I had a same problem, and my fix was to specify some random address to mmap instead of providing NULL. My guess is that the OS tries to pack virtual addresses as tightly as possible, so there is no space for remap to grow.