diff --git a/src/heap.c b/src/heap.c
index e55fdf34..63954b3b 100644
--- a/src/heap.c
+++ b/src/heap.c
@@ -506,7 +506,7 @@ typedef struct mi_visit_blocks_args_s {
 
 static bool mi_heap_area_visitor(const mi_heap_t* heap, const mi_heap_area_ex_t* xarea, void* arg) {
   mi_visit_blocks_args_t* args = (mi_visit_blocks_args_t*)arg;
-  if (!args->visitor(heap, &xarea->area, NULL, xarea->area.block_size, arg)) return false;
+  if (!args->visitor(heap, &xarea->area, NULL, xarea->area.block_size, args->arg)) return false;
   if (args->visit_blocks) {
     return mi_heap_area_visit_blocks(xarea, args->visitor, args->arg);
   }
diff --git a/src/os.c b/src/os.c
index b0eab87d..b7499796 100644
--- a/src/os.c
+++ b/src/os.c
@@ -260,6 +260,7 @@ static void* mi_unix_mmap(size_t size, size_t try_alignment, int protect_flags)
   #define MAP_ANONYMOUS  MAP_ANON
   #endif
   int flags = MAP_PRIVATE | MAP_ANONYMOUS;
+  int fd = -1;
   #if defined(MAP_ALIGNED)  // BSD
   if (try_alignment > 0) {
     size_t n = _mi_bsr(try_alignment);
@@ -271,9 +272,13 @@ static void* mi_unix_mmap(size_t size, size_t try_alignment, int protect_flags)
   #if defined(PROT_MAX)
   protect_flags |= PROT_MAX(PROT_READ | PROT_WRITE); // BSD
   #endif
+  #if defined(VM_MAKE_TAG)
+  // darwin: tracking anonymous page with a specific ID all up to 98 are taken officially but LLVM sanitizers had taken 99
+  fd = VM_MAKE_TAG(100);
+  #endif
   if (large_os_page_size > 0 && use_large_os_page(size, try_alignment)) {
     int lflags = flags;
-    int fd = -1;
+    int lfd = fd;
     #ifdef MAP_ALIGNED_SUPER
     lflags |= MAP_ALIGNED_SUPER;
     #endif
@@ -284,18 +289,18 @@ static void* mi_unix_mmap(size_t size, size_t try_alignment, int protect_flags)
     lflags |= MAP_HUGE_2MB;
     #endif
     #ifdef VM_FLAGS_SUPERPAGE_SIZE_2MB
-    fd = VM_FLAGS_SUPERPAGE_SIZE_2MB;
+    lfd |= VM_FLAGS_SUPERPAGE_SIZE_2MB;
     #endif
     if (lflags != flags) {
       // try large page allocation
       // TODO: if always failing due to permissions or no huge pages, try to avoid repeatedly trying?
       // Should we check this in _mi_os_init? (as on Windows)
-      p = mi_unix_mmapx(size, try_alignment, protect_flags, lflags, fd);
+      p = mi_unix_mmapx(size, try_alignment, protect_flags, lflags, lfd);
       if (p == MAP_FAILED) p = NULL; // fall back to regular mmap if large is exhausted or no permission
     }
   }
   if (p == NULL) {
-    p = mi_unix_mmapx(size, try_alignment, protect_flags, flags, -1);
+    p = mi_unix_mmapx(size, try_alignment, protect_flags, flags, fd);
     if (p == MAP_FAILED) p = NULL;
   }
   return p;
diff --git a/src/page.c b/src/page.c
index e6be8df6..c644a5b3 100644
--- a/src/page.c
+++ b/src/page.c
@@ -143,7 +143,7 @@ static void mi_page_thread_free_collect(mi_page_t* page)
   mi_thread_free_t tfree;
   mi_thread_free_t tfreex;
   do {
-    tfreex = tfree = page->thread_free;
+    tfree = page->thread_free;
     head = mi_tf_block(tfree);
     tfreex = mi_tf_set_block(tfree,NULL);
   } while (!mi_atomic_compare_exchange((volatile uintptr_t*)&page->thread_free, tfreex, tfree));