54ed272d75
The previous cap at canonical_top_page still left mmap_min at 0x7FFFFFFFF000 (last canonical page), but there is no valid region above that for anonymous mmaps — find_free_near would still return None. Skip the mmap_min update entirely when the mapping end is at or past the canonical top, so mmap_min retains its previous value which points into a valid (lower) region of the address space.