I think I fixed it:

Code:
void * paw__realloc( PAGE *page, struct _ADDR *addr, size_t size )
{
	char *ptr, *end, *nxt, *tmp;

	if ( !size )
	{
		if ( addr->prev )
			addr->prev->next = addr->next;

		if ( addr->next )
			addr->next->prev = addr->prev;

		addr->size = 0;
		return NULL;
	}

	end = ((char*)page) + page->size;
	ptr = (char*)(addr + 1);
	nxt = ptr + size;
	tmp = addr->next ? (char*)(addr->next) : end;

	/* Can we make do with current pointer? */
	if ( nxt > tmp )
		return NULL;

	addr->desc = ADDR_DESC;
	addr->size = size;

	if ( addr->next )
		return ptr;

	tmp = end - (sizeof(struct _ADDR*) + 1);

	if ( nxt < tmp )
	{
		addr->next = memset( nxt, 0, sizeof(struct _ADDR) );
		addr->next->prev = addr;
	}

	return ptr;
}
Get's further but either it or another piece of code is faulty because a line that succeeded before I started this code is now failing, the only reason for failure is not getting the buffers it's expecting, however lines before it that get buffers do succeed so I'm at least along the right path of logic.