As far as I can see the problem is that Linux maps things to the top of address space, blocking 0x7ffe0000. So even though it is below 2GB, we can't grab this address with 2/2 memsplit.
In my quick'n'dirty testing vDSO (which, incidentally, is a Linux feature that has similar purpose to KUSER_SHARED_DATA) and the initial stack are in the way.
I am not an authoritative expert on this in any way :-/ .