An allocator is free to only `mmap` addresses that are within a range. I think jemalloc could allow you to do that using custom arenas.