The cc65 doc explicitly states that the return value of _heapmaxavail() can be used as parameter of malloc(). To actually allow for that the size of HEAP_ADMIN_SPACE has to be substracted from the raw size of the largest free heap block.
; F = F->next;
-@L2: iny ; Points to F->next
+@L2: iny ; Points to F->next
lda (ptr1),y
tax
iny
stx ptr1
jmp @L1
-; return Size;
+; if (Size < HEAP_ADMIN_SPACE) return 0;
@L3: lda ptr2
+ sub #HEAP_ADMIN_SPACE
ldx ptr2+1
+ bcs @L5
+ bne @L4
+ txa
rts
+
+; return Size - HEAP_ADMIN_SPACE;
+
+@L4: dex
+@L5: rts