diff --git a/reactos/drivers/ksfilter/ks/api.c b/reactos/drivers/ksfilter/ks/api.c
index bace9efaec7..059d7a223bf 100644
--- a/reactos/drivers/ksfilter/ks/api.c
+++ b/reactos/drivers/ksfilter/ks/api.c
@@ -1155,10 +1155,19 @@ KsSynchronousIoControlDevice(
     }
 
 
-    /* HACK */
+    /* Store Fileobject */
     IoStack = IoGetNextIrpStackLocation(Irp);
     IoStack->FileObject = FileObject;
 
+    if (IoControl == IOCTL_KS_WRITE_STREAM)
+    {
+        Irp->AssociatedIrp.SystemBuffer = OutBuffer;
+    }
+    else if (IoControl == IOCTL_KS_READ_STREAM)
+    {
+        Irp->AssociatedIrp.SystemBuffer = InBuffer;
+    }
+
     IoSetCompletionRoutine(Irp, KspSynchronousIoControlDeviceCompletion, (PVOID)&IoStatusBlock, TRUE, TRUE, TRUE);
 
     Status = IoCallDriver(DeviceObject, Irp);
diff --git a/reactos/drivers/ksfilter/ks/irp.c b/reactos/drivers/ksfilter/ks/irp.c
index a4dd1620490..95ecb96f5e9 100644
--- a/reactos/drivers/ksfilter/ks/irp.c
+++ b/reactos/drivers/ksfilter/ks/irp.c
@@ -1855,6 +1855,8 @@ KspDispatchIrp(
     /* get device header */
     DeviceHeader = DeviceExtension->DeviceHeader;
 
+    ASSERT(IoStack->FileObject);
+
     /* get object header */
     ObjectHeader = (PKSIOBJECT_HEADER) IoStack->FileObject->FsContext;
 
diff --git a/reactos/drivers/wdm/audio/backpln/portcls/irpstream.c b/reactos/drivers/wdm/audio/backpln/portcls/irpstream.c
index 54d200f0eee..4f15fb2cdab 100644
--- a/reactos/drivers/wdm/audio/backpln/portcls/irpstream.c
+++ b/reactos/drivers/wdm/audio/backpln/portcls/irpstream.c
@@ -118,24 +118,44 @@ IIrpQueue_fnAddMapping(
     IN PIRP Irp)
 {
     PKSSTREAM_HEADER Header;
-    //PIO_STACK_LOCATION IoStack;
+    NTSTATUS Status = STATUS_SUCCESS;
+    PIO_STACK_LOCATION IoStack;
     IIrpQueueImpl * This = (IIrpQueueImpl*)iface;
 
-#if 0
     /* get current irp stack location */
     IoStack = IoGetCurrentIrpStackLocation(Irp);
 
-    ASSERT(IoStack->Parameters.DeviceIoControl.InputBufferLength >= sizeof(KSSTREAM_HEADER));
+    if (!Buffer)
+    {
+        /* probe the stream irp */
+        Status = KsProbeStreamIrp(Irp, KSSTREAM_WRITE | KSPROBE_ALLOCATEMDL | KSPROBE_PROBEANDLOCK | KSPROBE_ALLOWFORMATCHANGE | KSPROBE_SYSTEMADDRESS, 0);
 
-    /* get stream header */
-    Header = (KSSTREAM_HEADER*)IoStack->Parameters.DeviceIoControl.Type3InputBuffer;
-#else
-    /* HACK get stream header */
-    Header = (KSSTREAM_HEADER*)Buffer;
+        /* check for success */
+        if (!NT_SUCCESS(Status))
+        {
+            DPRINT1("KsProbeStreamIrp failed with %x\n", Status);
+            return Status;
+        }
 
-    /* HACK untill stream probing is ready */
+        /* get the stream header */
+        Header = (PKSSTREAM_HEADER)Irp->AssociatedIrp.SystemBuffer;
+        ASSERT(Header);
+        ASSERT(Irp->MdlAddress);
+
+        if (Irp->RequestorMode != KernelMode)
+        {
+           /* use allocated mdl */
+           Header->Data = MmGetSystemAddressForMdlSafe(Irp->MdlAddress, NormalPagePriority);
+        }
+    }
+    else
+    {
+        /* HACK */
+        Header = (PKSSTREAM_HEADER)Buffer;
+    }
+
+    /* HACK */
     Irp->Tail.Overlay.DriverContext[2] = (PVOID)Header;
-#endif
 
     /* sanity check */
     ASSERT(Header);
@@ -156,7 +176,7 @@ IIrpQueue_fnAddMapping(
     KsAddIrpToCancelableQueue(&This->IrpList, &This->IrpListLock, Irp, KsListEntryTail, NULL);
 
     /* done */
-    return STATUS_SUCCESS;
+    return Status;
 }
 
 NTSTATUS
@@ -281,10 +301,10 @@ IIrpQueue_fnUpdateMapping(
         This->Irp->IoStatus.Information = StreamHeader->FrameExtent;
 
         /* free stream data, no tag as wdmaud.drv does it atm */
-        ExFreePool(StreamHeader->Data);
+        //ExFreePool(StreamHeader->Data);
 
         /* free stream header, no tag as wdmaud.drv allocates it atm */
-        ExFreePool(StreamHeader);
+        //ExFreePool(StreamHeader);
 
         /* complete the request */
         IoCompleteRequest(This->Irp, IO_SOUND_INCREMENT);
diff --git a/reactos/drivers/wdm/audio/backpln/portcls/pin_wavecyclic.c b/reactos/drivers/wdm/audio/backpln/portcls/pin_wavecyclic.c
index 598f8dad6ba..fcb28790ea7 100644
--- a/reactos/drivers/wdm/audio/backpln/portcls/pin_wavecyclic.c
+++ b/reactos/drivers/wdm/audio/backpln/portcls/pin_wavecyclic.c
@@ -640,15 +640,7 @@ IPortPinWaveCyclic_HandleKsStream(
 
     Status = This->IrpQueue->lpVtbl->AddMapping(This->IrpQueue, NULL, 0, Irp);
 
-    /* check if pin is in run state */
-    if (This->State != KSSTATE_RUN)
-    {
-        /* HACK set pin into run state if caller forgot it */
-        SetStreamState(This, KSSTATE_RUN);
-        DPRINT1("Starting stream with %lu mappings Status %x\n", This->IrpQueue->lpVtbl->NumMappings(This->IrpQueue), Status);
-    }
-
-    return Status;
+    return STATUS_PENDING;
 }
 
 /*
@@ -911,7 +903,7 @@ IPortPinWaveCyclic_fnFastDeviceIoControl(
     OUT PIO_STATUS_BLOCK StatusBlock,
     IN PDEVICE_OBJECT DeviceObject)
 {
-    return FALSE;
+    return KsDispatchFastIoDeviceControlFailure(FileObject, Wait, InputBuffer, InputBufferLength, OutputBuffer, OutputBufferLength, IoControlCode, StatusBlock, DeviceObject);
 }
 
 /*
diff --git a/reactos/drivers/wdm/audio/legacy/wdmaud/control.c b/reactos/drivers/wdm/audio/legacy/wdmaud/control.c
index 57057935ddb..15a600db005 100644
--- a/reactos/drivers/wdm/audio/legacy/wdmaud/control.c
+++ b/reactos/drivers/wdm/audio/legacy/wdmaud/control.c
@@ -1105,8 +1105,8 @@ WdmAudWrite(
     /* now build the irp */
     LowerIrp = IoBuildAsynchronousFsdRequest (IRP_MJ_WRITE,
                                               IoGetRelatedDeviceObject(FileObject),
-                                              Packet, 
-                                              sizeof(KSSTREAM_HEADER), 
+                                              Packet,
+                                              sizeof(KSSTREAM_HEADER),
                                               &Offset,
                                               NULL);
 
@@ -1120,6 +1120,12 @@ WdmAudWrite(
         return SetIrpIoStatus(Irp, STATUS_INSUFFICIENT_RESOURCES, 0);
     }
 
+    /* get next stack location */
+    IoStack = IoGetNextIrpStackLocation(LowerIrp);
+
+    /* attach file object */
+    IoStack->FileObject = FileObject;
+
     /* set a completion routine */
     IoSetCompletionRoutine(LowerIrp, WdmAudWriteCompletion, (PVOID)Irp, TRUE, TRUE, TRUE);
 
diff --git a/reactos/drivers/wdm/audio/sysaudio/pin.c b/reactos/drivers/wdm/audio/sysaudio/pin.c
index fd321ea9c54..46b00e1cd95 100644
--- a/reactos/drivers/wdm/audio/sysaudio/pin.c
+++ b/reactos/drivers/wdm/audio/sysaudio/pin.c
@@ -129,6 +129,7 @@ Pin_fnWrite(
     PDISPATCH_CONTEXT Context;
     PIO_STACK_LOCATION IoStack;
     PFILE_OBJECT FileObject;
+    PVOID Buffer;
     NTSTATUS Status;
     ULONG BytesReturned;
 
@@ -159,15 +160,26 @@ Pin_fnWrite(
         return Status;
     }
 
+    Buffer = MmGetSystemAddressForMdlSafe(Irp->MdlAddress, NormalPagePriority);
+
+    if (!Buffer)
+    {
+        /* insufficient resources */
+        Irp->IoStatus.Status = STATUS_INSUFFICIENT_RESOURCES;
+        /* Complete the irp */
+        IoCompleteRequest(Irp, IO_NO_INCREMENT);
+        return STATUS_INSUFFICIENT_RESOURCES;
+    }
+
+
     /* call the portcls audio pin */
     Status = KsSynchronousIoControlDevice(FileObject, KernelMode, IOCTL_KS_WRITE_STREAM,
-                                          Irp->UserBuffer,
-                                          IoStack->Parameters.Write.Length,
                                           NULL,
                                           0,
+                                          Buffer,
+                                          IoStack->Parameters.Write.Length,
                                           &BytesReturned);
 
-
     /* Release file object */
     ObDereferenceObject(FileObject);
 
@@ -329,9 +341,6 @@ Pin_fnFastDeviceIoControl(
     PIO_STATUS_BLOCK IoStatus,
     PDEVICE_OBJECT DeviceObject)
 {
-    DPRINT("Pin_fnFastDeviceIoControl called DeviceObject %p Irp %p\n", DeviceObject);
-
-
     return FALSE;
 }
 
@@ -348,8 +357,6 @@ Pin_fnFastRead(
     PIO_STATUS_BLOCK IoStatus,
     PDEVICE_OBJECT DeviceObject)
 {
-    DPRINT("Pin_fnFastRead called DeviceObject %p Irp %p\n", DeviceObject);
-
     return FALSE;
 
 }