..." suggests that you might have interpreted it as the other way around

I certainly did. Thank you for pointing that out. That suggests then that the problem is the tests are bogus.

In addition to the other comment, the primary problem with malloc() in embedded environments is that you push the memory exhaustion error to runtime, rather than compile time (not memory fragmentation). A call to malloc() in a rarely-called function might not exhaust available RAM until a system has been deployed for days or weeks, which is much worse than finding out your program requires too much memory at compile time, or at boot time. While stack overflows are always possible, many embedded projects at least have static analysis tools that can (with varying degrees of soundness) calculate worst-case stack use.

For Cortex-M embedded topics, memfault's blog is simply one of the best out there. Consistently great posts even though they are written by a bunch of different authors. I go back to https://interrupt.memfault.com/blog/cortex-m-fault-debug all the time when debugging hard faults on different systems.

Even if you regularly write embedded code for Cortex-M MCUs, scroll through their list of posts and you'll find several that will teach you something new and useful.

I'm a bit jealous of the fact they have such good blog posts. I did a deep dive on a couple of different architectures and always wanted to write something so nice and useful for other people with the stuff I know.

I find it hard to imagine that a product which lasts 2 years and is smaller than a shot glass can be much of an environmental concern. I would have to throw away 10000 pairs of airpods to match the volume in a landfill of throwing out a single TV. Similarly, 10000 pairs of airpods use about as much raw materials as that single TV. This just seems like the wrong battle to fight

And who repairs flatscreen TVs? A very small percentage of the market

What ARM chip are you considering this for? Is it a Cortex M?

No, Cortex A in an Arria10 SoC. The boot process is tedious because you have to load the FPGA before you can access the external RAM so the stage 1 bootloader has to fit 256KB code+data. Currently I'm using a multi-stage U-Boot but for simplicity and robustness I'd like to cram everything in a single stage loader.

Since I can't get u-boot to create a small enough image with all the features that I want (and also because I want to add vendor-specific customizations on top) I decided to try and rewrite a small, single purpose loader from scratch. I considered Rust but then that meant that I'd have to port or rewrite all of u-boot's code I want to reuse (especially the vendor code contributed by Altera mentioned in the previous post). So C it is.