msp/oneway-malloc: fix `realloc()`

Depending on the arguments, `realloc()` needs to act as `malloc()` or `free()`.