The llsc stack is not safe from ABA with how LL/SC is used

On the Cortex-M, STREX will always fail if the processor takes an exception between it and its corresponding LDREX operation

But the load of next at 8000136 is done outside of the LDREX...STREX sequence.

So if the process is preempted between 8000136 and 800013a and during the
preemption we cause the ABA problem (e.g. given h->A->B->C->0, do pop A, pop B, push A resulting in h->A->C->0 with B being in use).

Now given Cortex-M implementations might not have that problem:

A context switch might cause a subsequent Store-Exclusive to fail, requiring a load ... store sequence to be replayed. To minimize the possibility of this happening, ARM recommends that the Store-Exclusive instruction is kept as close as possible to the associated Load-Exclusive instruction, see Load-Exclusive and Store-Exclusive usage restrictions.

(quote from the ARM®v7-M ArchitectureReference Manual, linked in the sourcecode)

The problem is this is a might so depending on where you get your Cortex-M chip from this might or might not be a sound implementation.

https://github.com/japaric/heapless/blob/9ff3a5fa8968fb263cece456ccc9505dc913147e/src/pool/mod.rs#L123-L139

Start with src/pool/mod.rs lines 123-139 and inspect how next is loaded relative to the LDREX/STREX sequence. Read the referenced ARMv7-M guidance and the issue's ABA example to understand the portability concern. Done means the stack's safety across the relevant Cortex-M implementations is resolved and the behavior is documented.