Fix bad realloc call - need sizeof(T)
Properly correct callee-save counting

If we already have a callee-save vector, we have at least two,
since the last one `p' is left on satisfies .is_float == 2.