STM32F429 run away after the first time burning the program

Question

The first time the new chip burned the program, it froze and blocked some irrelevant code. After burning it again, it ran normally. It restored the original code and ran normally again. What is the reason? The malloc function was used in the code, but it was also released correctly. It felt like there was an issue with stack space, but after restoring the code, it could still run normally, which is not quite like this kind of problem. It is strange that only the first time a new chip burns the program, this problem occurs. However, after multiple program crashes, there is no problem of running and flying.Here are some parts of the project:

#include "bsp_all_define.h"
#include "bsp_cms_i2c.h"
#include "app_init.h"

#define EEPROM_STATE_ADR  0X0000
#define EEPROM_DATA_START_ADR  0X0001
uint8_t EEPROM_used_val=0x01;
typedef union
{
    struct
    {
        uint16_t wData_L:8;
        uint16_t wData_H:8;
    }bBit;
    uint16_t nData;
}UN_U16Data;

typedef struct 
{
      UN_U16Data wAI_Filter;
      UN_U16Data wTemptureFilter_1;
      UN_U16Data wTemptureFilter_2;
      UN_U16Data wVoltageFilter;
      UN_U16Data wOCV_Filter;
      UN_U16Data wRCV_Filter;
          UN_U16Data wCurrentFilter;
}S_eeprom_data;
S_eeprom_data eeprom_data;
S_eeprom_data eeprom_data_new;
uint8_t EEPROM_state;
/*******************************************************************************
* Function Name  : structToU8Array
* Description    : 
* Input          : None
* Output         : None
* Return         : None
********************************************************************************/
void structToU8Array(void *data, uint8_t *array, int size) {
     uint8_t *ptr = (uint8_t *)data;
    for (int i = 0; i < size; i++) {
        array[i] = *(ptr + i);
    }
}
/*******************************************************************************
* Function Name  : U8ArrayTostruct
* Description    : 
* Input          : None
* Output         : None
* Return         : None
********************************************************************************/
void U8ArrayTostruct(void *data, uint8_t *array, int size) {
    uint8_t *ptr = (uint8_t *)data;
    for (int i = 0; i < size; i++) {
         *(ptr + i)=array[i];
    }
}
/*******************************************************************************
* Function Name  : Modbus_data_to_eeprom
* Description    : 
* Input          : 
* Output         : 
* Return         : 
********************************************************************************/
void Modbus_data_to_eeprom(void)
{
    eeprom_data_new.wAI_Filter=xMbHoldReg.wAI_Filter;
    eeprom_data_new.wTemptureFilter_1=xMbHoldReg.wTemptureFilter_1;
    eeprom_data_new.wTemptureFilter_2=xMbHoldReg.wTemptureFilter_2;
    eeprom_data_new.wVoltageFilter=xMbHoldReg.wVoltageFilter;
    eeprom_data_new.wOCV_Filter=xMbHoldReg.wOCV_Filter;
    eeprom_data_new.wRCV_Filter=xMbHoldReg.wRCV_Filter;
    eeprom_data_new.wCurrentFilter=xMbHoldReg.wCurrentFilter;
}
/*******************************************************************************
* Function Name  : EEPROM_data_to_modbus
* Description    : 
* Input          : 
* Output         : 
* Return         : 
********************************************************************************/
void EEPROM_data_to_modbus(void)
{
    xMbHoldReg.wAI_Filter=eeprom_data_new.wAI_Filter;
    xMbHoldReg.wTemptureFilter_1=eeprom_data_new.wTemptureFilter_1;
    xMbHoldReg.wTemptureFilter_2=eeprom_data_new.wTemptureFilter_2;
    xMbHoldReg.wVoltageFilter=eeprom_data_new.wVoltageFilter;
    xMbHoldReg.wOCV_Filter=eeprom_data_new.wOCV_Filter;
    xMbHoldReg.wRCV_Filter=eeprom_data_new.wRCV_Filter;
    xMbHoldReg.wCurrentFilter=eeprom_data_new.wCurrentFilter;
}
/*******************************************************************************
* Function Name  : EEPROM_data_init
* Description    : 
* Input          : 
* Output         : 
* Return         : 
********************************************************************************/
void EEPROM_data_init(void)
{
    int size=sizeof(S_eeprom_data);
    EEPROM_Read(EEPROM_STATE_ADR,&EEPROM_state,1);
    if(EEPROM_state==0xFF||EEPROM_state!=EEPROM_used_val)//EEPROM未使用，设置默认参数
    {
        eeprom_data_new.wAI_Filter.nData =50;
        eeprom_data_new.wTemptureFilter_1.nData=50;
        eeprom_data_new.wTemptureFilter_2.nData=50;
        eeprom_data_new.wVoltageFilter.nData=50;
        eeprom_data_new.wOCV_Filter.nData=50;
        eeprom_data_new.wRCV_Filter.nData=50;
        eeprom_data_new.wCurrentFilter.nData=50;
        EEPROM_write_buff(EEPROM_STATE_ADR,&EEPROM_used_val,0x01);
        EEPROM_data_to_modbus();
    }
    else
    {
     uint8_t* data=malloc(size);
     EEPROM_Read(EEPROM_DATA_START_ADR,data,size);
     U8ArrayTostruct(&eeprom_data,data,size);
     U8ArrayTostruct(&eeprom_data_new ,data,size);
     EEPROM_data_to_modbus();
     free(data);
    }
}


/*******************************************************************************
* Function Name  : Data_changed_save
* Description    : 
* Input          : None
* Output         : None
* Return         : None
********************************************************************************/
void Data_changed_save(void)
{
    Modbus_data_to_eeprom();
    if(memcmp(&eeprom_data, &eeprom_data_new, sizeof(S_eeprom_data)) != 0)
    {
        int size=sizeof(S_eeprom_data);
        uint8_t* data=malloc(size);
        structToU8Array(&eeprom_data_new,data,size);
        EEPROM_write_buff(EEPROM_DATA_START_ADR,data,size);
        free(data);
        eeprom_data=eeprom_data_new;
    }
}
//
void Task_dataThread(void* pArg);
/*******************************************************************************
* Function Name  : Task_dataInit
* Description    : 
* Input          : None
* Output         : None
* Return         : None
********************************************************************************/
void Task_dataInit(void)
{
    g_xSysVar.dataThread.id = setThreadStart(Task_dataThread, 1024);
}

/*******************************************************************************
* Function Name  : Task_dataThread
* Description    : 数据更新线程
* Input          : None
* Output         : None
* Return         : None
********************************************************************************/
void Task_dataThread(void* pArg)
{
  EEPROM_data_init();
    while(1)
    {
    Data_changed_save();
    g_xSysVar.dataThread.nsignal++;
        osThreadYield();
        osDelay(100);
    }
}

xMbHoldReg is global variable about modbus.The underlying driver of EEPROM has also been verified to be usable.

give me some suggestions useful please.