diff --git a/sys/dev/dev_gc.pas b/sys/dev/dev_gc.pas
index 9f1d1b9c..8eb28a3b 100644
--- a/sys/dev/dev_gc.pas
+++ b/sys/dev/dev_gc.pas
@@ -763,7 +763,7 @@ end;
 
 Function gc_ioctl(dev:p_cdev;cmd:QWORD;data:Pointer;fflag:Integer):Integer;
 var
- vaddr:QWORD;
+ vaddr:Pointer;
 begin
  Result:=0;
 
@@ -814,7 +814,7 @@ begin
             begin
              if (gc_submits_allowed_vaddr=nil) then
              begin
-              vaddr:=0;
+              vaddr:=nil;
               Result:=mmap_addr($fe0100000,$4000,1,@vaddr);
 
               if (Result<>0) then
diff --git a/sys/dev/display_soft.pas b/sys/dev/display_soft.pas
index ca4c660f..511cc7f2 100644
--- a/sys/dev/display_soft.pas
+++ b/sys/dev/display_soft.pas
@@ -19,16 +19,21 @@ type
   init :DWORD;
   index:DWORD;
   attr :t_register_buffer_attr;
+  size :QWORD;
+ end;
+
+ t_ptr_pair=packed record
+  left :Pointer; //buffer ptr
+  right:Pointer; //Stereo ptr
  end;
 
  p_buffer=^t_buffer;
  t_buffer=packed record
   init :DWORD;
   attr :DWORD;
-  left :Pointer; //buffer ptr
-  right:Pointer; //Stereo ptr
-  left_dmem :Pointer; //buffer ptr
-  right_dmem:Pointer; //Stereo ptr
+  orig :t_ptr_pair;
+  mirr :t_ptr_pair;
+  size :QWORD;
  end;
 
  PQNode=^TQNode;
@@ -141,7 +146,7 @@ uses
  }
  md_time,
  sys_bootparam,
- kern_dmem;
+ vm_mmap;
 
 //
 
@@ -270,6 +275,13 @@ begin
  Result:=0;
 end;
 
+function get_buf_size(attr:p_register_buffer_attr):QWORD;
+begin
+ //TODO: neo mode, etc
+ Result:=((attr^.pitchPixel+127) and (not 127))*
+         ((attr^.height    +127) and (not 127))*4;
+end;
+
 function TDisplayHandleSoft.RegisterBufferAttribute(attrid:Byte;attr:p_register_buffer_attr):Integer;
 begin
  if (m_attr[attrid].init<>0) then Exit(EINVAL);
@@ -277,6 +289,7 @@ begin
  m_attr[attrid].init :=1;
  m_attr[attrid].index:=attrid;
  m_attr[attrid].attr :=attr^;
+ m_attr[attrid].size :=get_buf_size(attr);
 
  Result:=0;
 end;
@@ -307,10 +320,10 @@ function TDisplayHandleSoft.RegisterBuffer(buf:p_register_buffer):Integer;
 var
  i,a:Integer;
 
- left :Pointer;
- right:Pointer;
- left_dmem :Pointer;
- right_dmem:Pointer;
+ orig:t_ptr_pair;
+ mirr:t_ptr_pair;
+
+ size:QWORD;
 begin
  i:=buf^.index;
  a:=buf^.attrid;
@@ -318,35 +331,24 @@ begin
  if (m_bufs[i].init<>0) then Exit(EINVAL);
  if (m_attr[a].init=0 ) then Exit(EINVAL);
 
- left :=buf^.left;
- right:=buf^.right;
+ orig.left :=buf^.left;
+ orig.right:=buf^.right;
 
- if (left=nil) then Exit(EINVAL);
+ if (orig.left=nil) then Exit(EINVAL);
 
- left_dmem :=nil;
- right_dmem:=nil;
+ size:=(m_attr[a].size+$FFF) and (not $FFF);
 
- //TODO: check size!
- if not get_dmem_ptr(left,@left_dmem,nil) then
- begin
-  Exit(EINVAL);
- end;
+ Assert((QWORD(orig.left)  and $FFF=0),'left');
+ Assert((QWORD(orig.right) and $FFF=0),'right');
 
- if (right<>nil) then
- begin
-  //TODO: check size!
-  if not get_dmem_ptr(right,@right_dmem,nil) then
-  begin
-   Exit(EINVAL);
-  end;
- end;
+ mirr.left :=mirror_map(orig.left ,size);
+ mirr.right:=mirror_map(orig.right,size);
 
- m_bufs[i].init :=1;
- m_bufs[i].attr :=a;
- m_bufs[i].left :=left;
- m_bufs[i].right:=right;
- m_bufs[i].left_dmem :=left_dmem;
- m_bufs[i].right_dmem:=right_dmem;
+ m_bufs[i].init:=1;
+ m_bufs[i].attr:=a;
+ m_bufs[i].orig:=orig;
+ m_bufs[i].mirr:=mirr;
+ m_bufs[i].size:=size;
 
  //
  labels       [buf^.index]:=0; //reset
@@ -360,12 +362,21 @@ begin
 end;
 
 function TDisplayHandleSoft.UnregisterBuffer(index:Integer):Integer;
+var
+ mirr:t_ptr_pair;
+ size:QWORD;
 begin
  if (m_bufs[index].init=0)  then Exit(EINVAL);
  if (Fflip_count[index]<>0) then Exit(EBUSY);
 
  m_bufs[index].init:=0;
 
+ mirr:=m_bufs[index].mirr;
+ size:=m_bufs[index].size;
+
+ mirror_unmap(mirr.left ,size);
+ mirror_unmap(mirr.right,size);
+
  Result:=0;
 end;
 
@@ -933,12 +944,12 @@ begin
   dst:=p_dst^;
 
   //detile32bppBuf_slow(attr,bi.bmiHeader.biWidth,buf^.left_dmem,dst);
-  detile32bppBuf_AVX(attr,bi.bmiHeader.biWidth,buf^.left_dmem,dst);
+  detile32bppBuf_AVX(attr,bi.bmiHeader.biWidth,buf^.mirr.left,dst);
  end else
  begin
   bi.bmiHeader.biWidth:=(bi.bmiHeader.biWidth+63) and (not 63);
 
-  dst:=buf^.left_dmem;
+  dst:=buf^.mirr.left;
  end;
 
  if (attr^.attr.pixelFormat=SCE_VIDEO_OUT_PIXEL_FORMAT_A8B8G8R8_SRGB) then
@@ -1228,6 +1239,7 @@ begin
   //
   mtx_lock(dce_mtx^);
    m_attr[i].attr:=m_sbat.attr;
+   m_attr[i].size:=get_buf_size(@m_sbat.attr);
   mtx_unlock(dce_mtx^);
   //
   m_sbat.init:=0;
diff --git a/sys/vm/vm_mmap.pas b/sys/vm/vm_mmap.pas
index a61ad054..4a50b906 100644
--- a/sys/vm/vm_mmap.pas
+++ b/sys/vm/vm_mmap.pas
@@ -50,7 +50,7 @@ function vm_mmap2(map        :vm_map_t;
                   foff       :vm_ooffset_t;
                   anon       :Pointer):Integer;
 
-function  mirror_map  (paddr,psize:QWORD):Pointer;
+function  mirror_map  (paddr:Pointer;psize:QWORD):Pointer;
 procedure mirror_unmap(base:Pointer;size:QWORD);
 
 implementation
@@ -1184,19 +1184,23 @@ begin
  Exit(ENOENT); //devkit_parameter(0)=0
 end;
 
-function mirror_map(paddr,psize:QWORD):Pointer;
+function mirror_map(paddr:Pointer;psize:QWORD):Pointer;
 var
  map:vm_map_t;
 begin
+ if (paddr=nil) or (psize=0) then Exit(nil);
+
  map:=p_proc.p_vmspace;
 
- Result:=pmap_mirror_map(map^.pmap,paddr,paddr+psize);
+ Result:=pmap_mirror_map(map^.pmap,QWORD(paddr),QWORD(paddr)+psize);
 end;
 
 procedure mirror_unmap(base:Pointer;size:QWORD);
 var
  map:vm_map_t;
 begin
+ if (base=nil) then Exit;
+
  map:=p_proc.p_vmspace;
 
  pmap_mirror_unmap(map^.pmap,base,size);
diff --git a/sys/vm/vm_nt_map.pas b/sys/vm/vm_nt_map.pas
index 78b64153..e8fc315c 100644
--- a/sys/vm/vm_nt_map.pas
+++ b/sys/vm/vm_nt_map.pas
@@ -1472,9 +1472,6 @@ begin
  if (not vm_nt_map_lookup_entry(map, start, @entry)) then
  begin
   entry:=entry^.next;
- end else
- begin
-  entry:=entry;
  end;
 
  prev:=0;
@@ -1492,8 +1489,8 @@ begin
 
    if (base<start) then
    begin
-    base:=start;
     offset:=offset+(start-base);
+    base:=start;
    end;
 
    if (b_end>__end) then