diff --git a/tasks/fs0/src/syscalls.c b/tasks/fs0/src/syscalls.c
index f3e8069..185dc6e 100644
--- a/tasks/fs0/src/syscalls.c
+++ b/tasks/fs0/src/syscalls.c
@@ -257,6 +257,13 @@ int sys_readdir(l4id_t sender, int fd, void *buf, int count)
 	/* Get the task */
 	BUG_ON(!(t = find_task(sender)));
 
+	/* Check address is in task's utcb */
+	if ((unsigned long)buf < t->utcb_address ||
+	    (unsigned long)buf > t->utcb_address + PAGE_SIZE) {
+		l4_ipc_return(-EINVAL);
+		return 0;
+	}
+
 	/* Convert fd to vnum. */
 	BUG_ON((vnum = t->fd[fd]) < 0);
 
diff --git a/tasks/fs0/src/task.c b/tasks/fs0/src/task.c
index 12746be..026fad3 100644
--- a/tasks/fs0/src/task.c
+++ b/tasks/fs0/src/task.c
@@ -141,8 +141,8 @@ int task_utcb_attach(struct tcb *t)
 	if ((unsigned long)shmaddr != t->utcb_address)
 		return -EINVAL;
 
-	//printf("%s: Mapped utcb of task %d @ 0x%x\n",
-	//       __TASKNAME__, t->tid, shmaddr);
+	printf("%s: Mapped utcb of task %d @ 0x%x\n",
+	       __TASKNAME__, t->tid, shmaddr);
 
 	return 0;
 
diff --git a/tasks/libl4/include/l4lib/arch-arm/utcb.h b/tasks/libl4/include/l4lib/arch-arm/utcb.h
index 9f76700..91ecc27 100644
--- a/tasks/libl4/include/l4lib/arch-arm/utcb.h
+++ b/tasks/libl4/include/l4lib/arch-arm/utcb.h
@@ -9,6 +9,9 @@
 #include <l4lib/types.h>
 #include <l4/macros.h>
 #include INC_GLUE(message.h)
+#include INC_GLUE(memory.h)
+#include <string.h>
+#include <stdio.h>
 
 /*
  * NOTE: In syslib.h the first few mrs are used by data frequently
@@ -43,6 +46,25 @@ static inline void write_mr(unsigned int offset, unsigned int val)
 {
 	l4_get_utcb()->mr[offset] = val;
 }
+
+/*
+ * Arguments that are too large to fit in message registers are
+ * copied onto another area that is still on the utcb, and the servers
+ * map-in the task utcb and read those arguments from there.
+ */
+
+static inline void copy_to_utcb(void *arg, int offset, int size)
+{
+	BUG_ON(size > PAGE_SIZE);
+	memcpy(utcb_page, arg, size);
+}
+
+static inline void copy_from_utcb(void *buf, int offset, int size)
+{
+	BUG_ON(size > PAGE_SIZE);
+	memcpy(buf, utcb_page + offset, size);
+}
+
 #endif /* !__ASSEMBLY__ */
 
 #endif /* __ARM_UTCB_H__ */
diff --git a/tasks/libl4/src/init.c b/tasks/libl4/src/init.c
index e389ba5..8588b28 100644
--- a/tasks/libl4/src/init.c
+++ b/tasks/libl4/src/init.c
@@ -90,8 +90,8 @@ int utcb_init(void)
 
 		/* Obtain our utcb page address */
 		utcb_page = l4_utcb_page();
-		//printf("%s: UTCB Read from mm0 as: 0x%x\n", __FUNCTION__,
-		//       (unsigned long)utcb_page);
+		printf("%s: UTCB Read from mm0 as: 0x%x\n", __FUNCTION__,
+		       (unsigned long)utcb_page);
 
 		/* Use it as a key to create a shared memory region */
 		BUG_ON((shmid = shmget((key_t)utcb_page,
diff --git a/tasks/libposix/open.c b/tasks/libposix/open.c
index 77ece01..7c8829d 100644
--- a/tasks/libposix/open.c
+++ b/tasks/libposix/open.c
@@ -18,23 +18,12 @@
 #include <l4/macros.h>
 #include INC_GLUE(memory.h)
 
-/*
- * Arguments that are too large to fit in message registers are
- * copied onto another area that is still on the utcb, and the servers
- * map-in the task utcb and read those arguments from there.
- */
-void *copy_to_utcb(void *arg, int size)
-{
-	BUG_ON(size > PAGE_SIZE);
-	memcpy(utcb_page, arg, size);
-}
-
 static inline int l4_open(const char *pathname, int flags, mode_t mode)
 {
 	int fd;
 
 	// write_mr(L4SYS_ARG0, (unsigned long)pathname);
-	copy_to_utcb((void *)pathname, strlen(pathname));
+	copy_to_utcb((void *)pathname, 0, strlen(pathname));
 	write_mr(L4SYS_ARG0, (unsigned long)utcb_page);
 	write_mr(L4SYS_ARG1, flags);
 	write_mr(L4SYS_ARG2, (u32)mode);
diff --git a/tasks/libposix/read.c b/tasks/libposix/read.c
index 5abcef2..aaff02b 100644
--- a/tasks/libposix/read.c
+++ b/tasks/libposix/read.c
@@ -5,19 +5,23 @@
  */
 #include <errno.h>
 #include <stdio.h>
+#include <string.h>
 #include <sys/types.h>
 #include <unistd.h>
 #include <l4lib/arch/syscalls.h>
 #include <l4lib/arch/syslib.h>
 #include <l4lib/ipcdefs.h>
 #include <l4lib/os/posix/readdir.h>
+#include <l4/macros.h>
+#include INC_GLUE(memory.h)
+
 
 static inline int l4_readdir(int fd, void *buf, size_t count)
 {
 	size_t cnt;
 
 	write_mr(L4SYS_ARG0, fd);
-	write_mr(L4SYS_ARG1, (unsigned long)buf);
+	write_mr(L4SYS_ARG1, (unsigned long)utcb_page);
 	write_mr(L4SYS_ARG2, count);
 
 	/* Call pager with readdir() request. Check ipc error. */
@@ -31,6 +35,8 @@ static inline int l4_readdir(int fd, void *buf, size_t count)
 		return cnt;
 
 	}
+
+	copy_from_utcb(buf, 0, cnt);
 	return cnt;
 }
 
diff --git a/tasks/mm0/include/vm_area.h b/tasks/mm0/include/vm_area.h
index 5294f04..01f84aa 100644
--- a/tasks/mm0/include/vm_area.h
+++ b/tasks/mm0/include/vm_area.h
@@ -14,7 +14,7 @@
 #include <arch/mm.h>
 #include <lib/spinlock.h>
 
-// #define DEBUG_FAULT_HANDLING
+#define DEBUG_FAULT_HANDLING
 #ifdef DEBUG_FAULT_HANDLING
 #define dprintf(...)	printf(__VA_ARGS__)
 #else
diff --git a/tasks/mm0/src/shm.c b/tasks/mm0/src/shm.c
index bbddac9..1c6873c 100644
--- a/tasks/mm0/src/shm.c
+++ b/tasks/mm0/src/shm.c
@@ -9,7 +9,6 @@
 #include <mmap.h>
 #include <utcb.h>
 #include <vm_area.h>
-#include <l4/lib/string.h>
 #include <kmalloc/kmalloc.h>
 #include <l4lib/arch/syscalls.h>
 #include <l4lib/arch/syslib.h>
diff --git a/tasks/test0/include/tests.h b/tasks/test0/include/tests.h
index 8b83587..1801837 100644
--- a/tasks/test0/include/tests.h
+++ b/tasks/test0/include/tests.h
@@ -1,6 +1,8 @@
 #ifndef __TEST0_TESTS_H__
 #define __TEST0_TESTS_H__
 
+#define __TASKNAME__			"test0"
+
 int shmtest(void);
 int mmaptest(void);
 int dirtest(void);
diff --git a/tasks/test0/main.c b/tasks/test0/main.c
index c21f746..5dd4772 100644
--- a/tasks/test0/main.c
+++ b/tasks/test0/main.c
@@ -11,7 +11,6 @@
 #include <l4lib/ipcdefs.h>
 #include <tests.h>
 
-#define __TASKNAME__			"test0"
 
 void wait_pager(l4id_t partner)
 {
diff --git a/tasks/test0/src/dirtest.c b/tasks/test0/src/dirtest.c
index af2dce7..71746be 100644
--- a/tasks/test0/src/dirtest.c
+++ b/tasks/test0/src/dirtest.c
@@ -12,6 +12,7 @@
 #include <sys/syscall.h>
 #include <sys/stat.h>
 #include <l4lib/os/posix/readdir.h>
+#include <tests.h>
 
 #define DENTS_TOTAL	50
 
@@ -116,7 +117,7 @@ int lsdir(char *path)
 		printf("OPEN OK.\n");
 
 	if ((bytes = os_readdir(fd, dents, sizeof(struct dirent) * DENTS_TOTAL)) < 0) {
-		perror("GETDENTS");
+		printf("%s: GETDENTS failed.\n", __TASKNAME__);
 		return 0;
 	} else {
 		printf("GETDENTS OK.\n");