Help with malloc/sbrk/new

First off, I am using WinArm and an AT91SAM7A3.

I'm attempting to write my own malloc function.  Until now we've been
using the built in new() function that is available for the ARM.  We are
in the process of creating a boot loader though, so we need much finer
control over where data is stored.

When I need to allocate space, I call this function.  Previously I had
the top part commented out and was just doing the "U8* pReturn = new
U8[size]" line.

static U32   s_nAmountUsed = 0;
static U8*   s_pNextBlock = NULL;
extern void* __bss_end;

void* Heap::Alloc(size_t size)
{
    if (!s_pNextBlock) {
        s_pNextBlock = (U8*)&__bss_end;
    }

    U8* pReturn = s_pNextBlock;
  s_pNextBlock += size;


    //U8* pReturn = new U8[size];
  s_nAmountUsed += (U32)size;

  return pReturn;
}

Related Linker Script:
  .bss (NOLOAD) :
  {
    __bss_start = . ;
    _bss_start_ = . ;
    *(.bss)
  *(.gnu.linkonce.b*)
    *(COMMON)
    . = ALIGN(4);
  } > RAM

  . = ALIGN(4);
  _bss_end_ = . ;
  PROVIDE (__bss_end = .);

  _end = . ;
  PROVIDE (end = .);


Related Map file output:
 *(.gnu.linkonce.b*)
 *(COMMON)
                0x002016cc                . = ALIGN (0x4)
                0x002016cc                . = ALIGN (0x4)
                0x002016cc                _bss_end_ = .
                0x002016cc                PROVIDE (__bss_end, .)
                0x002016cc                _end = .
                0x002016cc                PROVIDE (end, .)
                0x002016cc                . = ALIGN (0x4)


I am using this in a program that has an LCD attached to it, and the
program allocs space for a string, and then sprints it to the screen.
It works beautifully when I use new() and fails quite miserably when I
try to use mine.

s_nAmountUsed is a debug statement that I can access from hyper
terminal.  I had a smaller version of the program that does not load up
the LCD screen, so it doesn't hang.  I've adjusted what s_nAmountUsed is
set to and run the program a number of times, and pNextBlock starts off
pointing to 2016cc and once everything has been allocated it points to
2023EC, which equates to 3360 bytes of allocated memory, which is
exactly what it should be.  So I seem to be moving across memory
appropriately...

Anyone have any thoughts about what I might be doing wrong?