Example with dynamic array works with uint8_t, why not with uint16_t?
I suspect you changed everything to uint16_t but did not change the malloc call to account for the 2-byte size. Original:

_tester = (uint16_t *)malloc(len);


Try changing it to

_tester = (uint16_t *)malloc(len * sizeof(uint16_t));


This will multiply len by 2 to ensure it allocates enough space for all of the data.

(Beware that if you also changed len to be uint16_t then some of those random numbers from 1..1000 will be large enough to deplete all of the memory on an Uno. But at least it doesn't seem to crash.)