When this code runs, seL4 prints the following during the cspace_ut_retype_addr call:
<<seL4 [decodeUntypedInvocation/128 Tffeead00 @b330]: Untyped Retype: Invalid destination address.>>
This error comes from inside libsel4cspace, specifically where it calls seL4_Untyped_RetypeAtOffset(). I've read the libsel4cspace documentation and enabled CSPACE_DEBUG, but nothing from the output looks amiss (I'm not an expert though, and I can post the relevant debug output).