How does the microcontroller keep track of where a malloc will point to in the heap?

This is implementation defined, malloc will be in some library and compile like any other function. Here is one implementation you can look at: https://github.com/32bitmicro/newlib-nano-1.0/blob/master/newlib/libc/stdlib/malloc.c

Usually, malloc stores a header full of information (like number of bytes allocated) next to each assignment.

After free(x), are subsequent mallocs able to use the memory that was allocated for x or is it blocked because of malloc for y?

free(x) frees up the memory for x, y has nothing to do with it.

For clarity, each call to malloc returns a new pointer. But if x is freed, that memory region could be returned again.

You also don't need to cast the pointer to char*, and it's recommended not to!