You just said that if you ask for a pointer of size 7, it gives you one from the 8-11 bucket. Surely when you then free it it goes into the 4-7 byte bucket, meaning that chunks can migrate downwards over time?