The size of the output frame buffer used by the Transport is set unconditionally to the max frame size advertised by the peer:
In transport.c::int pn_do_open(pn_dispatcher_t *disp):
pn_buffer_ensure( disp->frame, disp->remote_max_frame );
This can potentially exhaust memory on small memory systems (eg, embedded devices). Instead, the output frame buffer should grow as needed based on the size of the payloads generated, limited by the remote_max_frame value.
And, of course, pn_buffer_ensure + caller should handle realloc failures instead of ignoring them.