Apparently even if there is not enough xen memory to balloon up, balloon driver will try to fulfill the request later, when some memory is freed. Thus, in do_balloon, do not limit mem_set to the available memory.