I understand what mallocarray does and why it is preferable. In these cases, the multiplied values happen to be constrained such that overflow is not possible. Given that precondition, the two patterns are functionally equivalent.

For what it's worth, I tend to advocate for using mallocarray and would use mallocarray in the same places Donenfeld does here. But unless overflow can actually happen, it's stylistic rather than "bug."