A historical oddity. With ASLR, placed near-ish the PIE base Starts with size of 0 Manged by brk() and sbrk() syscalls