diff --git a/kernel/malloc.asm b/kernel/malloc.asm
index d9d2191..1fe4474 100644
--- a/kernel/malloc.asm
+++ b/kernel/malloc.asm
@@ -1,4 +1,4 @@
-; All these functions assume DS=0
+; All these functions assume DS=0 and ES=0
 
 malloc_reserve:
   push bx
@@ -15,14 +15,9 @@ malloc_reset:
   mov cx, 0x100 ; 256 words
   rep stosw
 
-  ; reserve IVT and BDA
+  ; reserve IVT and BDA, the extra data area and this table itself
   xor bx, bx
-  mov cx, 0x50
-  call malloc_reserve
-
-  ; reserve malloc table itself
-  mov bx, 0x0600
-  mov cx, 0x20
+  mov cx, 0x80
   call malloc_reserve
 
   ; reserve location for chainloaded boot sector
@@ -71,13 +66,6 @@ malloc_mark_allocated:
   or byte [bx+di], al
   ret
 
-; IN: 0:BX ptr to paragraph to be marked as free
-malloc_mark_free:
-  call malloc_calc_offsets
-  not al
-  and byte [bx+di], al
-  ret
-
 malloc_dump:
   call malloc_get_table
   mov si, di
@@ -97,3 +85,51 @@ malloc_dump:
   db " data %UkB", 0x0A, 0x0D, 0x00
   pop dx
   ret
+
+; allocate a 16 byte section
+; out BX ptr
+malloc:
+  ; search for a byte that is not 0xFF
+  mov di, 0x0600
+  mov cx, 0x0200
+  mov al, 0xFF
+  repe scasb
+  je fatal_oom
+  dec di
+  mov al, [es:di]
+
+  sub di, 0x0600
+  mov cl, 3
+  shl di, cl
+  jmp .ishere
+
+  ; advance one bit each time
+.nextbit:
+  inc di
+  shr al, 1
+.ishere:
+  test al, 1
+  jnz .nextbit
+
+  mov cl, 4
+  shl di, cl
+
+  mov bx, di
+  call malloc_mark_allocated
+  mov bx, di
+  ret
+
+; IN: 0:BX ptr to paragraph to be marked as free
+free:
+  call malloc_calc_offsets
+  not al
+  and byte [bx+di], al
+  ret
+
+fatal_oom:
+  call printf
+  db "PANIC OOM", 0x0A, 0x0D, 0x00
+  clip
+.loop:
+  hlt
+  jmp .loop