So from the kernel's initialization, I have figured out exactly which region it considers to be BSS. And there's conspicuously a gap between data and BSS in the memory map.
I have data right after text. But looking back at the bootloader, isn't read into `text_addr+text_size`, it's read into `PGROUND(text_addr+text_size)`, so fingers crossed that moving that forward a bit makes things start making sense!