malloc + Automatic Reference Counting?

Yes. ARC only applies to Objective-C instances, and does not apply to malloc() and free().

Some 'NoCopy' variants of NSData can be paired with a call to malloc which will free you from having to free anything.

NSMutableData can be used as somewhat higher-overhead version of calloc which provides the convenience and safety of ARC.

Yes, you have to code the call to free yourself. However, your pointer may participate in the reference counting system indirectly if you put it in an instance of a reference-counted object:

@interface MyObj : NSObject {
    int *buf;
}
@end

@implementation MyObj

-(id)init {
    self = [super init];
    if (self) {
        buf = malloc(100*sizeof(int));
    }
}
-(void)dealloc {
    free(buf);
}

@end

There is no way around writing that call to free - one way or the other, you have to have it in your code.