Ok, one quick look with Cthulhu.jl later and it seems like the return type passed to ccall is taken as a literal, i.e. does not participate in the usual TypeVar resolution?
(arr = $(Expr(:foreigncall, "jl_malloc", Ptr{T}, svec(UInt64), 0, :(:ccall), :(%6), :(%4))))
This would be consistent (if mildly annoying) with the documentation of the Expr(:foreigncall):
args[2]::Type: RT
The (literal) return type, computed statically when the containing method was defined.
Type inference definitely infers the type of the result correctly, since it infers arr as Ptr{Int32} correctly, so this might just be a missed bit in the compiler. People don’t usually go around having inferred ccalls, since one C function can generally only have one return type.