I think this cuestion could be more suitable to be asked in the Lwip development support channels, but anyway here my quick analysis of the sources.
The tcp_new_ip_type function allocates memory using tcp_alloc function, that at the end of the day uses the memory allocation functions provided in the lwip core code as alternative to C library standard malloc. As you can see in the mem.c file, the allocated memory is just taken from the heap, and you can configure lwip to use pool mechanisms.
It's bit more complicated to check the second one but my understanding is that again all the TCP buffers are allocated by the LwIP core using the memory allocation routines, hence using the heap.
Ibai Don’t forget to reply, kudo, and accept as solution.