On amd64, a pointer must have the top 17 bits all the same, or else it is not a valid pointer. On Windows and Linux, user space is the "lower half" which means

On amd64, a pointer must have the top 17 bits all the same, or else it is not a valid pointer. On Windows and Linux, user space is the "lower half" which means bits 47 to 63 must all be zero for a value to be a pointer. This gives you 65535 tag values without using the LSB at all.