Delete all references to __com32.cs_bounce

The COM32 cs_bounce buffer is not usable with ELF modules, as we're
trying to move to an environment where memory is dynamically
allocated. All users of __com32.cs_bounce have been converted to using
lmalloc() to allocate low memory.

Signed-off-by: Matt Fleming <matt.fleming@intel.com>

14 files changed, 229 insertions, 88 deletions

diff --git a/com32/chain/utility.c b/com32/chain/utility.c
index fb59551b..b54e0cd2 100644
--- a/com32/chain/utility.c
+++ b/com32/chain/utility.c
@@ -94,24 +94,30 @@ void lba2chs(disk_chs *dst, const struct disk_info *di, uint64_t lba, uint32_t m
 uint32_t get_file_lba(const char *filename)
 {
     com32sys_t inregs;
-    uint32_t lba;
+    uint32_t lba = 0;
+    int size = 65536;
+    char *buf;
 
     /* Start with clean registers */
     memset(&inregs, 0, sizeof(com32sys_t));
 
+    buf = lmalloc(size);
+    if (!buf)
+	return 0;
+
     /* Put the filename in the bounce buffer */
-    strlcpy(__com32.cs_bounce, filename, __com32.cs_bounce_size);
+    strlcpy(buf, filename, size);
 
     /* Call comapi_open() which returns a structure pointer in SI
      * to a structure whose first member happens to be the LBA.
      */
     inregs.eax.w[0] = 0x0006;
-    inregs.esi.w[0] = OFFS(__com32.cs_bounce);
-    inregs.es = SEG(__com32.cs_bounce);
+    inregs.esi.w[0] = OFFS(buf);
+    inregs.es = SEG(buf);
     __com32.cs_intcall(0x22, &inregs, &inregs);
 
     if ((inregs.eflags.l & EFLAGS_CF) || inregs.esi.w[0] == 0) {
-	return 0;		/* Filename not found */
+	goto fail;		/* Filename not found */
     }
 
     /* Since the first member is the LBA, we simply cast */
@@ -121,14 +127,16 @@ uint32_t get_file_lba(const char *filename)
     memset(&inregs, 0, sizeof(com32sys_t));
 
     /* Put the filename in the bounce buffer */
-    strlcpy(__com32.cs_bounce, filename, __com32.cs_bounce_size);
+    strlcpy(buf, filename, size);
 
     /* Call comapi_close() to free the structure */
     inregs.eax.w[0] = 0x0008;
-    inregs.esi.w[0] = OFFS(__com32.cs_bounce);
-    inregs.es = SEG(__com32.cs_bounce);
+    inregs.esi.w[0] = OFFS(buf);
+    inregs.es = SEG(buf);
     __com32.cs_intcall(0x22, &inregs, &inregs);
 
+fail:
+    lfree(buf);
     return lba;
 }
 
diff --git a/com32/cmenu/libmenu/syslnx.c b/com32/cmenu/libmenu/syslnx.c
index 53e2401b..27823df8 100644
--- a/com32/cmenu/libmenu/syslnx.c
+++ b/com32/cmenu/libmenu/syslnx.c
@@ -28,10 +28,16 @@ char issyslinux(void)
 
 void runsyslinuxcmd(const char *cmd)
 {
-    strcpy(__com32.cs_bounce, cmd);
+    char *bounce;
+
+    bounce = lmalloc(strlen(cmd) + 1);
+    if (!bounce)
+	return;
+
+    strcpy(bounce, cmd);
     REG_AX(inreg) = 0x0003;	// Run command
-    REG_BX(inreg) = OFFS(__com32.cs_bounce);
-    REG_ES(inreg) = SEG(__com32.cs_bounce);
+    REG_BX(inreg) = OFFS(bounce);
+    REG_ES(inreg) = SEG(bounce);
     __intcall(0x22, &inreg, &outreg);
 }
 
@@ -62,6 +68,7 @@ void runsyslinuximage(const char *cmd, long ipappend)
 {
     unsigned int numfun = 0;
     char *ptr, *cmdline;
+    char *bounce;
 
     (void)ipappend;		// XXX: Unused?!
 
@@ -71,8 +78,12 @@ void runsyslinuximage(const char *cmd, long ipappend)
 	runsyslinuxcmd(cmd);
     // Try the Run Kernel Image function
     // Split command line into
-    strcpy(__com32.cs_bounce, cmd);
-    ptr = __com32.cs_bounce;
+    bounce = lmalloc(strlen(cmd) + 1);
+    if (!bounce)
+	return;
+
+    strcpy(bounce, cmd);
+    ptr = bounce;
     // serach for first space or end of string
     while ((*ptr) && (*ptr != ' '))
 	ptr++;
@@ -87,8 +98,8 @@ void runsyslinuximage(const char *cmd, long ipappend)
     // Now call the interrupt
     REG_BX(inreg) = OFFS(cmdline);
     REG_ES(inreg) = SEG(cmdline);
-    REG_SI(inreg) = OFFS(__com32.cs_bounce);
-    REG_DS(inreg) = SEG(__com32.cs_bounce);
+    REG_SI(inreg) = OFFS(bounce);
+    REG_DS(inreg) = SEG(bounce);
     REG_EDX(inreg) = 0;
 
     __intcall(0x22, &inreg, &outreg);	// If successful does not return
diff --git a/com32/gpllib/disk/geom.c b/com32/gpllib/disk/geom.c
index 9e673ed4..e1095200 100644
--- a/com32/gpllib/disk/geom.c
+++ b/com32/gpllib/disk/geom.c
@@ -120,7 +120,7 @@ static int detect_extensions(struct driveinfo *drive_info)
 static int get_drive_parameters_with_extensions(struct driveinfo *drive_info)
 {
     com32sys_t inreg, outreg;
-    struct edd_device_parameters *dp = __com32.cs_bounce;
+    struct edd_device_parameters *dp;
 
     memset(&inreg, 0, sizeof inreg);
 
@@ -134,6 +134,10 @@ static int get_drive_parameters_with_extensions(struct driveinfo *drive_info)
      * If the buffer length is less than 26 on entry an error shall be
      * returned.
      */
+    dp = lmalloc(sizeof *dp);
+    if (!dp)
+	return -1;
+
     dp->len = sizeof(struct edd_device_parameters);
 
     inreg.esi.w[0] = OFFS(dp);
@@ -144,10 +148,13 @@ static int get_drive_parameters_with_extensions(struct driveinfo *drive_info)
     __intcall(0x13, &inreg, &outreg);
 
     /* CF set on error */
-    if (outreg.eflags.l & EFLAGS_CF)
+    if (outreg.eflags.l & EFLAGS_CF) {
+	lfree(dp);
 	return outreg.eax.b[1];
+    }
 
     memcpy(&drive_info->edd_params, dp, sizeof drive_info->edd_params);
+    lfree(dp);
 
     return 0;
 }
diff --git a/com32/gpllib/disk/read.c b/com32/gpllib/disk/read.c
index 7a6cc430..541957f9 100644
--- a/com32/gpllib/disk/read.c
+++ b/com32/gpllib/disk/read.c
@@ -76,13 +76,22 @@ int read_sectors(struct driveinfo *drive_info, void *data,
 		 const unsigned int lba, const int sectors)
 {
     com32sys_t inreg, outreg;
-    struct ebios_dapa *dapa = __com32.cs_bounce;
-    void *buf = (char *)__com32.cs_bounce + sectors * SECTOR;
+    struct ebios_dapa *dapa;
+    void *buf;
     char *bufp = data;
+    int rv = -1;
 
     if (get_drive_parameters(drive_info) == -1)
 	return -1;
 
+    buf = lmalloc(sectors * SECTOR);
+    if (!buf)
+	return -1;
+
+    dapa = lmalloc(sizeof(*dapa));
+    if (!dapa)
+	goto fail;
+
     memset(&inreg, 0, sizeof inreg);
 
     if (drive_info->ebios) {
@@ -102,7 +111,7 @@ int read_sectors(struct driveinfo *drive_info, void *data,
 	if (!drive_info->cbios) {	// XXX errno
 	    /* We failed to get the geometry */
 	    if (lba)
-		return -1;	/* Can only read MBR */
+		goto fail;	/* Can only read MBR */
 
 	    s = 1;
 	    h = 0;
@@ -112,7 +121,7 @@ int read_sectors(struct driveinfo *drive_info, void *data,
 
 	// XXX errno
 	if (s > 63 || h > 256 || c > 1023)
-	    return -1;
+	    goto fail;
 
 	inreg.eax.w[0] = 0x0201;	/* Read one sector */
 	inreg.ecx.b[1] = c & 0xff;
@@ -126,10 +135,14 @@ int read_sectors(struct driveinfo *drive_info, void *data,
     /* Perform the read */
     if (int13_retry(&inreg, &outreg)) {
 	errno_disk = outreg.eax.b[1];
-	return -1;		/* Give up */
+	goto fail;		/* Give up */
     }
 
     memcpy(bufp, buf, sectors * SECTOR);
+    rv = sectors;
 
-    return sectors;
+fail:
+    lfree(dapa);
+    lfree(buf);
+    return rv;
 }
diff --git a/com32/gpllib/disk/write.c b/com32/gpllib/disk/write.c
index 89e530d9..d183adef 100644
--- a/com32/gpllib/disk/write.c
+++ b/com32/gpllib/disk/write.c
@@ -36,8 +36,17 @@ int write_sectors(const struct driveinfo *drive_info, const unsigned int lba,
 		  const void *data, const int size)
 {
     com32sys_t inreg, outreg;
-    struct ebios_dapa *dapa = __com32.cs_bounce;
-    void *buf = (char *)__com32.cs_bounce + size;
+    struct ebios_dapa *dapa;
+    void *buf;
+    int rv = -1;
+
+    buf = lmalloc(size);
+    if (!buf)
+	return -1;
+
+    dapa = lmalloc(sizeof(*dapa));
+    if (!dapa)
+	goto out;
 
     memcpy(buf, data, size);
     memset(&inreg, 0, sizeof inreg);
@@ -59,7 +68,7 @@ int write_sectors(const struct driveinfo *drive_info, const unsigned int lba,
 	if (!drive_info->cbios) {	// XXX errno
 	    /* We failed to get the geometry */
 	    if (lba)
-		return -1;	/* Can only write MBR */
+		goto out;	/* Can only write MBR */
 
 	    s = 1;
 	    h = 0;
@@ -69,7 +78,7 @@ int write_sectors(const struct driveinfo *drive_info, const unsigned int lba,
 
 	// XXX errno
 	if (s > 63 || h > 256 || c > 1023)
-	    return -1;
+	    goto out;
 
 	inreg.eax.w[0] = 0x0301;	/* Write one sector */
 	inreg.ecx.b[1] = c & 0xff;
@@ -82,10 +91,13 @@ int write_sectors(const struct driveinfo *drive_info, const unsigned int lba,
 
     /* Perform the write */
     if (int13_retry(&inreg, &outreg)) {
-	errno_disk = outreg.eax.b[1];
-	return -1;		/* Give up */
+	errno_disk = outreg.eax.b[1];	/* Give up */
     } else
-	return size;
+	rv = size;
+out:
+    lfree(dapa);
+    lfree(buf);
+    return rv;
 }
 
 /**
diff --git a/com32/gpllib/memory.c b/com32/gpllib/memory.c
index 28a95ff4..06c746da 100644
--- a/com32/gpllib/memory.c
+++ b/com32/gpllib/memory.c
@@ -87,15 +87,20 @@ void detect_memory_e820(struct e820entry *desc, int size_map, int *size_found)
 {
     int count = 0;
     static struct e820_ext_entry buf;	/* static so it is zeroed */
+    void *bounce;
 
     com32sys_t ireg, oreg;
     memset(&ireg, 0, sizeof ireg);
 
+    bounce = lmalloc(sizeof buf);
+    if (!bounce)
+	goto out;
+
     ireg.eax.w[0] = 0xe820;
     ireg.edx.l = SMAP;
     ireg.ecx.l = sizeof(struct e820_ext_entry);
-    ireg.edi.w[0] = OFFS(__com32.cs_bounce);
-    ireg.es = SEG(__com32.cs_bounce);
+    ireg.edi.w[0] = OFFS(bounce);
+    ireg.es = SEG(bounce);
 
     /*
      * Set this here so that if the BIOS doesn't change this field
@@ -105,7 +110,7 @@ void detect_memory_e820(struct e820entry *desc, int size_map, int *size_found)
     buf.ext_flags = 1;
 
     do {
-	memcpy(__com32.cs_bounce, &buf, sizeof buf);
+	memcpy(bounce, &buf, sizeof buf);
 
 	/* Important: %edx and %esi are clobbered by some BIOSes,
 	   so they must be either used for the error output
@@ -126,7 +131,7 @@ void detect_memory_e820(struct e820entry *desc, int size_map, int *size_found)
 	if (oreg.eflags.l & EFLAGS_CF || oreg.ecx.l < 20)
 	    break;
 
-	memcpy(&buf, __com32.cs_bounce, sizeof buf);
+	memcpy(&buf, bounce, sizeof buf);
 
 	/*
 	 * ACPI 3.0 added the extended flags support.  If bit 0
@@ -143,6 +148,8 @@ void detect_memory_e820(struct e820entry *desc, int size_map, int *size_found)
 	ireg.ebx.l = oreg.ebx.l;
     } while (ireg.ebx.l && count < size_map);
 
+out:
+    lfree(bounce);
     *size_found = count;
 }
 
diff --git a/com32/hdt/hdt-common.c b/com32/hdt/hdt-common.c
index 8e9a9e64..f729a107 100644
--- a/com32/hdt/hdt-common.c
+++ b/com32/hdt/hdt-common.c
@@ -312,6 +312,7 @@ int detect_vesa(struct s_hardware *hardware)
     struct vesa_mode_info *mi;
     uint16_t mode, *mode_ptr;
     char *oem_ptr;
+    int rv = -1;
 
     if (hardware->vesa_detection == true)
 	return -1;
@@ -319,9 +320,13 @@ int detect_vesa(struct s_hardware *hardware)
     hardware->vesa_detection = true;
     hardware->is_vesa_valid = false;
 
-    /* Allocate space in the bounce buffer for these structures */
-    gi = &((struct vesa_info *)__com32.cs_bounce)->gi;
-    mi = &((struct vesa_info *)__com32.cs_bounce)->mi;
+    gi = lmalloc(sizeof(*gi));
+    if (!gi)
+	return -1;
+
+    mi = lmalloc(sizeof(*mi));
+    if (!mi)
+	goto out;
 
     gi->signature = VBE2_MAGIC;	/* Get VBE2 extended data */
     rm.eax.w[0] = 0x4F00;	/* Get SVGA general information */
@@ -330,7 +335,7 @@ int detect_vesa(struct s_hardware *hardware)
     __intcall(0x10, &rm, &rm);
 
     if (rm.eax.w[0] != 0x004F) {
-	return -1;
+	goto out;
     };
 
     mode_ptr = GET_PTR(gi->video_mode_ptr);
@@ -369,7 +374,12 @@ int detect_vesa(struct s_hardware *hardware)
 	hardware->vesa.vmi_count++;
     }
     hardware->is_vesa_valid = true;
-    return 0;
+
+    rv = 0;
+out:
+    lfree(mi);
+    lfree(gi);
+    return rv;
 }
 
 /* Try to detect disks from port 0x80 to 0xff */
diff --git a/com32/lib/syslinux/disk.c b/com32/lib/syslinux/disk.c
index d6409af6..093751ac 100644
--- a/com32/lib/syslinux/disk.c
+++ b/com32/lib/syslinux/disk.c
@@ -73,7 +73,8 @@ int disk_int13_retry(const com32sys_t * inreg, com32sys_t * outreg)
 int disk_get_params(int disk, struct disk_info *const diskinfo)
 {
     static com32sys_t inreg, outreg;
-    struct disk_ebios_eparam *eparam = __com32.cs_bounce;
+    struct disk_ebios_eparam *eparam;
+    int rv = 0;
 
     memset(diskinfo, 0, sizeof *diskinfo);
     diskinfo->disk = disk;
@@ -93,6 +94,10 @@ int disk_get_params(int disk, struct disk_info *const diskinfo)
 	diskinfo->ebios = 1;
     }
 
+    eparam = lmalloc(sizeof *eparam);
+    if (!eparam)
+	return -1;
+
     /* Get extended disk parameters if ebios == 1 */
     if (diskinfo->ebios) {
 	memset(&inreg, 0, sizeof inreg);
@@ -127,8 +132,10 @@ int disk_get_params(int disk, struct disk_info *const diskinfo)
 
     __intcall(0x13, &inreg, &outreg);
 
-    if (outreg.eflags.l & EFLAGS_CF)
-	return diskinfo->ebios ? 0 : -1;
+    if (outreg.eflags.l & EFLAGS_CF) {
+	rv = diskinfo->ebios ? 0 : -1;
+	goto out;
+    }
 
     diskinfo->spt = 0x3f & outreg.ecx.b[0];
     diskinfo->head = 1 + outreg.edx.b[1];
@@ -145,7 +152,9 @@ int disk_get_params(int disk, struct disk_info *const diskinfo)
     if (!diskinfo->lbacnt)
 	diskinfo->lbacnt = diskinfo->cyl * diskinfo->head * diskinfo->spt;
 
-    return 0;
+out:
+    lfree(eparam);
+    return rv;
 }
 
 /**
@@ -163,17 +172,26 @@ void *disk_read_sectors(const struct disk_info *const diskinfo, uint64_t lba,
 			uint8_t count)
 {
     com32sys_t inreg;
-    struct disk_ebios_dapa *dapa = __com32.cs_bounce;
-    void *buf = (char *)__com32.cs_bounce + diskinfo->bps;
-    void *data;
+    struct disk_ebios_dapa *dapa;
+    void *buf;
+    void *data = NULL;
     uint32_t maxcnt;
+    uint32_t size = 65536;
 
-    maxcnt = (__com32.cs_bounce_size - diskinfo->bps) / diskinfo->bps;
+    maxcnt = (size - diskinfo->bps) / diskinfo->bps;
     if (!count || count > maxcnt || lba + count > diskinfo->lbacnt)
 	return NULL;
 
     memset(&inreg, 0, sizeof inreg);
 
+    buf = lmalloc(count * diskinfo->bps);
+    if (!buf)
+	return NULL;
+
+    dapa = lmalloc(sizeof(*dapa));
+    if (!dapa)
+	goto out;
+
     if (diskinfo->ebios) {
 	dapa->len = sizeof(*dapa);
 	dapa->count = count;
@@ -209,11 +227,14 @@ void *disk_read_sectors(const struct disk_info *const diskinfo, uint64_t lba,
     }
 
     if (disk_int13_retry(&inreg, NULL))
-	return NULL;
+	goto out;
 
     data = malloc(count * diskinfo->bps);
     if (data)
 	memcpy(data, buf, count * diskinfo->bps);
+out:
+    lfree(dapa);
+    lfree(buf);
     return data;
 }
 
@@ -233,17 +254,27 @@ int disk_write_sectors(const struct disk_info *const diskinfo, uint64_t lba,
 		       const void *data, uint8_t count)
 {
     com32sys_t inreg;
-    struct disk_ebios_dapa *dapa = __com32.cs_bounce;
-    void *buf = (char *)__com32.cs_bounce + diskinfo->bps;
+    struct disk_ebios_dapa *dapa;
+    void *buf;
     uint32_t maxcnt;
+    uint32_t size = 65536;
+    int rv = -1;
 
-    maxcnt = (__com32.cs_bounce_size - diskinfo->bps) / diskinfo->bps;
+    maxcnt = (size - diskinfo->bps) / diskinfo->bps;
     if (!count || count > maxcnt || lba + count > diskinfo->lbacnt)
 	return -1;
 
+    buf = lmalloc(count * diskinfo->bps);
+    if (!buf)
+	return -1;
+
     memcpy(buf, data, count * diskinfo->bps);
     memset(&inreg, 0, sizeof inreg);
 
+    dapa = lmalloc(sizeof(*dapa));
+    if (!dapa)
+	goto out;
+
     if (diskinfo->ebios) {
 	dapa->len = sizeof(*dapa);
 	dapa->count = count;
@@ -279,9 +310,13 @@ int disk_write_sectors(const struct disk_info *const diskinfo, uint64_t lba,
     }
 
     if (disk_int13_retry(&inreg, NULL))
-	return -1;
+	goto out;
 
-    return 0;			/* ok */
+    rv = 0;			/* ok */
+out:
+    lfree(dapa);
+    lfree(buf);
+    return rv;
 }
 
 /**
diff --git a/com32/lua/src/vesa.c b/com32/lua/src/vesa.c
index 9f281348..06649e11 100644
--- a/com32/lua/src/vesa.c
+++ b/com32/lua/src/vesa.c
@@ -17,10 +17,15 @@ static int vesa_getmodes(lua_State *L)
   struct vesa_general_info *gi;
   struct vesa_mode_info *mi;
   int nmode = 1;
+  int rv = -1;
 
-  /* Allocate space in the bounce buffer for these structures */
-  gi = &((struct vesa_info *)__com32.cs_bounce)->gi;
-  mi = &((struct vesa_info *)__com32.cs_bounce)->mi;
+  gi = lmalloc(sizeof *gi);
+  if (!gi)
+      return -1;
+
+  mi = lmalloc(sizeof *mi);
+  if (!mi)
+      goto out;
 
   memset(&rm, 0, sizeof rm);
   memset(gi, 0, sizeof *gi);
@@ -32,11 +37,15 @@ static int vesa_getmodes(lua_State *L)
   __intcall(0x10, &rm, &rm);
 
   if ( rm.eax.w[0] != 0x004F )
-    return -1;                   /* Function call failed */
-  if ( gi->signature != VESA_MAGIC )
-    return -2;                   /* No magic */
-  if ( gi->version < 0x0102 )
-    return -3;                   /* VESA 1.2+ required */
+    goto out;                   /* Function call failed */
+  if ( gi->signature != VESA_MAGIC ) {
+    rv = -2;                   /* No magic */
+    goto out;
+  }
+  if ( gi->version < 0x0102 ) {
+    rv = -3;                   /* VESA 1.2+ required */
+    goto out;
+  }
 
   lua_newtable(L);      /* list of modes */
 
@@ -86,7 +95,11 @@ static int vesa_getmodes(lua_State *L)
 
   }
 
-  return 1;
+  rv = 1;
+out:
+  lfree(mi);
+  lfree(gi);
+  return rv;
 }
 
 
diff --git a/com32/mboot/initvesa.c b/com32/mboot/initvesa.c
index bb3a8467..bd869e3d 100644
--- a/com32/mboot/initvesa.c
+++ b/com32/mboot/initvesa.c
@@ -62,9 +62,13 @@ void set_graphics_mode(const struct multiboot_header *mbh,
     if (!(mbh->flags & MULTIBOOT_VIDEO_MODE) || mbh->mode_type != 0)
 	return;
 
-    /* Allocate space in the bounce buffer for these structures */
-    gi = &((struct vesa_info *)__com32.cs_bounce)->gi;
-    mi = &((struct vesa_info *)__com32.cs_bounce)->mi;
+    gi = lmalloc(sizeof *gi);
+    if (!gi)
+	return;
+
+    mi = lmalloc(sizeof *mi);
+    if (!mi)
+	goto out;
 
     memset(&rm, 0, sizeof rm);
     memset(gi, 0, sizeof *gi);
@@ -76,11 +80,11 @@ void set_graphics_mode(const struct multiboot_header *mbh,
     __intcall(0x10, &rm, &rm);
 
     if (rm.eax.w[0] != 0x004F)
-	return;			/* Function call failed */
+	goto out;		/* Function call failed */
     if (gi->signature != VESA_MAGIC)
-	return;			/* No magic */
+	goto out;		/* No magic */
     if (gi->version < 0x0102)
-	return;			/* VESA 1.2+ required */
+	goto out;		/* VESA 1.2+ required */
 
     memcpy(&vesa_info.gi, gi, sizeof *gi);
 
@@ -183,7 +187,7 @@ void set_graphics_mode(const struct multiboot_header *mbh,
     }
 
     if (!bestpxf)
-	return;			/* No mode found */
+	goto out;		/* No mode found */
 
     mi = &vesa_info.mi;
     mode = bestmode;
@@ -194,7 +198,7 @@ void set_graphics_mode(const struct multiboot_header *mbh,
     rm.ebx.w[0] = mode;
     __intcall(0x10, &rm, &rm);
     if (rm.eax.w[0] != 0x004F)
-	return;			/* Failed to set mode */
+	goto out;		/* Failed to set mode */
 
     mbi->flags |= MB_INFO_VIDEO_INFO;
     mbi->vbe_mode = mode;
@@ -220,4 +224,8 @@ void set_graphics_mode(const struct multiboot_header *mbh,
      * output in VESA modes actually do that...
      */
     graphics_using_vga(0x0F, vesa_info.mi.h_res, vesa_info.mi.v_res);
+
+out:
+    lfree(mi);
+    lfree(gi);
 }
diff --git a/com32/mboot/mem.c b/com32/mboot/mem.c
index 6a31fac0..6e3995bf 100644
--- a/com32/mboot/mem.c
+++ b/com32/mboot/mem.c
@@ -49,9 +49,10 @@ struct e820_entry {
 static int mboot_scan_memory(struct AddrRangeDesc **ardp, uint32_t * dosmem)
 {
     com32sys_t ireg, oreg;
-    struct e820_entry *e820buf = __com32.cs_bounce;
+    struct e820_entry *e820buf;
     struct AddrRangeDesc *ard;
     size_t ard_count, ard_space;
+    int rv = 0;
 
     /* Use INT 12h to get DOS memory */
     __intcall(0x12, &__com32_zero_regs, &oreg);
@@ -65,10 +66,14 @@ static int mboot_scan_memory(struct AddrRangeDesc **ardp, uint32_t * dosmem)
 	    *dosmem = 640 * 1024;	/* Hope for the best... */
     }
 
+    e820buf = lmalloc(sizeof(*e820buf));
+    if (!e820buf)
+	return 0;
+
     /* Allocate initial space */
     *ardp = ard = malloc(RANGE_ALLOC_BLOCK * sizeof *ard);
     if (!ard)
-	return 0;
+	goto out;
 
     ard_count = 0;
     ard_space = RANGE_ALLOC_BLOCK;
@@ -93,8 +98,10 @@ static int mboot_scan_memory(struct AddrRangeDesc **ardp, uint32_t * dosmem)
 	if (ard_count >= ard_space) {
 	    ard_space += RANGE_ALLOC_BLOCK;
 	    *ardp = ard = realloc(ard, ard_space * sizeof *ard);
-	    if (!ard)
-		return ard_count;
+	    if (!ard) {
+		rv = ard_count;
+		goto out;
+	    }
 	}
 
 	ard[ard_count].size = 20;
@@ -106,8 +113,10 @@ static int mboot_scan_memory(struct AddrRangeDesc **ardp, uint32_t * dosmem)
 	ireg.ebx.l = oreg.ebx.l;
     } while (oreg.ebx.l);
 
-    if (ard_count)
-	return ard_count;
+    if (ard_count) {
+	rv = ard_count;
+	goto out;
+    };
 
     ard[0].size = 20;
     ard[0].BaseAddr = 0;
@@ -129,10 +138,12 @@ static int mboot_scan_memory(struct AddrRangeDesc **ardp, uint32_t * dosmem)
 	    ard[2].BaseAddr = 16 << 20;
 	    ard[2].Length = oreg.edx.w[0] << 16;
 	    ard[2].Type = 1;
-	    return 3;
+	    rv = 3;
 	} else {
-	    return 2;
+	    rv = 2;
 	}
+
+	goto out;
     }
 
     /* Finally try INT 15h AH=88h */
@@ -142,10 +153,14 @@ static int mboot_scan_memory(struct AddrRangeDesc **ardp, uint32_t * dosmem)
 	ard[1].BaseAddr = 1 << 20;
 	ard[1].Length = oreg.ecx.w[0] << 10;
 	ard[1].Type = 1;
-	return 2;
+	rv = 2;
+	goto out;
     }
 
-    return 1;			/* ... problematic ... */
+    rv = 1;			/* ... problematic ... */
+out:
+    lfree(e820buf);
+    return rv;
 }
 
 void mboot_make_memmap(void)
diff --git a/com32/modules/gpxecmd.c b/com32/modules/gpxecmd.c
index fe414b9a..9d4f4561 100644
--- a/com32/modules/gpxecmd.c
+++ b/com32/modules/gpxecmd.c
@@ -43,7 +43,10 @@ static void gpxecmd(const char **args)
 
     memset(&reg, 0, sizeof reg);
 
-    fx = __com32.cs_bounce;
+    fx = lmalloc(sizeof *fx);
+    if (!fx)
+	return;
+
     q = (char *)(fx + 1);
 
     fx->Status = 1;
diff --git a/com32/modules/pxechn.c b/com32/modules/pxechn.c
index 3f9ebd32..1902d4ef 100644
--- a/com32/modules/pxechn.c
+++ b/com32/modules/pxechn.c
@@ -1031,10 +1031,7 @@ int pxe_restart(char *ifn)
     }
     printf("  Attempting to boot '%s'...\n\n", pxe.fn);
     memset(&reg, 0, sizeof reg);
-    if (sizeof(t_PXENV_TFTP_READ_FILE) <= __com32.cs_bounce_size) {
-	pxep = __com32.cs_bounce;
-	memset(pxep, 0, sizeof(t_PXENV_RESTART_TFTP));
-    } else if (!(pxep = lzalloc(sizeof(t_PXENV_RESTART_TFTP)))){
+    if (!(pxep = lzalloc(sizeof(t_PXENV_RESTART_TFTP)))){
 	dprintf("Unable to lzalloc() for PXE call structure\n");
 	goto ret;
     }
@@ -1055,8 +1052,7 @@ int pxe_restart(char *ifn)
     __intcall(0x22, &reg, &reg);
 
     printf("PXENV_RESTART_TFTP returned %d\n", pxep->Status);
-    if (pxep != __com32.cs_bounce)
-	lfree(pxep);
+    lfree(pxep);
 
 ret:
     return rv;
diff --git a/com32/modules/sanboot.c b/com32/modules/sanboot.c
index a2fbbd6a..d55fbc08 100644
--- a/com32/modules/sanboot.c
+++ b/com32/modules/sanboot.c
@@ -43,7 +43,10 @@ static void sanboot(const char **args)
 
     memset(&reg, 0, sizeof reg);
 
-    fx = __com32.cs_bounce;
+    fx = lmalloc(sizeof *fx);
+    if (!fx)
+	return;
+
     q = (char *)(fx + 1);
 
     fx->Status = 1;