The code is inadvertently not letting an allocation succeed from a thread's alloc_region if it touches 'end_addr'.
That's not quite right, because you *are* allowed to hit it, just not go past.

This "overcautious" test is in (DEFUN ALLOCATION) where it says "(inst jmp :be NOT-INLINE)"
The test should be ":b" for ":below" but since I find order of the operands unclear as written, I'd prefer to swap them and make the branch test be ":a" for "above"
The code for x86 is totally different but looked right to me - it has ":be:" but that is to *skip* using the helper routine, so the sense is correct.

Affected lines in their corrected form are highlighted below.  Let me know if you see any issues with that. (QPX seems happy with it.)

* (disassemble '(lambda () (cons t t)))
 disassembly for (LAMBDA ())
 Size: 84 bytes
 790C41DF:       49896C2440       MOV [R12+64], RBP          ; no-arg-parsing entry point
      1E4:       4D8B5C2418       MOV R11, [R12+24]
      1E9:       498D4B10         LEA RCX, [R11+16]
      1ED:       493B4C2420       CMP RCX, [R12+32]
      1F2:       772B             JNBE L2
      1F4:       49894C2418       MOV [R12+24], RCX
      1F9:       498D4B07         LEA RCX, [R11+7]
      1FD: L0:   49316C2440       XOR [R12+64], RBP
      202:       7402             JEQ L1
      204:       CC09             BREAK 9                    ; pending interrupt trap
      206: L1:   48C741F94F001020 MOV QWORD PTR [RCX-7], 537919567
      20E:       48C741014F001020 MOV QWORD PTR [RCX+1], 537919567
      216:       488BD1           MOV RDX, RCX
      219:       488BE5           MOV RSP, RBP
      21C:       F8               CLC
      21D:       5D               POP RBP
      21E:       C3               RET
      21F: L2:   6A10             PUSH 16
      221:       4C8D1C25D08F4200 LEA R11, [#x428FD0]        ; alloc_tramp
      229:       41FFD3           CALL R11
      22C:       59               POP RCX
      22D:       488D4907         LEA RCX, [RCX+7]
      231:       EBCA             JMP L0