It's pointer bumping in optimistic case. Eventually it runs out of current slab and... then there is some more work to do. And also those page faults are actual

It's pointer bumping in optimistic case. Eventually it runs out of current slab and... then there is some more work to do. And also those page faults are actually quite likely as it gives you memory that hasn't been used recently. Malloc tends to return often whatever was released last that matches the requested allocation size. It is indeed a tad more work to find it, but when it's found it's usually hot in the cache.