Something doesn't add up here.
First, your starting addresses for the SRAM aren't consistent. Above you say that SRAM starts at 1FFF,E000, below you say 1FFF,EFFF. I presume the latter is just a typo.
Second, 1FFF,E000 to 2000,3FFF is not 16k, it's 24k.
Finally, when I actually run a malloc...