allocator: propagate errors