You're right--if it can't find memory within the heap, it will invoke a call to brk and it will allocate it from the OS and thereby invoking a syscall. Apologies for my lumping of malloc as a syscall :)

Neither is fopen, for that matter. Of course, many library functions end up doing syscalls underneath, which may be the source of the OP's confusion (e.g. malloc may do brk or mmap; fopen usually does open; etc.)