Okay, so to put this one to bed, the gotcha is in the definition of 'working set'. Entirely my misunderstanding, but it turns out that this function only returns those memory addresses that are currently paged into the process, and not all mapped pages.

So the blocks that were missing were those that hadn't been referenced recently and had hence been paged out of the working set to make room for more popular regions.

Thanks for listening
Admiral