Make reinterpret_cast more descriptive.

Add an operation to get a tag free pointer from an address_t, and use it

src/snmalloc/aal/address.h

@@ -290,4 +290,13 @@ namespace snmalloc
     return static_cast<size_t>(a - pointer_align_down<alignment>(a));
   }
 
+  /**
+   * Convert an address_t to a pointer.  The returned pointer should never be followed.
+   * On CHERI following this pointer will result in a capability violation.
+   */
+  template<typename T>
+  SNMALLOC_FAST_PATH_INLINE T* useless_ptr_from_addr(address_t p)
+  {
+    return reinterpret_cast<T*>(p);
+  }
 } // namespace snmalloc

src/snmalloc/mem/freelist.h

@@ -695,7 +695,7 @@ namespace snmalloc
           // the Freelist builder always knows which block it is referring too.
           head[i] = Object::code_next(
             address_cast(&head[i]),
-            reinterpret_cast<Object::T<BQueue>*>(slab),
+            useless_ptr_from_addr<Object::T<BQueue>>(address_cast(slab)),
             key);
         }
       }