Deleting Pointer Causing Debug Assert

I've been working on a memory pool allocator class, and no major problems have arisen, sans Visual Studio's debug assertion (_BLOCK_TYPE_IS_VALID(pHead->nBlockUse)) being thrown whenever I try to free the memory allocated by new with delete.

template<class T, u8 alignment, u32 poolSize>
class PoolAllocator
{
private:
    u8          _paddedSize;    // The size in bytes of each allocated chunk of memory. 
    u32         _numAllocations;// The number of allocations made by the pool.          
    u32         _freeBytes;     // The number of bytes left in the pool.                
    u32         _usedBytes;     // The number of bytes currently occupied in the pool.  
    FreeList*   _freeListHead;  // A pointer to a freed space in memory.                
public:
    PoolAllocator() :
        _paddedSize((sizeof(T) > sizeof(uptr) ? sizeof(T) : sizeof(uptr))),
        _numAllocations(0),
        _freeBytes(0),
        _usedBytes(0),
        _freeListHead(nullptr)
    {
        _freeListHead = reinterpret_cast<FreeList*>(operator new (_paddedSize * poolSize));
        _freeBytes = _paddedSize * poolSize;

        uptr current = reinterpret_cast<uptr>(_freeListHead);
        uptr last = current + (_paddedSize * poolSize);
        for (int i = 0; i < poolSize-1; i++)
        {
            uptr next = current + _paddedSize;
            (reinterpret_cast<FreeList*>(current))->next = reinterpret_cast<FreeList*>(next);
            current += _paddedSize;
        }
        reinterpret_cast<FreeList*>(current)->next = nullptr;
    }
    T *allocate()
    {
        if (_freeListHead != nullptr && _freeBytes >= _paddedSize)  // Make sure the pool has memory left
        {
            uptr *toReturn = reinterpret_cast<uptr*>(_freeListHead);    // Cast the pointer to a modifiable data type.
            _freeListHead = _freeListHead->next;    // VITAL THAT THIS IS BEFORE SETTING DATA TO 0.
            *toReturn = 0;  // Set the data at the memory location to 0.

            _freeBytes -= _paddedSize;
            _usedBytes += _paddedSize;
            _numAllocations++;

            printf("Allocated %d bytes of memory at %p.\n", _paddedSize, toReturn);
            return reinterpret_cast<T*>(toReturn);
        }
        else
        {
            printf("Pool allocator out of memory! Returning nullptr.\n");
            return nullptr;
        }
    }
    void free(T **ptr)
    {
        FreeList *newHead = reinterpret_cast<FreeList*>(*ptr);
        *ptr = nullptr;
        newHead->next = _freeListHead;
        _freeListHead = newHead;

        _freeBytes += _paddedSize;
        _usedBytes -= _paddedSize;
        _numAllocations--;
        printf("Freed %d bytes of memory at %p.\n", _paddedSize, _freeListHead);
    }
    void clear()
    {
        assert(_usedBytes == 0);

        FreeList *head = _freeListHead;
        while (head != 0)
        {
            FreeList *next = head->next;
            delete reinterpret_cast<T*>(head);
            head = next;
        }

        _paddedSize = 0;
        _numAllocations = 0;
        _freeBytes = 0;
        _usedBytes = 0;
        _freeListHead = nullptr;
    }
};

The test code I am using:

int main()
{
    PoolAllocator<int, 4, 4> pool;
    int *a, *b, *c, *d, *e;

    a = pool.allocate();
    b = pool.allocate();
    c = pool.allocate();
    d = pool.allocate();
    pool.free(&a);
    e = pool.allocate();

    printf("A | %p\t%d\nB | %p\t%d\nC | %p\t%d\nD | %p\t%d\nE | %p\t%d\n", a, 0, b, *b, c, *c, d, *d, e, *e);

    pool.free(&b);
    pool.free(&c);
    pool.free(&d);
    pool.free(&e);
    pool.clear();

    return 0;
}

The problem area lies here:

void clear()
{
    assert(_usedBytes == 0);

    FreeList *head = _freeListHead;
    while (head != 0)
    {
        FreeList *next = head->next;
        delete reinterpret_cast<T*>(head); // Debug assert
        head = next;
    }

    _paddedSize = 0;
    _numAllocations = 0;
    _freeBytes = 0;
    _usedBytes = 0;
    _freeListHead = nullptr;
}

What this code is supposed to do is increment through the linked list of memory locations where individual pieces of data of type T are being stored. My reasoning for this being a valid piece of code is that, because the initially allocated memory is divided into pieces the size of sizeof(T). Therefor, I assumed that it would be appropriate to typecast the memory address to a pointer of type T* so that the individual block of memory would be completely deallocated. This would be done for the entire linked list, ensuring that all allocated memory is freed. However, when I run the code, it always throws the assert on the delete.

Stepping through the code showed that after the first iteration of typecasting and deleteing, the pointers take on strange values (the next variable, for instance:

next 0x004b2864 {next=0xfeeefeee {next=??? } } FreeList *

Whereas before, it was

next 0x006c2864 {next=0x006c2860 {next=0x006c285c {next=0x00000000 } } } FreeList *

just as it should be). I have tried this approach many different times in many different ways, including typecasting to void* instead of T*.

This problem has had me stumped for days, and any help would be appreciated. Thank you.