Fixed negative increments in sbrk() potentially moving the prog_brk beyond L_USER_HEAP_START