When realloc shrinks a allocated block, where is the memory free'd?

There is no guarantee that during downsizing the same block of memory will be returned to you with some(downsized) memory freed. You should not be relying on it because it is simply not guaranteed.

C99 Standard 7.20.3.4-1: The realloc function:

The realloc function deallocates the old object pointed to by ptr and returns a pointer to a new object that has the size specified by size. The contents of the new object shall be the same as that of the old object prior to deallocation, up to the lesser of the new and old sizes. Any bytes in the new object beyond the size of the old object have indeterminate values.

If the memory block is relocated, data will be copied from the bottom of the old buffer, up to the new size.

If you want to preserve the top of your data, you will have to do a malloc/memmove or similar.

How this relates to your bits depends on how you map your data into the block, I would have thought. This ought to be controllable.

from 'man realloc()'

 The realloc() function changes the size of the block pointed to by ptr to size bytes and returns a pointer to the (possi- bly moved) block. The contents will be unchanged up  to  the lesser  of  the  new  and  old sizes.