When querying into a submap, we can go straight to the middle, avoiding overhead of tons of syscalls querying from the start. And when we walk backward finding the prior on a free, a smaller starting step is a win for common queries. This drops Dr. Memory from taking 25s (!) on a tiny app down to 8s. Most of the 8s is still memqueries on the leak scan but that's for another day.
Issue: #1979