How about something like this to make sure solutions don't truncate addresses?

#include <memory.h>
#include <stdint.h>
#include <string.h>

  const char *const s = "11";
  char *const buf = malloc(((size_t)1 << 32) + sizeof(s) - 1);
  char *const boundary = (char*)((intptr_t)buf & ~(intptr_t)0xffffffff | 0xffffffff);
  printf("%zx\n", (size_t)boundary);
  printf("%zx\n", (size_t)boundary+1);
  strcpy(boundary, s);
  cr_expect(has_digits(boundary));
  cr_expect(has_digits(boundary + 1));
  free(buf);

(It looks like mallocing 4 GB is OK and unused pages are reserved but never commited.)