Does \end command issue a \vfill
in tex.web
you find
@<Declare act...@>=
function its_all_over:boolean; {do this when \.{\\end} or \.{\\dump} occurs}
label exit;
begin if privileged then
begin if (page_head=page_tail)and(head=tail)and(dead_cycles=0) then
begin its_all_over:=true; return;
end;
back_input; {we will try to end again after ejecting residual material}
tail_append(new_null_box);
width(tail):=hsize;
tail_append(new_glue(fill_glue));
tail_append(new_penalty(-@'10000000000));@/
build_page; {append \.{\\hbox to \\hsize\{\}\\vfill\\penalty-'10000000000}}
end;
its_all_over:=false;
exit:end;
where
tail_append(new_glue(fill_glue));
implies, as you suspected, that fill glue is added by the primitive.
Here's David Carlisle's answer in Don knuth words (The TeXbook, page 264)
When TeX sees an \end command, it terminates the job only if the main vertical list has been entirely output and if \deadcycles=0. Otherwise it inserts the equivalent of
\line{} \vfill \penalty-'10000000000
into the main vertical list, and prepares to read the `\end' token again. This has the effect of invoking the output routine repeatedly until everything has been shipped out. In particular, the last column of two-column format will not be lost.