diff --git a/base/applications/network/net/cmdAccounts.c b/base/applications/network/net/cmdAccounts.c
index c297da0af48..dcd93de724c 100644
--- a/base/applications/network/net/cmdAccounts.c
+++ b/base/applications/network/net/cmdAccounts.c
@@ -48,7 +48,7 @@ cmdAccounts(
 
         if (_wcsicmp(argv[i], L"/domain") == 0)
         {
-            printf("The /DOMAIN option is not supported yet!\n");
+            PrintToConsole(L"The /DOMAIN option is not supported yet!\n");
 #if 0
             Domain = TRUE;
 #endif
@@ -74,7 +74,7 @@ cmdAccounts(
                 value = wcstoul(p, &endptr, 10);
                 if (*endptr != 0)
                 {
-                    printf("You entered an invalid value for the /FORCELOGOFF option.\n");
+                    PrintToConsole(L"You entered an invalid value for the /FORCELOGOFF option.\n");
                     result = 1;
                     goto done;
                 }
@@ -89,7 +89,7 @@ cmdAccounts(
             value = wcstoul(p, &endptr, 10);
             if (*endptr != 0)
             {
-                    printf("You entered an invalid value for the /MINPWLEN option.\n");
+                    PrintToConsole(L"You entered an invalid value for the /MINPWLEN option.\n");
                     result = 1;
                     goto done;
             }
@@ -111,7 +111,7 @@ cmdAccounts(
                 value = wcstoul(p, &endptr, 10);
                 if (*endptr != 0)
                 {
-                    printf("You entered an invalid value for the /MAXPWAGE option.\n");
+                    PrintToConsole(L"You entered an invalid value for the /MAXPWAGE option.\n");
                     result = 1;
                     goto done;
                 }
@@ -126,7 +126,7 @@ cmdAccounts(
             value = wcstoul(p, &endptr, 10);
             if (*endptr != 0)
             {
-                printf("You entered an invalid value for the /MINPWAGE option.\n");
+                PrintToConsole(L"You entered an invalid value for the /MINPWAGE option.\n");
                 result = 1;
                 goto done;
             }
@@ -140,7 +140,7 @@ cmdAccounts(
             value = wcstoul(p, &endptr, 10);
             if (*endptr != 0)
             {
-                printf("You entered an invalid value for the /UNIQUEPW option.\n");
+                PrintToConsole(L"You entered an invalid value for the /UNIQUEPW option.\n");
                 result = 1;
                 goto done;
             }
@@ -168,51 +168,51 @@ cmdAccounts(
 
         RtlGetNtProductType(&ProductType);
 
-        printf("Force logoff after: ");
+        PrintToConsole(L"Force logoff after: ");
         if (Info0->usrmod0_force_logoff == TIMEQ_FOREVER)
-            printf("Never\n");
+            PrintToConsole(L"Never\n");
         else
-            printf("%lu seconds\n", Info0->usrmod0_force_logoff);
+            PrintToConsole(L"%lu seconds\n", Info0->usrmod0_force_logoff);
 
-        printf("Minimum password age (in days): %lu\n", Info0->usrmod0_min_passwd_age / 86400);
-        printf("Maximum password age (in days): %lu\n", Info0->usrmod0_max_passwd_age / 86400);
-        printf("Minimum password length: %lu\n", Info0->usrmod0_min_passwd_len);
+        PrintToConsole(L"Minimum password age (in days): %lu\n", Info0->usrmod0_min_passwd_age / 86400);
+        PrintToConsole(L"Maximum password age (in days): %lu\n", Info0->usrmod0_max_passwd_age / 86400);
+        PrintToConsole(L"Minimum password length: %lu\n", Info0->usrmod0_min_passwd_len);
 
-        printf("Password history length: ");
+        PrintToConsole(L"Password history length: ");
         if (Info0->usrmod0_password_hist_len == 0)
-            printf("None\n");
+            PrintToConsole(L"None\n");
         else
-            printf("%lu\n", Info0->usrmod0_password_hist_len);
+            PrintToConsole(L"%lu\n", Info0->usrmod0_password_hist_len);
 
-        printf("Lockout threshold: ");
+        PrintToConsole(L"Lockout threshold: ");
         if (Info3->usrmod3_lockout_threshold == 0)
-            printf("Never\n");
+            PrintToConsole(L"Never\n");
         else
-            printf("%lu\n", Info3->usrmod3_lockout_threshold);
+            PrintToConsole(L"%lu\n", Info3->usrmod3_lockout_threshold);
 
-        printf("Lockout duration (in minutes): %lu\n", Info3->usrmod3_lockout_duration / 60);
-        printf("Lockout observation window (in minutes): %lu\n", Info3->usrmod3_lockout_observation_window / 60);
+        PrintToConsole(L"Lockout duration (in minutes): %lu\n", Info3->usrmod3_lockout_duration / 60);
+        PrintToConsole(L"Lockout observation window (in minutes): %lu\n", Info3->usrmod3_lockout_observation_window / 60);
 
-        printf("Computer role: ");
+        PrintToConsole(L"Computer role: ");
 
         if (Info1->usrmod1_role == UAS_ROLE_PRIMARY)
         {
             if (ProductType == NtProductLanManNt)
             {
-                printf("Primary server\n");
+                PrintToConsole(L"Primary server\n");
             }
             else if (ProductType == NtProductServer)
             {
-                printf("Standalone server\n");
+                PrintToConsole(L"Standalone server\n");
             }
             else
             {
-                printf("Workstation\n");
+                PrintToConsole(L"Workstation\n");
             }
         }
         else
         {
-            printf("Backup server\n");
+            PrintToConsole(L"Backup server\n");
         }
     }
 
diff --git a/base/applications/network/net/cmdHelpMsg.c b/base/applications/network/net/cmdHelpMsg.c
index 8247836b354..d78d4e86e39 100644
--- a/base/applications/network/net/cmdHelpMsg.c
+++ b/base/applications/network/net/cmdHelpMsg.c
@@ -49,12 +49,12 @@ INT cmdHelpMsg(INT argc, WCHAR **argv)
                        0,
                        NULL))
     {
-        printf("\n%S\n", lpBuffer);
+        PrintToConsole(L"\n%s\n", lpBuffer);
         LocalFree(lpBuffer);
     }
     else
     {
-        printf("Unrecognized error code: %ld\n", errNum);
+        PrintToConsole(L"Unrecognized error code: %ld\n", errNum);
     }
 
     return 0;
diff --git a/base/applications/network/net/cmdLocalGroup.c b/base/applications/network/net/cmdLocalGroup.c
index 1995c2650a1..3cd5af48af3 100644
--- a/base/applications/network/net/cmdLocalGroup.c
+++ b/base/applications/network/net/cmdLocalGroup.c
@@ -38,8 +38,8 @@ EnumerateLocalGroups(VOID)
     if (Status != NERR_Success)
         return Status;
 
-    printf("\nAliases for \\\\%S\n\n", pServer->sv100_name);
-    printf("------------------------------------------\n");
+    PrintToConsole(L"\nAliases for \\\\%s\n\n", pServer->sv100_name);
+    PrintToConsole(L"------------------------------------------\n");
 
     NetApiBufferFree(pServer);
 
@@ -58,12 +58,10 @@ EnumerateLocalGroups(VOID)
           sizeof(PLOCALGROUP_INFO_0),
           CompareInfo);
 
-//    printf("dwRead: %lu  dwTotal: %lu\n", dwRead, dwTotal);
     for (i = 0; i < dwRead; i++)
     {
-//        printf("%p\n", pBuffer[i].lgrpi0_name);
          if (pBuffer[i].lgrpi0_name)
-            printf("*%S\n", pBuffer[i].lgrpi0_name);
+            PrintToConsole(L"*%s\n", pBuffer[i].lgrpi0_name);
     }
 
     NetApiBufferFree(pBuffer);
@@ -129,17 +127,17 @@ DisplayLocalGroup(LPWSTR lpGroupName)
              pNames[i] = pMembers[i].lgrmi3_domainandname;
     }
 
-    printf("Alias name        %S\n", pGroupInfo->lgrpi1_name);
-    printf("Comment           %S\n", pGroupInfo->lgrpi1_comment);
-    printf("\n");
-    printf("Members\n");
-    printf("\n");
-    printf("------------------------------------------\n");
+    PrintToConsole(L"Alias name        %s\n", pGroupInfo->lgrpi1_name);
+    PrintToConsole(L"Comment           %s\n", pGroupInfo->lgrpi1_comment);
+    PrintToConsole(L"\n");
+    PrintToConsole(L"Members\n");
+    PrintToConsole(L"\n");
+    PrintToConsole(L"------------------------------------------\n");
 
     for (i = 0; i < dwRead; i++)
     {
-         if (pNames[i])
-            printf("%S\n", pNames[i]);
+        if (pNames[i])
+            PrintToConsole(L"%s\n", pNames[i]);
     }
 
 done:
diff --git a/base/applications/network/net/cmdStart.c b/base/applications/network/net/cmdStart.c
index 34070584f72..ad6021c2a13 100644
--- a/base/applications/network/net/cmdStart.c
+++ b/base/applications/network/net/cmdStart.c
@@ -57,11 +57,11 @@ EnumerateRunningServices(VOID)
                                     &dwServiceCount,
                                     &dwResumeHandle))
             {
-                printf("The following services hav been started:\n\n");
+                PrintToConsole(L"The following services hav been started:\n\n");
 
                 for (i = 0; i < dwServiceCount; i++)
                 {
-                    printf("  %S\n", lpServiceBuffer[i].lpDisplayName);
+                    PrintToConsole(L"  %s\n", lpServiceBuffer[i].lpDisplayName);
                 }
             }
 
diff --git a/base/applications/network/net/cmdUser.c b/base/applications/network/net/cmdUser.c
index a8289ea80bc..038df08d1c3 100644
--- a/base/applications/network/net/cmdUser.c
+++ b/base/applications/network/net/cmdUser.c
@@ -37,11 +37,11 @@ EnumerateUsers(VOID)
     if (Status != NERR_Success)
         return Status;
 
-    printf("\nUser accounts for \\\\%S\n\n", pServer->sv100_name);
+    PrintToConsole(L"\nUser accounts for \\\\%s\n\n", pServer->sv100_name);
 
     NetApiBufferFree(pServer);
 
-    printf("------------------------------------------\n");
+    PrintToConsole(L"------------------------------------------\n");
 
     Status = NetUserEnum(NULL,
                          0,
@@ -64,7 +64,7 @@ EnumerateUsers(VOID)
     {
 //        printf("%p\n", pBuffer[i].lgrpi0_name);
          if (pBuffer[i].usri0_name)
-            printf("%S\n", pBuffer[i].usri0_name);
+            PrintToConsole(L"%s\n", pBuffer[i].usri0_name);
     }
 
     NetApiBufferFree(pBuffer);
@@ -102,7 +102,7 @@ PrintDateTime(DWORD dwSeconds)
                    TimeBuffer,
                    80);
 
-    printf("%S %S\n", DateBuffer, TimeBuffer);
+    PrintToConsole(L"%s %s\n", DateBuffer, TimeBuffer);
 }
 
 
@@ -110,6 +110,7 @@ static
 NET_API_STATUS
 DisplayUser(LPWSTR lpUserName)
 {
+    PUSER_MODALS_INFO_0 pUserModals = NULL;
     PUSER_INFO_4 pUserInfo = NULL;
     NET_API_STATUS Status;
 
@@ -121,39 +122,56 @@ DisplayUser(LPWSTR lpUserName)
     if (Status != NERR_Success)
         return Status;
 
-    printf("User name                    %S\n", pUserInfo->usri4_name);
-    printf("Full name                    %S\n", pUserInfo->usri4_full_name);
-    printf("Comment                      %S\n", pUserInfo->usri4_comment);
-    printf("User comment                 %S\n", pUserInfo->usri4_usr_comment);
-    printf("Country code                 %03ld ()\n", pUserInfo->usri4_country_code);
-    printf("Account active               %S\n", (pUserInfo->usri4_flags & UF_ACCOUNTDISABLE)? L"No" : ((pUserInfo->usri4_flags & UF_LOCKOUT) ? L"Locked" : L"Yes"));
-    printf("Account expires              ");
+    Status = NetUserModalsGet(NULL,
+                              0,
+                              (LPBYTE*)&pUserModals);
+    if (Status != NERR_Success)
+        goto done;
+
+    PrintToConsole(L"User name                    %s\n", pUserInfo->usri4_name);
+    PrintToConsole(L"Full name                    %s\n", pUserInfo->usri4_full_name);
+    PrintToConsole(L"Comment                      %s\n", pUserInfo->usri4_comment);
+    PrintToConsole(L"User comment                 %s\n", pUserInfo->usri4_usr_comment);
+    PrintToConsole(L"Country code                 %03ld ()\n", pUserInfo->usri4_country_code);
+    PrintToConsole(L"Account active               %s\n", (pUserInfo->usri4_flags & UF_ACCOUNTDISABLE)? L"No" : ((pUserInfo->usri4_flags & UF_LOCKOUT) ? L"Locked" : L"Yes"));
+    PrintToConsole(L"Account expires              ");
     if (pUserInfo->usri4_acct_expires == TIMEQ_FOREVER)
-        printf("Never\n");
+        PrintToConsole(L"Never\n");
     else
         PrintDateTime(pUserInfo->usri4_acct_expires);
 
-    printf("\n");
-    printf("Password last set            \n");
-    printf("Password expires             \n");
-    printf("Password changeable          \n");
-    printf("Password required            \n");
-    printf("User may change password     \n");
-    printf("\n");
-    printf("Workstation allowed          %S\n", pUserInfo->usri4_workstations);
-    printf("Logon script                 %S\n", pUserInfo->usri4_script_path);
-    printf("User profile                 %S\n", pUserInfo->usri4_profile);
-    printf("Home directory               %S\n", pUserInfo->usri4_home_dir);
-    printf("Last logon                   ");
+    PrintToConsole(L"\n");
+    PrintToConsole(L"Password last set            \n");
+
+    PrintToConsole(L"Password expires             ");
+    if (pUserModals->usrmod0_max_passwd_age == TIMEQ_FOREVER)
+        PrintToConsole(L"Never\n");
+    else
+        PrintDateTime(pUserInfo->usri4_acct_expires);
+
+    PrintToConsole(L"Password changeable          \n");
+    PrintToConsole(L"Password required            \n");
+    PrintToConsole(L"User may change password     \n");
+
+    PrintToConsole(L"\n");
+    PrintToConsole(L"Workstation allowed          %s\n", pUserInfo->usri4_workstations);
+    PrintToConsole(L"Logon script                 %s\n", pUserInfo->usri4_script_path);
+    PrintToConsole(L"User profile                 %s\n", pUserInfo->usri4_profile);
+    PrintToConsole(L"Home directory               %s\n", pUserInfo->usri4_home_dir);
+    PrintToConsole(L"Last logon                   ");
     if (pUserInfo->usri4_last_logon == 0)
-        printf("Never\n");
+        PrintToConsole(L"Never\n");
     else
         PrintDateTime(pUserInfo->usri4_last_logon);
-    printf("\n");
-    printf("Logon hours allowed          \n");
-    printf("\n");
-    printf("Local group memberships      \n");
-    printf("Global group memberships     \n");
+    PrintToConsole(L"\n");
+    PrintToConsole(L"Logon hours allowed          \n");
+    PrintToConsole(L"\n");
+    PrintToConsole(L"Local group memberships      \n");
+    PrintToConsole(L"Global group memberships     \n");
+
+done:
+    if (pUserModals != NULL)
+        NetApiBufferFree(pUserModals);
 
     if (pUserInfo != NULL)
         NetApiBufferFree(pUserInfo);
diff --git a/base/applications/network/net/main.c b/base/applications/network/net/main.c
index cc93fea82fd..1b489cc493c 100644
--- a/base/applications/network/net/main.c
+++ b/base/applications/network/net/main.c
@@ -51,13 +51,70 @@ PrintResourceString(
     INT resID,
     ...)
 {
-    WCHAR szMsgBuf[MAX_BUFFER_SIZE];
+    WCHAR szMsgBuffer[MAX_BUFFER_SIZE];
+    WCHAR szOutBuffer[MAX_BUFFER_SIZE];
     va_list arg_ptr;
 
     va_start(arg_ptr, resID);
-    LoadStringW(GetModuleHandle(NULL), resID, szMsgBuf, MAX_BUFFER_SIZE);
-    vwprintf(szMsgBuf, arg_ptr);
+    LoadStringW(GetModuleHandle(NULL), resID, szMsgBuffer, MAX_BUFFER_SIZE);
+    _vsnwprintf(szOutBuffer, MAX_BUFFER_SIZE, szMsgBuffer, arg_ptr);
     va_end(arg_ptr);
+
+    WriteToConsole(szOutBuffer);
+}
+
+
+VOID
+PrintToConsole(
+    LPWSTR lpFormat,
+    ...)
+{
+    WCHAR szBuffer[MAX_BUFFER_SIZE];
+    va_list arg_ptr;
+
+    va_start(arg_ptr, lpFormat);
+    _vsnwprintf(szBuffer, MAX_BUFFER_SIZE, lpFormat, arg_ptr);
+    va_end(arg_ptr);
+
+    WriteToConsole(szBuffer);
+}
+
+
+VOID
+WriteToConsole(
+    LPWSTR lpString)
+{
+    CHAR szOemBuffer[MAX_BUFFER_SIZE * 2];
+    HANDLE hOutput;
+    DWORD dwLength;
+
+    dwLength = wcslen(lpString);
+
+    hOutput = GetStdHandle(STD_OUTPUT_HANDLE);
+    if ((GetFileType(hOutput) & ~FILE_TYPE_REMOTE) == FILE_TYPE_CHAR)
+    {
+        WriteConsoleW(hOutput,
+                      lpString,
+                      dwLength,
+                      &dwLength,
+                      NULL);
+    }
+    else
+    {
+        dwLength = WideCharToMultiByte(CP_OEMCP,
+                                       0,
+                                       lpString,
+                                       dwLength,
+                                       szOemBuffer,
+                                       MAX_BUFFER_SIZE * 2,
+                                       NULL,
+                                       NULL);
+        WriteFile(hOutput,
+                  szOemBuffer,
+                  dwLength,
+                  &dwLength,
+                  NULL);
+    }
 }
 
 
diff --git a/base/applications/network/net/net.h b/base/applications/network/net/net.h
index e100dc9e84a..7f1d05924a3 100644
--- a/base/applications/network/net/net.h
+++ b/base/applications/network/net/net.h
@@ -14,6 +14,7 @@
 #include <windef.h>
 #include <winbase.h>
 #include <winnls.h>
+#include <wincon.h>
 #include <winuser.h>
 #include <winsvc.h>
 #include <stdio.h>
@@ -29,6 +30,15 @@ PrintResourceString(
     INT resID,
     ...);
 
+VOID
+PrintToConsole(
+    LPWSTR lpFormat,
+    ...);
+
+VOID
+WriteToConsole(
+    LPWSTR lpString);
+
 VOID help(VOID);
 INT unimplemented(INT argc, WCHAR **argv);
 
diff --git a/dll/win32/advapi32/wine/security.c b/dll/win32/advapi32/wine/security.c
index 4e60c9ee01b..bbb93aebf84 100644
--- a/dll/win32/advapi32/wine/security.c
+++ b/dll/win32/advapi32/wine/security.c
@@ -16,26 +16,13 @@
 
 WINE_DEFAULT_DEBUG_CHANNEL(advapi);
 
-static DWORD ComputeStringSidSize(LPCWSTR StringSid);
 static BOOL ParseStringSidToSid(LPCWSTR StringSid, PSID pSid, LPDWORD cBytes);
 
-#define MAX_GUID_STRING_LEN 39
-
-BOOL WINAPI
-AddAuditAccessAceEx(PACL pAcl,
-                    DWORD dwAceRevision,
-                    DWORD AceFlags,
-                    DWORD dwAccessMask,
-                    PSID pSid,
-                    BOOL bAuditSuccess,
-                    BOOL bAuditFailure);
-
-typedef struct RECORD
+typedef struct _ACEFLAG
 {
-    LPCWSTR key;
-    DWORD value;
-} RECORD;
-
+   LPCWSTR wstr;
+   DWORD value;
+} ACEFLAG, *LPACEFLAG;
 
 typedef struct _MAX_SID
 {
@@ -53,12 +40,6 @@ typedef struct WELLKNOWNSID
     MAX_SID Sid;
 } WELLKNOWNSID;
 
-typedef struct _ACEFLAG
-{
-   LPCWSTR wstr;
-   DWORD value;
-} ACEFLAG, *LPACEFLAG;
-
 static const WELLKNOWNSID WellKnownSids[] =
 {
     { {0,0}, WinNullSid, { SID_REVISION, 1, { SECURITY_NULL_SID_AUTHORITY }, { SECURITY_NULL_RID } } },
@@ -115,26 +96,28 @@ static const WELLKNOWNSID WellKnownSids[] =
     { {'S','I'}, WinSystemLabelSid, { SID_REVISION, 1, { SECURITY_MANDATORY_LABEL_AUTHORITY}, { SECURITY_MANDATORY_SYSTEM_RID } } },
 };
 
+/* these SIDs must be constructed as relative to some domain - only the RID is well-known */
 typedef struct WELLKNOWNRID
 {
+    WCHAR wstr[2];
     WELL_KNOWN_SID_TYPE Type;
     DWORD Rid;
 } WELLKNOWNRID;
 
 static const WELLKNOWNRID WellKnownRids[] = {
-    { WinAccountAdministratorSid,    DOMAIN_USER_RID_ADMIN },
-    { WinAccountGuestSid,            DOMAIN_USER_RID_GUEST },
-    { WinAccountKrbtgtSid,           DOMAIN_USER_RID_KRBTGT },
-    { WinAccountDomainAdminsSid,     DOMAIN_GROUP_RID_ADMINS },
-    { WinAccountDomainUsersSid,      DOMAIN_GROUP_RID_USERS },
-    { WinAccountDomainGuestsSid,     DOMAIN_GROUP_RID_GUESTS },
-    { WinAccountComputersSid,        DOMAIN_GROUP_RID_COMPUTERS },
-    { WinAccountControllersSid,      DOMAIN_GROUP_RID_CONTROLLERS },
-    { WinAccountCertAdminsSid,       DOMAIN_GROUP_RID_CERT_ADMINS },
-    { WinAccountSchemaAdminsSid,     DOMAIN_GROUP_RID_SCHEMA_ADMINS },
-    { WinAccountEnterpriseAdminsSid, DOMAIN_GROUP_RID_ENTERPRISE_ADMINS },
-    { WinAccountPolicyAdminsSid,     DOMAIN_GROUP_RID_POLICY_ADMINS },
-    { WinAccountRasAndIasServersSid, DOMAIN_ALIAS_RID_RAS_SERVERS },
+    { {'L','A'}, WinAccountAdministratorSid,    DOMAIN_USER_RID_ADMIN },
+    { {'L','G'}, WinAccountGuestSid,            DOMAIN_USER_RID_GUEST },
+    { {0,0}, WinAccountKrbtgtSid,           DOMAIN_USER_RID_KRBTGT },
+    { {0,0}, WinAccountDomainAdminsSid,     DOMAIN_GROUP_RID_ADMINS },
+    { {0,0}, WinAccountDomainUsersSid,      DOMAIN_GROUP_RID_USERS },
+    { {0,0}, WinAccountDomainGuestsSid,     DOMAIN_GROUP_RID_GUESTS },
+    { {0,0}, WinAccountComputersSid,        DOMAIN_GROUP_RID_COMPUTERS },
+    { {0,0}, WinAccountControllersSid,      DOMAIN_GROUP_RID_CONTROLLERS },
+    { {0,0}, WinAccountCertAdminsSid,       DOMAIN_GROUP_RID_CERT_ADMINS },
+    { {0,0}, WinAccountSchemaAdminsSid,     DOMAIN_GROUP_RID_SCHEMA_ADMINS },
+    { {0,0}, WinAccountEnterpriseAdminsSid, DOMAIN_GROUP_RID_ENTERPRISE_ADMINS },
+    { {0,0}, WinAccountPolicyAdminsSid,     DOMAIN_GROUP_RID_POLICY_ADMINS },
+    { {0,0}, WinAccountRasAndIasServersSid, DOMAIN_ALIAS_RID_RAS_SERVERS },
 };
 
 static const SID sidWorld = { SID_REVISION, 1, { SECURITY_WORLD_SID_AUTHORITY} , { SECURITY_WORLD_RID } };
@@ -226,40 +209,6 @@ static const char * debugstr_sid(PSID sid)
     return "(too-big)";
 }
 
-static const ACEFLAG AceRights[] =
-{
-    { SDDL_GENERIC_ALL,     GENERIC_ALL },
-    { SDDL_GENERIC_READ,    GENERIC_READ },
-    { SDDL_GENERIC_WRITE,   GENERIC_WRITE },
-    { SDDL_GENERIC_EXECUTE, GENERIC_EXECUTE },
-
-    { SDDL_READ_CONTROL,    READ_CONTROL },
-    { SDDL_STANDARD_DELETE, DELETE },
-    { SDDL_WRITE_DAC,       WRITE_DAC },
-    { SDDL_WRITE_OWNER,     WRITE_OWNER },
-
-    { SDDL_READ_PROPERTY,   ADS_RIGHT_DS_READ_PROP},
-    { SDDL_WRITE_PROPERTY,  ADS_RIGHT_DS_WRITE_PROP},
-    { SDDL_CREATE_CHILD,    ADS_RIGHT_DS_CREATE_CHILD},
-    { SDDL_DELETE_CHILD,    ADS_RIGHT_DS_DELETE_CHILD},
-    { SDDL_LIST_CHILDREN,   ADS_RIGHT_ACTRL_DS_LIST},
-    { SDDL_SELF_WRITE,      ADS_RIGHT_DS_SELF},
-    { SDDL_LIST_OBJECT,     ADS_RIGHT_DS_LIST_OBJECT},
-    { SDDL_DELETE_TREE,     ADS_RIGHT_DS_DELETE_TREE},
-    { SDDL_CONTROL_ACCESS,  ADS_RIGHT_DS_CONTROL_ACCESS},
-
-    { SDDL_FILE_ALL,        FILE_ALL_ACCESS },
-    { SDDL_FILE_READ,       FILE_GENERIC_READ },
-    { SDDL_FILE_WRITE,      FILE_GENERIC_WRITE },
-    { SDDL_FILE_EXECUTE,    FILE_GENERIC_EXECUTE },
-
-    { SDDL_KEY_ALL,         KEY_ALL_ACCESS },
-    { SDDL_KEY_READ,        KEY_READ },
-    { SDDL_KEY_WRITE,       KEY_WRITE },
-    { SDDL_KEY_EXECUTE,     KEY_EXECUTE },
-    { NULL, 0 },
-};
-
 /* set last error code from NT status and get the proper boolean return value */
 /* used for functions that are a simple wrapper around the corresponding ntdll API */
 static __inline BOOL set_ntstatus( NTSTATUS status )
@@ -268,48 +217,18 @@ static __inline BOOL set_ntstatus( NTSTATUS status )
     return NT_SUCCESS(status);
 }
 
-static const RECORD SidTable[] =
+static LPWSTR SERV_dup( LPCSTR str )
 {
-	{ SDDL_ACCOUNT_OPERATORS, WinBuiltinAccountOperatorsSid },
-	{ SDDL_ALIAS_PREW2KCOMPACC, WinBuiltinPreWindows2000CompatibleAccessSid },
-	{ SDDL_ANONYMOUS, WinAnonymousSid },
-	{ SDDL_AUTHENTICATED_USERS, WinAuthenticatedUserSid },
-	{ SDDL_BUILTIN_ADMINISTRATORS, WinBuiltinAdministratorsSid },
-	{ SDDL_BUILTIN_GUESTS, WinBuiltinGuestsSid },
-	{ SDDL_BACKUP_OPERATORS, WinBuiltinBackupOperatorsSid },
-	{ SDDL_BUILTIN_USERS, WinBuiltinUsersSid },
-	{ SDDL_CERT_SERV_ADMINISTRATORS, WinAccountCertAdminsSid /* FIXME: DOMAIN_GROUP_RID_CERT_ADMINS */ },
-	{ SDDL_CREATOR_GROUP, WinCreatorGroupSid },
-	{ SDDL_CREATOR_OWNER, WinCreatorOwnerSid },
-	{ SDDL_DOMAIN_ADMINISTRATORS, WinAccountDomainAdminsSid /* FIXME: DOMAIN_GROUP_RID_ADMINS */ },
-	{ SDDL_DOMAIN_COMPUTERS, WinAccountComputersSid /* FIXME: DOMAIN_GROUP_RID_COMPUTERS */ },
-	{ SDDL_DOMAIN_DOMAIN_CONTROLLERS, WinAccountControllersSid /* FIXME: DOMAIN_GROUP_RID_CONTROLLERS */ },
-	{ SDDL_DOMAIN_GUESTS, WinAccountDomainGuestsSid /* FIXME: DOMAIN_GROUP_RID_GUESTS */ },
-	{ SDDL_DOMAIN_USERS, WinAccountDomainUsersSid /* FIXME: DOMAIN_GROUP_RID_USERS */ },
-	{ SDDL_ENTERPRISE_ADMINS, WinAccountEnterpriseAdminsSid /* FIXME: DOMAIN_GROUP_RID_ENTERPRISE_ADMINS */ },
-	{ SDDL_ENTERPRISE_DOMAIN_CONTROLLERS, WinEnterpriseControllersSid },
-	{ SDDL_EVERYONE, WinWorldSid },
-	{ SDDL_GROUP_POLICY_ADMINS, WinAccountPolicyAdminsSid /* FIXME: DOMAIN_GROUP_RID_POLICY_ADMINS */ },
-	{ SDDL_INTERACTIVE, WinInteractiveSid },
-	{ SDDL_LOCAL_ADMIN, WinAccountAdministratorSid /* FIXME: DOMAIN_USER_RID_ADMIN */ },
-	{ SDDL_LOCAL_GUEST, WinAccountGuestSid /* FIXME: DOMAIN_USER_RID_GUEST */ },
-	{ SDDL_LOCAL_SERVICE, WinLocalServiceSid },
-	{ SDDL_LOCAL_SYSTEM, WinLocalSystemSid },
-	{ SDDL_NETWORK, WinNetworkSid },
-	{ SDDL_NETWORK_CONFIGURATION_OPS, WinBuiltinNetworkConfigurationOperatorsSid },
-	{ SDDL_NETWORK_SERVICE, WinNetworkServiceSid },
-	{ SDDL_PRINTER_OPERATORS, WinBuiltinPrintOperatorsSid },
-	{ SDDL_PERSONAL_SELF, WinSelfSid },
-	{ SDDL_POWER_USERS, WinBuiltinPowerUsersSid },
-	{ SDDL_RAS_SERVERS, WinAccountRasAndIasServersSid /* FIXME: DOMAIN_ALIAS_RID_RAS_SERVERS */ },
-	{ SDDL_REMOTE_DESKTOP, WinBuiltinRemoteDesktopUsersSid },
-	{ SDDL_REPLICATOR, WinBuiltinReplicatorSid },
-	{ SDDL_RESTRICTED_CODE, WinRestrictedCodeSid },
-	{ SDDL_SCHEMA_ADMINISTRATORS, WinAccountSchemaAdminsSid /* FIXME: DOMAIN_GROUP_RID_SCHEMA_ADMINS */ },
-	{ SDDL_SERVER_OPERATORS, WinBuiltinSystemOperatorsSid },
-	{ SDDL_SERVICE, WinServiceSid },
-	{ NULL, 0 },
-};
+    UINT len;
+    LPWSTR wstr;
+
+    if( !str )
+        return NULL;
+    len = MultiByteToWideChar( CP_ACP, 0, str, -1, NULL, 0 );
+    wstr = heap_alloc( len*sizeof (WCHAR) );
+    MultiByteToWideChar( CP_ACP, 0, str, -1, wstr, len );
+    return wstr;
+}
 
 /************************************************************
  *                ADVAPI_IsLocalComputer
@@ -335,6 +254,24 @@ BOOL ADVAPI_IsLocalComputer(LPCWSTR ServerName)
     return Result;
 }
 
+/************************************************************
+ *                ADVAPI_GetComputerSid
+ */
+BOOL ADVAPI_GetComputerSid(PSID sid)
+{
+    static const struct /* same fields as struct SID */
+    {
+        BYTE Revision;
+        BYTE SubAuthorityCount;
+        SID_IDENTIFIER_AUTHORITY IdentifierAuthority;
+        DWORD SubAuthority[4];
+    } computer_sid =
+    { SID_REVISION, 4, { SECURITY_NT_AUTHORITY }, { SECURITY_NT_NON_UNIQUE, 0, 0, 0 } };
+
+    memcpy( sid, &computer_sid, sizeof(computer_sid) );
+    return TRUE;
+}
+
 /* Exported functions */
 
 /*
@@ -364,28 +301,29 @@ OpenProcessToken(HANDLE ProcessHandle,
     return TRUE;
 }
 
-/*
- * @implemented
+/******************************************************************************
+ * OpenThreadToken [ADVAPI32.@]
+ *
+ * Opens the access token associated with a thread handle.
+ *
+ * PARAMS
+ *   ThreadHandle  [I] Handle to process
+ *   DesiredAccess [I] Desired access to the thread
+ *   OpenAsSelf    [I] ???
+ *   TokenHandle   [O] Destination for the token handle
+ *
+ * RETURNS
+ *  Success: TRUE. TokenHandle contains the access token.
+ *  Failure: FALSE.
+ *
+ * NOTES
+ *  See NtOpenThreadToken.
  */
 BOOL WINAPI
-OpenThreadToken(HANDLE ThreadHandle,
-                DWORD DesiredAccess,
-                BOOL OpenAsSelf,
-                PHANDLE TokenHandle)
+OpenThreadToken( HANDLE ThreadHandle, DWORD DesiredAccess,
+		 BOOL OpenAsSelf, HANDLE *TokenHandle)
 {
-    NTSTATUS Status;
-
-    Status = NtOpenThreadToken(ThreadHandle,
-                               DesiredAccess,
-                               OpenAsSelf,
-                               TokenHandle);
-    if (!NT_SUCCESS(Status))
-    {
-        SetLastError(RtlNtStatusToDosError(Status));
-        return FALSE;
-    }
-
-    return TRUE;
+	return set_ntstatus( NtOpenThreadToken(ThreadHandle, DesiredAccess, OpenAsSelf, TokenHandle));
 }
 
 /*
@@ -626,26 +564,18 @@ FreeSid(PSID pSid)
     return RtlFreeSid(pSid);
 }
 
-/*
- * @implemented
+/******************************************************************************
+ * CopySid [ADVAPI32.@]
+ *
+ * PARAMS
+ *   nDestinationSidLength []
+ *   pDestinationSid       []
+ *   pSourceSid            []
  */
 BOOL WINAPI
-CopySid(DWORD nDestinationSidLength,
-        PSID pDestinationSid,
-        PSID pSourceSid)
+CopySid( DWORD nDestinationSidLength, PSID pDestinationSid, PSID pSourceSid )
 {
-    NTSTATUS Status;
-
-    Status = RtlCopySid(nDestinationSidLength,
-                        pDestinationSid,
-                        pSourceSid);
-    if (!NT_SUCCESS (Status))
-    {
-        SetLastError(RtlNtStatusToDosError(Status));
-        return FALSE;
-    }
-
-  return TRUE;
+	return set_ntstatus(RtlCopySid(nDestinationSidLength, pDestinationSid, pSourceSid));
 }
 
 /*
@@ -1093,25 +1023,12 @@ AddAce(PACL pAcl,
     return TRUE;
 }
 
-/*
- * @implemented
+/******************************************************************************
+ * DeleteAce [ADVAPI32.@]
  */
-BOOL
-WINAPI
-DeleteAce(PACL pAcl,
-          DWORD dwAceIndex)
+BOOL WINAPI DeleteAce(PACL pAcl, DWORD dwAceIndex)
 {
-    NTSTATUS Status;
-
-    Status = RtlDeleteAce(pAcl,
-                          dwAceIndex);
-    if (!NT_SUCCESS(Status))
-    {
-        SetLastError(RtlNtStatusToDosError(Status));
-        return FALSE;
-    }
-
-    return TRUE;
+    return set_ntstatus(RtlDeleteAce(pAcl, dwAceIndex));
 }
 
 /*
@@ -1126,53 +1043,25 @@ FindFirstFreeAce(PACL pAcl,
                            (PACE*)pAce);
 }
 
-
-/*
- * @implemented
+/******************************************************************************
+ * GetAce [ADVAPI32.@]
  */
-BOOL
-WINAPI
-GetAce(PACL pAcl,
-       DWORD dwAceIndex,
-       LPVOID *pAce)
+BOOL WINAPI GetAce(PACL pAcl,DWORD dwAceIndex,LPVOID *pAce )
 {
-    NTSTATUS Status;
-
-    Status = RtlGetAce(pAcl,
-                       dwAceIndex,
-                       pAce);
-    if (!NT_SUCCESS(Status))
-    {
-        SetLastError(RtlNtStatusToDosError(Status));
-        return FALSE;
-    }
-
-    return TRUE;
+    return set_ntstatus(RtlGetAce(pAcl, dwAceIndex, pAce));
 }
 
-/*
- * @implemented
+/******************************************************************************
+ * GetAclInformation [ADVAPI32.@]
  */
-BOOL
-WINAPI
-GetAclInformation(PACL pAcl,
-                  LPVOID pAclInformation,
-                  DWORD nAclInformationLength,
-                  ACL_INFORMATION_CLASS dwAclInformationClass)
+BOOL WINAPI GetAclInformation(
+  PACL pAcl,
+  LPVOID pAclInformation,
+  DWORD nAclInformationLength,
+  ACL_INFORMATION_CLASS dwAclInformationClass)
 {
-    NTSTATUS Status;
-
-    Status = RtlQueryInformationAcl(pAcl,
-                                    pAclInformation,
-                                    nAclInformationLength,
-                                    dwAclInformationClass);
-    if (!NT_SUCCESS(Status))
-    {
-        SetLastError(RtlNtStatusToDosError(Status));
-        return FALSE;
-    }
-
-    return TRUE;
+    return set_ntstatus(RtlQueryInformationAcl(pAcl, pAclInformation,
+                                               nAclInformationLength, dwAclInformationClass));
 }
 
 /*
@@ -2148,25 +2037,32 @@ BuildTrusteeWithNameW(PTRUSTEE_W pTrustee,
     pTrustee->ptstrName = name;
 }
 
-/******************************************************************************
- * GetTrusteeFormW [ADVAPI32.@]
- */
-TRUSTEE_FORM WINAPI
-GetTrusteeFormA(PTRUSTEE_A pTrustee)
-{
-    return pTrustee->TrusteeForm;
-}
-
-
-/******************************************************************************
- * GetTrusteeFormW [ADVAPI32.@]
- */
-TRUSTEE_FORM WINAPI
-GetTrusteeFormW(PTRUSTEE_W pTrustee)
-{
-    return pTrustee->TrusteeForm;
-}
-
+/****************************************************************************** 
+ * GetTrusteeFormA [ADVAPI32.@] 
+ */ 
+TRUSTEE_FORM WINAPI GetTrusteeFormA(PTRUSTEEA pTrustee) 
+{  
+    TRACE("(%p)\n", pTrustee); 
+  
+    if (!pTrustee) 
+        return TRUSTEE_BAD_FORM; 
+  
+    return pTrustee->TrusteeForm; 
+}  
+  
+/****************************************************************************** 
+ * GetTrusteeFormW [ADVAPI32.@] 
+ */ 
+TRUSTEE_FORM WINAPI GetTrusteeFormW(PTRUSTEEW pTrustee) 
+{  
+    TRACE("(%p)\n", pTrustee); 
+  
+    if (!pTrustee) 
+        return TRUSTEE_BAD_FORM; 
+  
+    return pTrustee->TrusteeForm; 
+}  
+  
 /******************************************************************************
  * GetTrusteeNameA [ADVAPI32.@]
  */
@@ -2342,6 +2238,9 @@ static BYTE ParseAceStringType(LPCWSTR* StringAcl)
     LPCWSTR szAcl = *StringAcl;
     const ACEFLAG *lpaf = AceType;
 
+    while (*szAcl == ' ')
+        szAcl++;
+
     while (lpaf->wstr &&
         (len = strlenW(lpaf->wstr)) &&
         strncmpW(lpaf->wstr, szAcl, len))
@@ -2350,7 +2249,7 @@ static BYTE ParseAceStringType(LPCWSTR* StringAcl)
     if (!lpaf->wstr)
         return 0;
 
-    *StringAcl += len;
+    *StringAcl = szAcl + len;
     return lpaf->value;
 }
 
@@ -2376,6 +2275,9 @@ static BYTE ParseAceStringFlags(LPCWSTR* StringAcl)
     BYTE flags = 0;
     LPCWSTR szAcl = *StringAcl;
 
+    while (*szAcl == ' ')
+        szAcl++;
+
     while (*szAcl != ';')
     {
         const ACEFLAG *lpaf = AceFlags;
@@ -2388,7 +2290,7 @@ static BYTE ParseAceStringFlags(LPCWSTR* StringAcl)
         if (!lpaf->wstr)
             return 0;
 
-        flags |= lpaf->value;
+	flags |= lpaf->value;
         szAcl += len;
     }
 
@@ -2400,25 +2302,62 @@ static BYTE ParseAceStringFlags(LPCWSTR* StringAcl)
 /******************************************************************************
  * ParseAceStringRights
  */
+static const ACEFLAG AceRights[] =
+{
+    { SDDL_GENERIC_ALL,     GENERIC_ALL },
+    { SDDL_GENERIC_READ,    GENERIC_READ },
+    { SDDL_GENERIC_WRITE,   GENERIC_WRITE },
+    { SDDL_GENERIC_EXECUTE, GENERIC_EXECUTE },
+
+    { SDDL_READ_CONTROL,    READ_CONTROL },
+    { SDDL_STANDARD_DELETE, DELETE },
+    { SDDL_WRITE_DAC,       WRITE_DAC },
+    { SDDL_WRITE_OWNER,     WRITE_OWNER },
+
+    { SDDL_READ_PROPERTY,   ADS_RIGHT_DS_READ_PROP},
+    { SDDL_WRITE_PROPERTY,  ADS_RIGHT_DS_WRITE_PROP},
+    { SDDL_CREATE_CHILD,    ADS_RIGHT_DS_CREATE_CHILD},
+    { SDDL_DELETE_CHILD,    ADS_RIGHT_DS_DELETE_CHILD},
+    { SDDL_LIST_CHILDREN,   ADS_RIGHT_ACTRL_DS_LIST},
+    { SDDL_SELF_WRITE,      ADS_RIGHT_DS_SELF},
+    { SDDL_LIST_OBJECT,     ADS_RIGHT_DS_LIST_OBJECT},
+    { SDDL_DELETE_TREE,     ADS_RIGHT_DS_DELETE_TREE},
+    { SDDL_CONTROL_ACCESS,  ADS_RIGHT_DS_CONTROL_ACCESS},
+
+    { SDDL_FILE_ALL,        FILE_ALL_ACCESS },
+    { SDDL_FILE_READ,       FILE_GENERIC_READ },
+    { SDDL_FILE_WRITE,      FILE_GENERIC_WRITE },
+    { SDDL_FILE_EXECUTE,    FILE_GENERIC_EXECUTE },
+
+    { SDDL_KEY_ALL,         KEY_ALL_ACCESS },
+    { SDDL_KEY_READ,        KEY_READ },
+    { SDDL_KEY_WRITE,       KEY_WRITE },
+    { SDDL_KEY_EXECUTE,     KEY_EXECUTE },
+    { NULL, 0 },
+};
+
 static DWORD ParseAceStringRights(LPCWSTR* StringAcl)
 {
     UINT len = 0;
     DWORD rights = 0;
     LPCWSTR szAcl = *StringAcl;
 
+    while (*szAcl == ' ')
+        szAcl++;
+
     if ((*szAcl == '0') && (*(szAcl + 1) == 'x'))
     {
         LPCWSTR p = szAcl;
 
-        while (*p && *p != ';')
+	while (*p && *p != ';')
             p++;
 
-        if (p - szAcl <= 10 /* 8 hex digits + "0x" */ )
-        {
-            rights = strtoulW(szAcl, NULL, 16);
-            szAcl = p;
-        }
-        else
+	if (p - szAcl <= 10 /* 8 hex digits + "0x" */ )
+	{
+	    rights = strtoulW(szAcl, NULL, 16);
+	    szAcl = p;
+	}
+	else
             WARN("Invalid rights string format: %s\n", debugstr_wn(szAcl, p - szAcl));
     }
     else
@@ -2428,16 +2367,16 @@ static DWORD ParseAceStringRights(LPCWSTR* StringAcl)
             const ACEFLAG *lpaf = AceRights;
 
             while (lpaf->wstr &&
-                   (len = strlenW(lpaf->wstr)) &&
-                   strncmpW(lpaf->wstr, szAcl, len))
-            {
-                lpaf++;
-            }
+               (len = strlenW(lpaf->wstr)) &&
+               strncmpW(lpaf->wstr, szAcl, len))
+	    {
+               lpaf++;
+	    }
 
             if (!lpaf->wstr)
                 return 0;
 
-            rights |= lpaf->value;
+	    rights |= lpaf->value;
             szAcl += len;
         }
     }
@@ -2452,11 +2391,8 @@ static DWORD ParseAceStringRights(LPCWSTR* StringAcl)
  * 
  * dacl_flags(string_ace1)(string_ace2)... (string_acen) 
  */
-static BOOL
-ParseStringAclToAcl(LPCWSTR StringAcl,
-                    LPDWORD lpdwFlags, 
-                    PACL pAcl,
-                    LPDWORD cBytes)
+static BOOL ParseStringAclToAcl(LPCWSTR StringAcl, LPDWORD lpdwFlags, 
+    PACL pAcl, LPDWORD cBytes)
 {
     DWORD val;
     DWORD sidlen;
@@ -2464,11 +2400,12 @@ ParseStringAclToAcl(LPCWSTR StringAcl,
     DWORD acesize = 0;
     DWORD acecount = 0;
     PACCESS_ALLOWED_ACE pAce = NULL; /* pointer to current ACE */
+    DWORD error = ERROR_INVALID_ACL;
 
     TRACE("%s\n", debugstr_w(StringAcl));
 
     if (!StringAcl)
-        return FALSE;
+	return FALSE;
 
     if (pAcl) /* pAce is only useful if we're setting values */
         pAce = (PACCESS_ALLOWED_ACE) (pAcl + 1);
@@ -2483,29 +2420,34 @@ ParseStringAclToAcl(LPCWSTR StringAcl,
 
         /* Parse ACE type */
         val = ParseAceStringType(&StringAcl);
-        if (pAce)
+	if (pAce)
             pAce->Header.AceType = (BYTE) val;
         if (*StringAcl != ';')
+        {
+            error = RPC_S_INVALID_STRING_UUID;
             goto lerr;
+        }
         StringAcl++;
 
         /* Parse ACE flags */
-        val = ParseAceStringFlags(&StringAcl);
-        if (pAce)
+	val = ParseAceStringFlags(&StringAcl);
+	if (pAce)
             pAce->Header.AceFlags = (BYTE) val;
         if (*StringAcl != ';')
             goto lerr;
         StringAcl++;
 
         /* Parse ACE rights */
-        val = ParseAceStringRights(&StringAcl);
-        if (pAce)
+	val = ParseAceStringRights(&StringAcl);
+	if (pAce)
             pAce->Mask = val;
         if (*StringAcl != ';')
             goto lerr;
         StringAcl++;
 
         /* Parse ACE object guid */
+        while (*StringAcl == ' ')
+            StringAcl++;
         if (*StringAcl != ';')
         {
             FIXME("Support for *_OBJECT_ACE_TYPE not implemented\n");
@@ -2514,6 +2456,8 @@ ParseStringAclToAcl(LPCWSTR StringAcl,
         StringAcl++;
 
         /* Parse ACE inherit object guid */
+        while (*StringAcl == ' ')
+            StringAcl++;
         if (*StringAcl != ';')
         {
             FIXME("Support for *_OBJECT_ACE_TYPE not implemented\n");
@@ -2523,10 +2467,10 @@ ParseStringAclToAcl(LPCWSTR StringAcl,
 
         /* Parse ACE account sid */
         if (ParseStringSidToSid(StringAcl, pAce ? &pAce->SidStart : NULL, &sidlen))
-        {
+	{
             while (*StringAcl && *StringAcl != ')')
                 StringAcl++;
-        }
+	}
 
         if (*StringAcl != ')')
             goto lerr;
@@ -2561,7 +2505,7 @@ ParseStringAclToAcl(LPCWSTR StringAcl,
     return TRUE;
 
 lerr:
-    SetLastError(ERROR_INVALID_ACL);
+    SetLastError(error);
     WARN("Invalid ACE string format\n");
     return FALSE;
 }
@@ -2570,10 +2514,10 @@ lerr:
 /******************************************************************************
  * ParseStringSecurityDescriptorToSecurityDescriptor
  */
-static BOOL
-ParseStringSecurityDescriptorToSecurityDescriptor(LPCWSTR StringSecurityDescriptor,
-                                                  SECURITY_DESCRIPTOR_RELATIVE* SecurityDescriptor,
-                                                  LPDWORD cBytes)
+static BOOL ParseStringSecurityDescriptorToSecurityDescriptor(
+    LPCWSTR StringSecurityDescriptor,
+    SECURITY_DESCRIPTOR_RELATIVE* SecurityDescriptor,
+    LPDWORD cBytes)
 {
     BOOL bret = FALSE;
     WCHAR toktype;
@@ -2587,25 +2531,28 @@ ParseStringSecurityDescriptorToSecurityDescriptor(LPCWSTR StringSecurityDescript
     if (SecurityDescriptor)
         lpNext = (LPBYTE)(SecurityDescriptor + 1);
 
+    while (*StringSecurityDescriptor == ' ')
+        StringSecurityDescriptor++;
+
     while (*StringSecurityDescriptor)
     {
         toktype = *StringSecurityDescriptor;
 
-        /* Expect char identifier followed by ':' */
-        StringSecurityDescriptor++;
+	/* Expect char identifier followed by ':' */
+	StringSecurityDescriptor++;
         if (*StringSecurityDescriptor != ':')
         {
             SetLastError(ERROR_INVALID_PARAMETER);
             goto lend;
         }
-        StringSecurityDescriptor++;
+	StringSecurityDescriptor++;
 
-        /* Extract token */
-        lptoken = StringSecurityDescriptor;
-        while (*lptoken && *lptoken != ':')
+	/* Extract token */
+	lptoken = StringSecurityDescriptor;
+	while (*lptoken && *lptoken != ':')
             lptoken++;
 
-        if (*lptoken)
+	if (*lptoken)
             lptoken--;
 
         len = lptoken - StringSecurityDescriptor;
@@ -2613,7 +2560,7 @@ ParseStringSecurityDescriptorToSecurityDescriptor(LPCWSTR StringSecurityDescript
         tok[len] = 0;
 
         switch (toktype)
-        {
+	{
             case 'O':
             {
                 DWORD bytes;
@@ -2627,7 +2574,7 @@ ParseStringSecurityDescriptorToSecurityDescriptor(LPCWSTR StringSecurityDescript
                     lpNext += bytes; /* Advance to next token */
                 }
 
-                *cBytes += bytes;
+		*cBytes += bytes;
 
                 break;
             }
@@ -2645,13 +2592,13 @@ ParseStringSecurityDescriptorToSecurityDescriptor(LPCWSTR StringSecurityDescript
                     lpNext += bytes; /* Advance to next token */
                 }
 
-                *cBytes += bytes;
+		*cBytes += bytes;
 
                 break;
             }
 
             case 'D':
-            {
+	    {
                 DWORD flags;
                 DWORD bytes;
 
@@ -2663,11 +2610,11 @@ ParseStringSecurityDescriptorToSecurityDescriptor(LPCWSTR StringSecurityDescript
                     SecurityDescriptor->Control |= SE_DACL_PRESENT | flags;
                     SecurityDescriptor->Dacl = lpNext - (LPBYTE)SecurityDescriptor;
                     lpNext += bytes; /* Advance to next token */
-                }
+		}
 
-                *cBytes += bytes;
+		*cBytes += bytes;
 
-                break;
+		break;
             }
 
             case 'S':
@@ -2683,18 +2630,18 @@ ParseStringSecurityDescriptorToSecurityDescriptor(LPCWSTR StringSecurityDescript
                     SecurityDescriptor->Control |= SE_SACL_PRESENT | flags;
                     SecurityDescriptor->Sacl = lpNext - (LPBYTE)SecurityDescriptor;
                     lpNext += bytes; /* Advance to next token */
-                }
+		}
 
-                *cBytes += bytes;
+		*cBytes += bytes;
 
-                break;
+		break;
             }
 
             default:
                 FIXME("Unknown token\n");
                 SetLastError(ERROR_INVALID_PARAMETER);
-                goto lend;
-        }
+		goto lend;
+	}
 
         StringSecurityDescriptor = lptoken;
     }
@@ -3214,162 +3161,49 @@ ConvertSecurityDescriptorToStringSecurityDescriptorA(PSECURITY_DESCRIPTOR Securi
     }
 }
 
-/*
- * @implemented
+/******************************************************************************
+ * ConvertStringSidToSidW [ADVAPI32.@]
  */
-BOOL
-WINAPI
-ConvertStringSidToSidW(IN LPCWSTR StringSid,
-                       OUT PSID* sid)
+BOOL WINAPI ConvertStringSidToSidW(LPCWSTR StringSid, PSID* Sid)
 {
-    DWORD size;
-    DWORD i, cBytes, identAuth, csubauth;
-    BOOL ret;
-    SID* pisid;
+    BOOL bret = FALSE;
+    DWORD cBytes;
 
-    TRACE("%s %p\n", debugstr_w(StringSid), sid);
-
-    if (!StringSid)
-    {
-        SetLastError(ERROR_INVALID_SID);
-        return FALSE;
-    }
-
-    for (i = 0; i < sizeof(SidTable) / sizeof(SidTable[0]) - 1; i++)
-    {
-        if (wcscmp(StringSid, SidTable[i].key) == 0)
-        {
-            WELL_KNOWN_SID_TYPE knownSid = (WELL_KNOWN_SID_TYPE)SidTable[i].value;
-            size = SECURITY_MAX_SID_SIZE;
-            *sid = LocalAlloc(0, size);
-            if (!*sid)
-            {
-                SetLastError(ERROR_NOT_ENOUGH_MEMORY);
-                return FALSE;
-            }
-            ret = CreateWellKnownSid(knownSid,
-                                     NULL,
-                                     *sid,
-                                     &size);
-            if (!ret)
-            {
-                SetLastError(ERROR_INVALID_SID);
-                LocalFree(*sid);
-            }
-            return ret;
-        }
-    }
-
-    /* That's probably a string S-R-I-S-S... */
-    if (StringSid[0] != 'S' || StringSid[1] != '-')
-    {
-        SetLastError(ERROR_INVALID_SID);
-        return FALSE;
-    }
-
-    cBytes = ComputeStringSidSize(StringSid);
-    pisid = (SID*)LocalAlloc( 0, cBytes );
-    if (!pisid)
-    {
-        SetLastError(ERROR_NOT_ENOUGH_MEMORY);
-        return FALSE;
-    }
-    i = 0;
-    ret = FALSE;
-    csubauth = ((cBytes - GetSidLengthRequired(0)) / sizeof(DWORD));
-
-    StringSid += 2; /* Advance to Revision */
-    pisid->Revision = atoiW(StringSid);
-
-    if (pisid->Revision != SDDL_REVISION)
-    {
-        TRACE("Revision %d is unknown\n", pisid->Revision);
-        goto lend; /* ERROR_INVALID_SID */
-    }
-    if (csubauth == 0)
-    {
-        TRACE("SubAuthorityCount is 0\n");
-        goto lend; /* ERROR_INVALID_SID */
-    }
-
-    pisid->SubAuthorityCount = csubauth;
-
-    /* Advance to identifier authority */
-    while (*StringSid && *StringSid != '-')
-        StringSid++;
-    if (*StringSid == '-')
-        StringSid++;
-
-    /* MS' implementation can't handle values greater than 2^32 - 1, so
-     * we don't either; assume most significant bytes are always 0
-     */
-    pisid->IdentifierAuthority.Value[0] = 0;
-    pisid->IdentifierAuthority.Value[1] = 0;
-    identAuth = atoiW(StringSid);
-    pisid->IdentifierAuthority.Value[5] = identAuth & 0xff;
-    pisid->IdentifierAuthority.Value[4] = (identAuth & 0xff00) >> 8;
-    pisid->IdentifierAuthority.Value[3] = (identAuth & 0xff0000) >> 16;
-    pisid->IdentifierAuthority.Value[2] = (identAuth & 0xff000000) >> 24;
-
-    /* Advance to first sub authority */
-    while (*StringSid && *StringSid != '-')
-        StringSid++;
-    if (*StringSid == '-')
-        StringSid++;
-
-    while (*StringSid)
-    {
-        pisid->SubAuthority[i++] = atoiW(StringSid);
-
-        while (*StringSid && *StringSid != '-')
-            StringSid++;
-        if (*StringSid == '-')
-            StringSid++;
-    }
-
-    if (i != pisid->SubAuthorityCount)
-        goto lend; /* ERROR_INVALID_SID */
-
-    *sid = pisid;
-    ret = TRUE;
-
-lend:
-    if (!ret)
-    {
-        LocalFree(pisid);
-        SetLastError(ERROR_INVALID_SID);
-    }
-
-    TRACE("returning %s\n", ret ? "TRUE" : "FALSE");
-    return ret;
-}
-
-/*
- * @implemented
- */
-BOOL
-WINAPI
-ConvertStringSidToSidA(IN LPCSTR StringSid,
-                       OUT PSID* sid)
-{
-    BOOL bRetVal = FALSE;
-
-    TRACE("%s, %p\n", debugstr_a(StringSid), sid);
+    TRACE("%s, %p\n", debugstr_w(StringSid), Sid);
     if (GetVersion() & 0x80000000)
         SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
-    else if (!StringSid || !sid)
+    else if (!StringSid || !Sid)
+        SetLastError(ERROR_INVALID_PARAMETER);
+    else if (ParseStringSidToSid(StringSid, NULL, &cBytes))
+    {
+        PSID pSid = *Sid = LocalAlloc(0, cBytes);
+
+        bret = ParseStringSidToSid(StringSid, pSid, &cBytes);
+        if (!bret)
+            LocalFree(*Sid); 
+    }
+    return bret;
+}
+
+/******************************************************************************
+ * ConvertStringSidToSidA [ADVAPI32.@]
+ */
+BOOL WINAPI ConvertStringSidToSidA(LPCSTR StringSid, PSID* Sid)
+{
+    BOOL bret = FALSE;
+
+    TRACE("%s, %p\n", debugstr_a(StringSid), Sid);
+    if (GetVersion() & 0x80000000)
+        SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
+    else if (!StringSid || !Sid)
         SetLastError(ERROR_INVALID_PARAMETER);
     else
     {
-        UINT len = MultiByteToWideChar(CP_ACP, 0, StringSid, -1, NULL, 0);
-        LPWSTR wStringSid = HeapAlloc(GetProcessHeap(), 0, len * sizeof(WCHAR));
-        if (wStringSid == NULL)
-            return FALSE;
-        MultiByteToWideChar(CP_ACP, 0, StringSid, - 1, wStringSid, len);
-        bRetVal = ConvertStringSidToSidW(wStringSid, sid);
-        HeapFree(GetProcessHeap(), 0, wStringSid);
+        WCHAR *wStringSid = SERV_dup(StringSid);
+        bret = ConvertStringSidToSidW(wStringSid, Sid);
+        heap_free(wStringSid);
     }
-    return bRetVal;
+    return bret;
 }
 
 /*
@@ -3611,6 +3445,15 @@ static DWORD ComputeStringSidSize(LPCWSTR StringSid)
         for (i = 0; i < sizeof(WellKnownSids)/sizeof(WellKnownSids[0]); i++)
             if (!strncmpW(WellKnownSids[i].wstr, StringSid, 2))
                 return GetSidLengthRequired(WellKnownSids[i].Sid.SubAuthorityCount);
+
+        for (i = 0; i < sizeof(WellKnownRids)/sizeof(WellKnownRids[0]); i++)
+            if (!strncmpW(WellKnownRids[i].wstr, StringSid, 2))
+            {
+                MAX_SID local;
+                ADVAPI_GetComputerSid(&local);
+                return GetSidLengthRequired(*GetSidSubAuthorityCount(&local) + 1);
+            }
+
     }
 
     return GetSidLengthRequired(0);
@@ -3635,10 +3478,13 @@ static BOOL ParseStringSidToSid(LPCWSTR StringSid, PSID pSid, LPDWORD cBytes)
     while (*StringSid == ' ')
         StringSid++;
 
+    if (!*StringSid)
+        goto lend; /* ERROR_INVALID_SID */
+
     *cBytes = ComputeStringSidSize(StringSid);
     if (!pisid) /* Simply compute the size */
     {
-        TRACE("only size requested, returning TRUE\n");
+        TRACE("only size requested, returning TRUE with %d\n", *cBytes);
         return TRUE;
     }
 
@@ -3717,6 +3563,15 @@ static BOOL ParseStringSidToSid(LPCWSTR StringSid, PSID pSid, LPDWORD cBytes)
                 bret = TRUE;
             }
 
+        for (i = 0; i < sizeof(WellKnownRids)/sizeof(WellKnownRids[0]); i++)
+            if (!strncmpW(WellKnownRids[i].wstr, StringSid, 2))
+            {
+                ADVAPI_GetComputerSid(pisid);
+                pisid->SubAuthority[pisid->SubAuthorityCount] = WellKnownRids[i].Rid;
+                pisid->SubAuthorityCount++;
+                bret = TRUE;
+            }
+
         if (!bret)
             FIXME("String constant not supported: %s\n", debugstr_wn(StringSid, 2));
     }
diff --git a/dll/win32/kernel32/client/file/mntpoint.c b/dll/win32/kernel32/client/file/mntpoint.c
index af0ae94df2f..c6beae048be 100644
--- a/dll/win32/kernel32/client/file/mntpoint.c
+++ b/dll/win32/kernel32/client/file/mntpoint.c
@@ -118,14 +118,15 @@ GetVolumeNameForVolumeMountPointW(IN LPCWSTR VolumeMountPoint,
                                      NULL, 0, MountDevName, BufferLength);
       if (!NT_SUCCESS(Status))
       {
-         RtlFreeHeap(GetProcessHeap(), 0, MountDevName);
          if (Status == STATUS_BUFFER_OVERFLOW)
          {
             BufferLength = sizeof(MOUNTDEV_NAME) + MountDevName->NameLength;
+            RtlFreeHeap(GetProcessHeap(), 0, MountDevName);
             continue;
          }
          else
          {
+            RtlFreeHeap(GetProcessHeap(), 0, MountDevName);
             NtClose(FileHandle);
             BaseSetLastNTError(Status);
             return FALSE;
diff --git a/dll/win32/kernel32/client/resntfy.c b/dll/win32/kernel32/client/resntfy.c
index fec93d43be4..2f2e0fde090 100644
--- a/dll/win32/kernel32/client/resntfy.c
+++ b/dll/win32/kernel32/client/resntfy.c
@@ -41,7 +41,7 @@ CreateMemoryResourceNotification(IN MEMORY_RESOURCE_NOTIFICATION_TYPE Notificati
     InitializeObjectAttributes(&ObjectAttributes,
                                &EventName,
                                0,
-                               BaseGetNamedObjectDirectory(),
+                               NULL,
                                NULL);
 
     Status = NtOpenEvent(&hEvent,
diff --git a/dll/win32/rasdlg/lang/tr-TR.rc b/dll/win32/rasdlg/lang/tr-TR.rc
index 13cfa52913d..1e3f3b15f67 100644
--- a/dll/win32/rasdlg/lang/tr-TR.rc
+++ b/dll/win32/rasdlg/lang/tr-TR.rc
@@ -46,7 +46,7 @@ BEGIN
     AUTOCHECKBOX "&İleride, Olmayan Geçekleri Deneme", 1030, 38, 226, 222, 10
     DEFPUSHBUTTON "&Onayla", 1, 135, 242, 60, 14
     PUSHBUTTON "&Ertele", 2, 201, 242, 60, 14
-    LTEXT "Eğer yalnızca bir tek geçek bağlıysa sunucu çoklu bağlantılı aramaları kabul etmeye yapılandırılmamış olabilir. Böyle bir durumda gereksiz bağlantı görevlerinden kaçınmak için ""İleride, Olmayan Geçekleri Deneme""yi imleyiniz.", -1, 37, 36, 224, 44
+    LTEXT "Eğer yalnızca bir tek geçek bağlıysa sunucu çoklu bağlantılı aramaları kabul etmeye yapılandırılmamış olabilir. Böyle bir durumda gereksiz bağlantı yüklerinden kaçınmak için ""İleride, Olmayan Geçekleri Deneme""yi imleyiniz.", -1, 37, 36, 224, 44
 END
 
 105 DIALOGEX 0, 0, 261, 253
@@ -366,145 +366,145 @@ END
 
 125 DIALOGEX 12, 16, 261, 190
 STYLE DS_SHELLFONT | DS_MODALFRAME | WS_POPUPWINDOW | WS_VISIBLE | WS_CAPTION
-CAPTION "Modem Configuration"
+CAPTION "Çevirge Yapılandırılması"
 FONT 8, "MS Shell Dlg"
 BEGIN
     ICON 15102, 1238, 7, 7, 20, 20
-    LTEXT "Modem", -1, 25, 27, 24, 8, NOT WS_VISIBLE | NOT WS_GROUP
+    LTEXT "Çevirge", -1, 25, 27, 24, 8, NOT WS_VISIBLE | NOT WS_GROUP
     EDITTEXT 1235, 40, 7, 214, 16, ES_AUTOHSCROLL | ES_READONLY | NOT WS_BORDER
-    LTEXT "&Maximum speed (bps):", 1243, 7, 36, 110, 8
+    LTEXT "E&n Çok Hız (bps):", 1243, 7, 36, 110, 8
     COMBOBOX 1239, 119, 34, 136, 186, CBS_DROPDOWNLIST | CBS_AUTOHSCROLL | WS_VSCROLL | NOT WS_TABSTOP
-    LTEXT "Modem &protocol", 1244, 7, 52, 111, 8
+    LTEXT "&Çevirge İletişim Kâidesi", 1244, 7, 52, 111, 8
     COMBOBOX 1245, 119, 50, 136, 186, CBS_DROPDOWNLIST | CBS_AUTOHSCROLL | WS_VSCROLL | NOT WS_TABSTOP
-    GROUPBOX "Hardware features", 1237, 6, 70, 248, 61, WS_GROUP
-    AUTOCHECKBOX "E&nable hardware flow control", 1232, 19, 82, 217, 10, BS_TOP | BS_MULTILINE
-    AUTOCHECKBOX "En&able modem error control", 1231, 19, 98, 217, 10, BS_TOP | BS_MULTILINE
-    AUTOCHECKBOX "Enable m&odem compression", 1229, 19, 115, 217, 10, BS_TOP | BS_MULTILINE
-    AUTOCHECKBOX "&Show terminal window", 1234, 8, 136, 246, 10, BS_TOP | BS_MULTILINE
-    AUTOCHECKBOX "Enable mo&dem speaker", 1230, 8, 151, 247, 10, BS_TOP | BS_MULTILINE | WS_GROUP
-    DEFPUSHBUTTON "OK", 1, 129, 171, 60, 14, WS_GROUP
-    PUSHBUTTON "Cancel", 2, 194, 171, 60, 14
+    GROUPBOX "Donanım Husûsiyetleri", 1237, 6, 70, 248, 61, WS_GROUP
+    AUTOCHECKBOX "&Donanım Akış Denetimini Etkinleştir", 1232, 19, 82, 217, 10, BS_TOP | BS_MULTILINE
+    AUTOCHECKBOX "Ç&evirge Yanlışlık Denetimini Etkinleştir", 1231, 19, 98, 217, 10, BS_TOP | BS_MULTILINE
+    AUTOCHECKBOX "Çe&virge Sıkıştırmasını Etkinleştir", 1229, 19, 115, 217, 10, BS_TOP | BS_MULTILINE
+    AUTOCHECKBOX "&Uçbirim Penceresini Göster", 1234, 8, 136, 246, 10, BS_TOP | BS_MULTILINE
+    AUTOCHECKBOX "Çev&irge Hoparlörünü Etkinleştir", 1230, 8, 151, 247, 10, BS_TOP | BS_MULTILINE | WS_GROUP
+    DEFPUSHBUTTON "Tamam", 1, 129, 171, 60, 14, WS_GROUP
+    PUSHBUTTON "İptal", 2, 194, 171, 60, 14
 END
 
 126 DIALOGEX 0, 0, 270, 117
 STYLE DS_SHELLFONT | DS_MODALFRAME | WS_POPUPWINDOW | WS_CAPTION
-CAPTION "Select Network Component Type"
+CAPTION "Ağ Bileşeni Türünü Seç"
 FONT 8, "MS Shell Dlg"
 BEGIN
-    LTEXT "Click the type of network component you want to install:", -1, 8, 7, 258, 8
+    LTEXT "Kurmak istediğiniz ağ bileşeninin türünü tıklayınız:", -1, 8, 7, 258, 8
     CONTROL "", 1251, "SYSLISTVIEW32", WS_BORDER | WS_TABSTOP | 0x0000C04D, 8, 20, 188, 58
     GROUPBOX "", -1, 8, 81, 188, 30
     LTEXT "", 1250, 12, 90, 177, 17
-    DEFPUSHBUTTON "&Add...", 1252, 205, 20, 60, 14
-    PUSHBUTTON "Cancel", 2, 205, 38, 60, 14
+    DEFPUSHBUTTON "&Ekle...", 1252, 205, 20, 60, 14
+    PUSHBUTTON "İptal", 2, 205, 38, 60, 14
 END
 
 127 DIALOGEX 16, 20, 260, 135
 STYLE DS_SHELLFONT | DS_MODALFRAME | WS_POPUPWINDOW | WS_VISIBLE | WS_CAPTION
-CAPTION "NetWare or Compatible Connections"
+CAPTION "NetWare veyâ Uyumlu Bağlantılar"
 FONT 8, "MS Shell Dlg"
 BEGIN
     ICON 32515, 1278, 7, 7, 21, 20, WS_GROUP
-    LTEXT "You have connections to a NetWare compatible network.  These connections will be closed when the PPP IPX connection is established.", 1279, 42, 7, 215, 37
-    LTEXT "Before dialing, to avoid data loss, either close all files using these connections or uncheck IPX on this entry's Network Protocol settings.", 1280, 42, 46, 215, 38, NOT WS_GROUP
-    AUTOCHECKBOX "&Do not display this message in the future", 1277, 42, 86, 215, 10, BS_TOP | BS_MULTILINE | WS_GROUP
-    DEFPUSHBUTTON "OK", 1, 65, 112, 60, 14, WS_GROUP
-    PUSHBUTTON "Cancel", 2, 134, 112, 60, 14
+    LTEXT "Bir NetWare uyumlu ağ için bağlantılarınız var. PPP IPX bağlantısı kurulduğunda bu bağlantılar kapatılacaktır.", 1279, 42, 7, 215, 37
+    LTEXT "Çevirmeden önce veri yitiminden kaçınmak için ya bu bağlantıları kullanan tüm kütükleri siliniz ya da bu girişin Ağ İletişim Kâidesi ayarlarında IPX'in imini kaldırınız.", 1280, 42, 46, 215, 38, NOT WS_GROUP
+    AUTOCHECKBOX "&Gelecekte Bu İletiyi Gösterme", 1277, 42, 86, 215, 10, BS_TOP | BS_MULTILINE | WS_GROUP
+    DEFPUSHBUTTON "Tamam", 1, 65, 112, 60, 14, WS_GROUP
+    PUSHBUTTON "İptal", 2, 134, 112, 60, 14
 END
 
 128 DIALOGEX 7, 22, 236, 90
 STYLE DS_SHELLFONT | DS_MODALFRAME | WS_POPUPWINDOW | WS_CAPTION
-CAPTION "Manual Dial"
+CAPTION "Elle Çevir"
 FONT 8, "MS Shell Dlg"
 BEGIN
-    LTEXT "Pick up the handset and dial (or ask the operator to dial).  After dialing is complete, click OK.  Listen to handset until silent, and then hang up.", 1281, 8, 8, 219, 32
-    LTEXT "Phone number:", 1282, 8, 46, 91, 8
+    LTEXT "Almacı kaldırınız ve çeviriniz (ya da çevirmek için işletmene sorunuz). Çevirme bitirildikten sonra Tamam'a tıklayınız. Almacı, sessiz olana dek dinleyniz, sonra erteleyiniz.", 1281, 8, 8, 219, 32
+    LTEXT "Telefon Numarası:", 1282, 8, 46, 91, 8
     LTEXT "", 1283, 103, 46, 126, 8, NOT WS_GROUP
-    DEFPUSHBUTTON "OK", 1, 104, 70, 60, 14, WS_GROUP
-    PUSHBUTTON "Cancel", 2, 168, 70, 60, 14
+    DEFPUSHBUTTON "Tamam", 1, 104, 70, 60, 14, WS_GROUP
+    PUSHBUTTON "İptal", 2, 168, 70, 60, 14
 END
 
 129 DIALOGEX 6, 20, 260, 85
 STYLE DS_SHELLFONT | DS_MODALFRAME | WS_POPUPWINDOW | WS_CAPTION
-CAPTION "Network Protocol Connection Result"
+CAPTION "Ağ İletişim Kâidesi Bağlantı Sonucu"
 FONT 8, "MS Shell Dlg"
 BEGIN
     ICON 32516, 1328, 7, 7, 21, 20, WS_GROUP
     LTEXT "", 1329, 38, 7, 216, 24, NOT WS_GROUP
-    AUTOCHECKBOX "&Do not request the failed protocols next time", 1327, 40, 44, 215, 10, BS_TOP | BS_MULTILINE | WS_GROUP
-    PUSHBUTTON "&Accept", 1, 129, 64, 60, 14
-    PUSHBUTTON "&Hang Up", 2, 193, 64, 60, 14
+    AUTOCHECKBOX "O&lmayan İletişim Kâidelerini Bir Dahaki Kezde İsteme", 1327, 40, 44, 215, 10, BS_TOP | BS_MULTILINE | WS_GROUP
+    PUSHBUTTON "&Onayla", 1, 129, 64, 60, 14
+    PUSHBUTTON "&Ertele", 2, 193, 64, 60, 14
 END
 
 133 DIALOGEX 6, 18, 231, 211
 STYLE DS_SHELLFONT | DS_MODALFRAME | WS_POPUPWINDOW | WS_VISIBLE | WS_CAPTION
-CAPTION "X.25 Logon Settings"
+CAPTION "X.25 Oturum Açma Ayarları"
 FONT 8, "MS Shell Dlg"
 BEGIN
-    LTEXT "Select your X.25 network provider and type the X.121 address of the remote server:", 1408, 7, 4, 220, 27
-    LTEXT "&Network:", 1410, 9, 35, 213, 8, NOT WS_GROUP
+    LTEXT "X.25 ağ sağlayıcınızı seçiniz ve uzak sunucunun X.121 adresini yazınız:", 1408, 7, 4, 220, 27
+    LTEXT "&Ağ:", 1410, 9, 35, 213, 8, NOT WS_GROUP
     COMBOBOX 1406, 9, 46, 215, 125, CBS_DROPDOWNLIST | CBS_SORT | WS_VSCROLL | NOT WS_TABSTOP
-    LTEXT "X.121&address:", 1407, 9, 66, 213, 8, NOT WS_GROUP
+    LTEXT "&X.121 Adresi:", 1407, 9, 66, 213, 8, NOT WS_GROUP
     EDITTEXT 1402, 8, 77, 215, 14, ES_AUTOHSCROLL
-    GROUPBOX "Optional", 1405, 8, 95, 215, 79
-    LTEXT "&User data:", 1411, 19, 109, 182, 8, NOT WS_GROUP
+    GROUPBOX "Seçimlik", 1405, 8, 95, 215, 79
+    LTEXT "&Kullanıcı Verisi:", 1411, 19, 109, 182, 8, NOT WS_GROUP
     EDITTEXT 1404, 19, 120, 193, 14, ES_AUTOHSCROLL
-    LTEXT "&Facilities:", 1409, 19, 138, 182, 8, NOT WS_GROUP
+    LTEXT "&Olanaklar:", 1409, 19, 138, 182, 8, NOT WS_GROUP
     EDITTEXT 1403, 19, 149, 193, 14, ES_AUTOHSCROLL
-    DEFPUSHBUTTON "OK", 1, 100, 189, 60, 14
-    PUSHBUTTON "Cancel", 2, 164, 189, 60, 14
+    DEFPUSHBUTTON "Tamam", 1, 100, 189, 60, 14
+    PUSHBUTTON "İptal", 2, 164, 189, 60, 14
 END
 
 146 DIALOGEX 6, 18, 230, 210
 STYLE DS_SHELLFONT | WS_CHILD | WS_VISIBLE | WS_CAPTION
-CAPTION "Autodial"
+CAPTION "Kendiliğinden Çevirme"
 FONT 8, "MS Shell Dlg"
 BEGIN
-    LTEXT "If you are disconnected from a network, autodial attempts to connect to a network whenever you try to access remote information.", -1, 7, 4, 219, 32
-    LTEXT "&Enable autodial by location:", 1006, 8, 42, 213, 8
+    LTEXT "Bir ağdan ayrıysanız ne zaman uzak bilgiye erişmeye çalıştığınız bir ağ için kendiliğinden çevirme bağlanmaya girişir.", -1, 7, 4, 219, 32
+    LTEXT "&Şu Konuma Göre Kendiliğinden Çevirmeyi Etkinleştir:", 1006, 8, 42, 213, 8
     CONTROL "", 1004, "SYSLISTVIEW32", WS_BORDER | WS_GROUP | WS_TABSTOP | 0x0000C401, 7, 53, 216, 109
-    AUTOCHECKBOX "Al&ways ask me before autodialing", 1496, 8, 170, 218, 9, BS_TOP | BS_MULTILINE
-    AUTOCHECKBOX "&Disable autodial while I am logged on", 1550, 8, 185, 217, 9, BS_TOP | BS_MULTILINE
+    AUTOCHECKBOX "&Kendiliğinden Çevirmeden Önce Tüm Zamanlarda Bana Sor", 1496, 8, 170, 218, 9, BS_TOP | BS_MULTILINE
+    AUTOCHECKBOX "&Ben Oturum Açtığım Sürede Kendiliğinden Çevirmeyi Edilginleştir", 1550, 8, 185, 217, 9, BS_TOP | BS_MULTILINE
 END
 
 147 DIALOGEX 6, 18, 230, 215
 STYLE DS_SHELLFONT | WS_CHILD | WS_VISIBLE | WS_CAPTION
-CAPTION "Dialing"
+CAPTION "Çevirme"
 FONT 8, "MS Shell Dlg"
 BEGIN
-    LTEXT "These preferences apply to 'Login using Dial-Up Networking' at Ctrl-Alt-Del login.  You, as an administrator, have access to this sheet.", 1007, 7, 4, 221, 40, NOT WS_GROUP
-    LTEXT "&Number of redial attempts:", 1005, 7, 55, 154, 8
+    LTEXT "Bu yeğlemeler; Denetim, Seçenek ve Silme oturum açmada ""Çevirmeli Ağ'ı kullanan oturum açmaya"" uygulanır. Sizin bir yönetici olarak bu sayfaya erişiminiz var.", 1007, 7, 4, 221, 40, NOT WS_GROUP
+    LTEXT "&Yeniden Çevirme Girişimlerinin Sayısı:", 1005, 7, 55, 154, 8
     EDITTEXT 1001, 164, 52, 60, 14, ES_AUTOHSCROLL
-    LTEXT "&Seconds between redial attempts:", 1009, 7, 73, 156, 8, NOT WS_GROUP
+    LTEXT "Y&eniden Çevirme Girişimleri Arasındaki Sâniyeler:", 1009, 7, 73, 156, 8, NOT WS_GROUP
     EDITTEXT 1003, 164, 70, 60, 14, ES_AUTOHSCROLL
-    LTEXT "I&dle seconds before hanging up:", 1008, 7, 91, 154, 8, NOT WS_GROUP
+    LTEXT "E&rtelemeden Önce Boşta Kalma Sâniyeleri:", 1008, 7, 91, 154, 8, NOT WS_GROUP
     EDITTEXT 1002, 164, 88, 60, 14, ES_AUTOHSCROLL
 END
 
 148 DIALOGEX 6, 18, 230, 215
 STYLE DS_SHELLFONT | WS_CHILD | WS_VISIBLE | WS_CAPTION
-CAPTION "Callback"
+CAPTION "Geri Arama"
 FONT 8, "MS Shell Dlg"
 BEGIN
-    LTEXT "When you dial into a server, it may offer to call you back to reduce your phone charges.  Specify whether you want callback.  (Callback is not supported for virtual private network (VPN) connections.)", 1043, 8, 4, 219, 43
-    AUTORADIOBUTTON "&No callback", 1041, 7, 48, 219, 10, BS_TOP | BS_MULTILINE | WS_GROUP
-    AUTORADIOBUTTON "A&sk me during dialing when the server offers", 1040, 7, 61, 219, 10, BS_TOP | BS_MULTILINE
-    AUTORADIOBUTTON "Al&ways call me back at the number(s) below:", 1042, 7, 74, 219, 10, BS_TOP | BS_MULTILINE
+    LTEXT "Bir sunucuya çevirdiğinizde o, telefonunuzun yükünü azaltmaya sizi yeniden aramak için sağlayabilir. Geri arama isteseniz de istemeseniz de belirtiniz. (Geri arama farazî ve şahsî ağ (VPN) bağlantıları için desteklenmiyor.)", 1043, 8, 4, 219, 43
+    AUTORADIOBUTTON "&Geri Arama Yok", 1041, 7, 48, 219, 10, BS_TOP | BS_MULTILINE | WS_GROUP
+    AUTORADIOBUTTON "S&unucu Sunduğunda Çevirme Esnâsında Bana Sor", 1040, 7, 61, 219, 10, BS_TOP | BS_MULTILINE
+    AUTORADIOBUTTON "&Beni Tüm Zamanalarda Aşağıdaki Numaralardan Geri Ara:", 1042, 7, 74, 219, 10, BS_TOP | BS_MULTILINE
     CONTROL "", 1037, "SYSLISTVIEW32", WS_BORDER | WS_GROUP | WS_TABSTOP | 0x00008401, 16, 88, 204, 94
-    PUSHBUTTON "&Edit...", 1039, 96, 190, 60, 14
-    PUSHBUTTON "&Delete", 1038, 159, 190, 60, 14
+    PUSHBUTTON "&Düzenle...", 1039, 96, 190, 60, 14
+    PUSHBUTTON "&Sil", 1038, 159, 190, 60, 14
 END
 
 149 DIALOGEX 6, 18, 317, 142
 STYLE DS_SHELLFONT | DS_MODALFRAME | WS_POPUP | WS_VISIBLE | WS_CAPTION
 FONT 8, "MS Shell Dlg"
 BEGIN
-    LTEXT "You need to set the dial-in credentials that remote routers will use when connecting to this interface. A user account will be created on this router with the information that you enter here.", 1094, 8, 5, 307, 35
-    LTEXT "&User name:", 1078, 8, 47, 124, 8, NOT WS_GROUP
+    LTEXT "Bu arayüz için bağlandığında kullanılacak uzak yönlendiriciler arama kimlik bilgilerini ayarlamaya gerksiniminiz var. Bu yönlendiricide buraya girdiğiniz bilgiyle bir kullanıcı hesâbı oluşturulacaktır.", 1094, 8, 5, 307, 35
+    LTEXT "&Kullanıcı Adı:", 1078, 8, 47, 124, 8, NOT WS_GROUP
     EDITTEXT 1074, 135, 45, 175, 12, ES_AUTOHSCROLL | WS_DISABLED
-    LTEXT "&Password:", 1077, 8, 68, 124, 8, NOT WS_GROUP
+    LTEXT "&Şifre:", 1077, 8, 68, 124, 8, NOT WS_GROUP
     EDITTEXT 1073, 135, 66, 175, 12, ES_PASSWORD | ES_AUTOHSCROLL
-    LTEXT "&Confirm password:", 1075, 8, 90, 124, 8, NOT WS_GROUP
+    LTEXT "Ş&ifreyi Doğrula:", 1075, 8, 90, 124, 8, NOT WS_GROUP
     EDITTEXT 1071, 135, 87, 175, 12, ES_PASSWORD | ES_AUTOHSCROLL
 END
 
@@ -512,14 +512,14 @@ END
 STYLE DS_SHELLFONT | DS_MODALFRAME | WS_POPUP | WS_VISIBLE | WS_CAPTION
 FONT 8, "MS Shell Dlg"
 BEGIN
-    LTEXT "You need to set the dial out credentials that this interface will use when connecting to the remote router.  These credentials must match the dial in credentials configured on the remote router.", 1094, 8, 5, 308, 33
-    LTEXT "&User name:", 1096, 8, 43, 130, 8, NOT WS_GROUP
+    LTEXT "Uzak yönlendiriciye bağlanırken bu arayüzün kullanacağı dışarıya arama kimlik bilgilerini ayarlamaya gereksiniminiz var. Bu kimlik bilgileri, uzak yönlendiricide yapılandırılmış içeriye arama kimlik bilgileriyle eşleşmelidir.", 1094, 8, 5, 308, 33
+    LTEXT "&Kullanıcı Adı:", 1096, 8, 43, 130, 8, NOT WS_GROUP
     EDITTEXT 1091, 140, 40, 175, 12, ES_AUTOHSCROLL
-    LTEXT "&Domain:", 1093, 8, 63, 130, 8, NOT WS_GROUP
+    LTEXT "&Etki Alanı:", 1093, 8, 63, 130, 8, NOT WS_GROUP
     EDITTEXT 1089, 140, 60, 175, 12, ES_UPPERCASE | ES_AUTOHSCROLL
-    LTEXT "&Password:", 1095, 8, 81, 130, 8, NOT WS_GROUP
+    LTEXT "&Şifre:", 1095, 8, 81, 130, 8, NOT WS_GROUP
     EDITTEXT 1090, 140, 78, 175, 12, ES_PASSWORD | ES_AUTOHSCROLL
-    LTEXT "&Confirm password:", 1092, 8, 99, 130, 8, NOT WS_GROUP
+    LTEXT "Ş&ifreyi Doğrula:", 1092, 8, 99, 130, 8, NOT WS_GROUP
     EDITTEXT 1088, 140, 96, 175, 12, ES_PASSWORD | ES_AUTOHSCROLL
 END
 
@@ -527,140 +527,140 @@ END
 STYLE DS_SHELLFONT | WS_CHILD | WS_DISABLED | WS_CAPTION
 FONT 8, "MS Shell Dlg"
 BEGIN
-    LTEXT "Type a name you want for this connection:", -1, 8, 4, 190, 8
+    LTEXT "Bu bağlantı için istediğiniz bir ad yazınız:", -1, 8, 4, 190, 8
     EDITTEXT 1114, 8, 17, 190, 12, ES_AUTOHSCROLL
-    LTEXT "Click Finish to save it in the Network Connections folder.", -1, 8, 38, 193, 8
-    LTEXT "To edit this connection later, select it, click the File menu, and then click Properties.", -1, 8, 58, 193, 16
+    LTEXT "Onu Ağ Bağlantıları dizini içine kaydetmek için Bitir'e tıklayınız.", -1, 8, 38, 193, 8
+    LTEXT "Bu bağlantıyı daha sonra düzenlemek için onu seçiniz, Kütük seçkesine tıklayınız, sonra Husûsiyetler'e tıklayınız.", -1, 8, 58, 193, 16
 END
 
 155 DIALOGEX 0, 0, 231, 215
 STYLE DS_SHELLFONT | DS_MODALFRAME | WS_POPUP | WS_CAPTION
-CAPTION "General"
+CAPTION "Umûmî"
 FONT 8, "MS Shell Dlg"
 BEGIN
-    LTEXT "Connec&t using:", 1124, 7, 5, 219, 8
+    LTEXT "&Bağlanırken Kullan:", 1124, 7, 5, 219, 8
     CONTROL "", 1128, "SYSLISTVIEW32", WS_BORDER | WS_TABSTOP | 0x00004C0D, 7, 17, 198, 44, WS_EX_CLIENTEDGE
-    PUSHBUTTON "&Up", 1132, 210, 18, 16, 14, BS_ICON
-    PUSHBUTTON "&Down", 1131, 210, 36, 16, 14, BS_ICON
-    AUTOCHECKBOX "A&ll devices call the same numbers", 1119, 9, 66, 133, 14, BS_TOP | BS_MULTILINE
-    PUSHBUTTON "C&onfigure...", 1130, 144, 66, 60, 14
-    GROUPBOX "Sample type", 1125, 8, 84, 215, 100, WS_GROUP
-    LTEXT "Ar&ea code:", 1133, 17, 102, 52, 8
+    PUSHBUTTON "&Yukarı", 1132, 210, 18, 16, 14, BS_ICON
+    PUSHBUTTON "&Aşağı", 1131, 210, 36, 16, 14, BS_ICON
+    AUTOCHECKBOX "&Tüm Aygıtlar Aynı Numaralardan Arasın", 1119, 9, 66, 133, 14, BS_TOP | BS_MULTILINE
+    PUSHBUTTON "Ya&pılandır...", 1130, 144, 66, 60, 14
+    GROUPBOX "Örnek Tür", 1125, 8, 84, 215, 100, WS_GROUP
+    LTEXT "A&lan Kodu:", 1133, 17, 102, 52, 8
     COMBOBOX 1122, 17, 112, 52, 110, CBS_DROPDOWN | WS_VSCROLL | NOT WS_TABSTOP
-    LTEXT "&Phone number:", 1135, 71, 102, 139, 8
+    LTEXT "T&elefon Numarası:", 1135, 71, 102, 139, 8
     EDITTEXT 1123, 73, 112, 79, 14, ES_AUTOHSCROLL
-    PUSHBUTTON "Alter&nates", 1129, 154, 112, 60, 14
-    LTEXT "Country/re&gion code:", 1134, 17, 132, 197, 8
+    PUSHBUTTON "Ba&şkaları", 1129, 154, 112, 60, 14
+    LTEXT "&Ülke ya da Bölge Kodu:", 1134, 17, 132, 197, 8
     COMBOBOX 1126, 17, 143, 193, 130, CBS_DROPDOWNLIST | CBS_SORT | WS_VSCROLL | NOT WS_TABSTOP
-    AUTOCHECKBOX "U&se dialing rules", 1121, 17, 163, 132, 14, BS_TOP | BS_MULTILINE
-    PUSHBUTTON "Dialing &Rules", 1136, 151, 161, 60, 14
-    AUTOCHECKBOX "Sho&w icon in notification area when connected", 1120, 10, 192, 214, 19, BS_TOP | BS_MULTILINE
+    AUTOCHECKBOX "&Çevirme Kâidelerini Kullan", 1121, 17, 163, 132, 14, BS_TOP | BS_MULTILINE
+    PUSHBUTTON "Çe&virme Kâideleri", 1136, 151, 161, 60, 14
+    AUTOCHECKBOX "Ba&ğlandığında Bildirim Alanında Simge Göster", 1120, 10, 192, 214, 19, BS_TOP | BS_MULTILINE
 END
 
 156 DIALOGEX 0, 0, 231, 215
 STYLE DS_SHELLFONT | DS_MODALFRAME | WS_POPUP | WS_CAPTION
-CAPTION "General"
+CAPTION "Umûmî"
 FONT 8, "MS Shell Dlg"
 BEGIN
-    PUSHBUTTON "C&onfigure...", 1130, 164, 38, 60, 14
-    GROUPBOX "Sample text", 1125, 8, 55, 217, 100, WS_GROUP
-    LTEXT "Ar&ea code:", 1133, 17, 72, 48, 8
+    PUSHBUTTON "&Yapılandır...", 1130, 164, 38, 60, 14
+    GROUPBOX "Örnek Metin", 1125, 8, 55, 217, 100, WS_GROUP
+    LTEXT "A&lan Kodu:", 1133, 17, 72, 48, 8
     COMBOBOX 1122, 17, 83, 48, 119, CBS_DROPDOWN | WS_VSCROLL | NOT WS_TABSTOP
-    LTEXT "&Phone number:", 1135, 71, 72, 146, 8
+    LTEXT "T&elefon Numarası:", 1135, 71, 72, 146, 8
     EDITTEXT 1123, 71, 83, 81, 14, ES_AUTOHSCROLL
-    PUSHBUTTON "Alter&nates", 1129, 155, 83, 63, 14
-    LTEXT "Country/re&gion code:", 1134, 17, 103, 193, 8
+    PUSHBUTTON "Ba&şkaları", 1129, 155, 83, 63, 14
+    LTEXT "&Ülke ya da Bölge Kodu:", 1134, 17, 103, 193, 8
     COMBOBOX 1126, 17, 114, 201, 130, CBS_DROPDOWNLIST | CBS_SORT | WS_VSCROLL | NOT WS_TABSTOP
-    AUTOCHECKBOX "U&se dialing rules", 1121, 19, 134, 136, 12, BS_TOP | BS_MULTILINE
-    PUSHBUTTON "Dialing &Rules", 1136, 157, 132, 60, 14
-    AUTOCHECKBOX "Sho&w icon in notification area when connected", 1120, 12, 164, 209, 18, BS_TOP | BS_MULTILINE
-    LTEXT "Connect using:", 1124, 8, 5, 217, 8
+    AUTOCHECKBOX "&Çevirme Kâidelerini Kullan", 1121, 19, 134, 136, 12, BS_TOP | BS_MULTILINE
+    PUSHBUTTON "Çe&virme Kâideleri", 1136, 157, 132, 60, 14
+    AUTOCHECKBOX "Ba&ğlandığında Bildirim Alanında Simge Göster", 1120, 12, 164, 209, 18, BS_TOP | BS_MULTILINE
+    LTEXT "&Bağlanırken Kullan:", 1124, 8, 5, 217, 8
     CONTROL "", 1127, "SYSLISTVIEW32", WS_DISABLED | WS_BORDER | 0x0000EC0D, 7, 18, 217, 15
 END
 
 157 DIALOGEX 6, 18, 235, 160
 STYLE DS_SHELLFONT | DS_MODALFRAME | WS_POPUPWINDOW | WS_VISIBLE | WS_CAPTION
-CAPTION "Appearance"
+CAPTION "Görünüm"
 FONT 8, "MS Shell Dlg"
 BEGIN
-    AUTOCHECKBOX "&Preview phone numbers before dialing", 1142, 8, 10, 224, 10, WS_GROUP
-    AUTOCHECKBOX "Show &location setting before dialing", 1139, 8, 27, 224, 10
-    AUTOCHECKBOX "Allo&w location edits during login", 1140, 21, 43, 212, 10
-    AUTOCHECKBOX "Show &connection progress while dialing", 1143, 8, 59, 224, 10
-    AUTOCHECKBOX "Clo&se on dial", 1137, 8, 76, 224, 10
-    AUTOCHECKBOX "All&ow phonebook edits during login", 1141, 8, 94, 224, 10
-    AUTOCHECKBOX "&Use wizard to create new phonebook entries", 1144, 22, 111, 210, 10
+    AUTOCHECKBOX "&Çevirmeden Önce Telefon Numaralarını Önceden Göster", 1142, 8, 10, 224, 10, WS_GROUP
+    AUTOCHECKBOX "Ç&evirmeden Önce Koum Ayârını Göster", 1139, 8, 27, 224, 10
+    AUTOCHECKBOX "&Oturum Açma Esnâsında Konum Düzenlemelerine İzin Ver", 1140, 21, 43, 212, 10
+    AUTOCHECKBOX "Çe&virirken Bağlantı İlerlemesini Göster", 1143, 8, 59, 224, 10
+    AUTOCHECKBOX "&Aramada Kapat", 1137, 8, 76, 224, 10
+    AUTOCHECKBOX "O&turum Açma Esnâsında Telefon Defteri Düzenlemelerine İzin Ver", 1141, 8, 94, 224, 10
+    AUTOCHECKBOX "&Yeni Telefon Defteri Girişlerini Oluşturmak İçin Yardımcı Kullan", 1144, 22, 111, 210, 10
 END
 
 158 DIALOGEX 6, 18, 235, 160
 STYLE DS_SHELLFONT | DS_MODALFRAME | WS_POPUPWINDOW | WS_VISIBLE | WS_CAPTION
-CAPTION "Appearance"
+CAPTION "Görünüm"
 FONT 8, "MS Shell Dlg"
 BEGIN
-    AUTOCHECKBOX "&Preview phone numbers before dialing", 1142, 8, 10, 223, 10, WS_GROUP
-    AUTOCHECKBOX "Show &location setting before dialing", 1139, 8, 27, 206, 10
-    AUTOCHECKBOX "Start dial-up networking &monitor before dialing", 1138, 8, 44, 226, 10
-    AUTOCHECKBOX "Show &connection progress while dialing", 1143, 8, 61, 224, 10
-    AUTOCHECKBOX "Clo&se on dial", 1137, 8, 79, 220, 10
-    AUTOCHECKBOX "&Use wizard to create new phonebook entries", 1144, 8, 97, 220, 10
-    AUTOCHECKBOX "Always prompt &before auto-dialing", 1136, 8, 114, 220, 10
+    AUTOCHECKBOX "&Çevirmeden Önce Telefon Numaralarını Önceden Göster", 1142, 8, 10, 223, 10, WS_GROUP
+    AUTOCHECKBOX "Ç&evirmeden Önce Koum Ayârını Göster", 1139, 8, 27, 206, 10
+    AUTOCHECKBOX "Çev&irmeden Önce Çevirmeli Ağ İzlemesini Başlat", 1138, 8, 44, 226, 10
+    AUTOCHECKBOX "Çe&virirken Bağlantı İlerlemesini Göster", 1143, 8, 61, 224, 10
+    AUTOCHECKBOX "&Aramada Kapat", 1137, 8, 79, 220, 10
+    AUTOCHECKBOX "&Yeni Telefon Defteri Girişlerini Oluşturmak İçin Yardımcı Kullan", 1144, 8, 97, 220, 10
+    AUTOCHECKBOX "&Kendiliğinden Çevirmeden Önce Tüm Zamanlarda Sor", 1136, 8, 114, 220, 10
 END
 
 160 DIALOGEX 6, 18, 320, 145
 STYLE DS_SHELLFONT | DS_MODALFRAME | WS_CHILD | WS_VISIBLE | WS_CAPTION
 FONT 8, "MS Shell Dlg"
 BEGIN
-    LTEXT "Select a name for this demand dial interface.  A common practice is to name interfaces after the network or router to which they connect.", 1158, 7, 5, 309, 29
-    LTEXT "&Interface name:", 1159, 17, 41, 285, 8, NOT WS_GROUP
+    LTEXT "Bu çevirme arayüzü isteği için bir ad seçiniz. Bağlanan yönlendirici ya da ağdan sonra arayüzleri adlandırmak bilinen bir uygulamadır.", 1158, 7, 5, 309, 29
+    LTEXT "&Arayüz Adı:", 1159, 17, 41, 285, 8, NOT WS_GROUP
     EDITTEXT 1157, 17, 53, 284, 12, ES_AUTOHSCROLL
-    AUTOCHECKBOX "I &know all about demand-dial interfaces and would rather edit the properties directly", 1156, 24, 100, 258, 31, BS_TOP | BS_MULTILINE | NOT WS_VISIBLE | WS_DISABLED
+    AUTOCHECKBOX "&Çevirme Arayüzleri İsteği Üzerine Tüm Şeyleri Biliyorum ve Husûsiyetleri Doğrudan Düzenlemeyi Yeğliyorum", 1156, 24, 100, 258, 31, BS_TOP | BS_MULTILINE | NOT WS_VISIBLE | WS_DISABLED
 END
 
 162 DIALOGEX 0, 0, 230, 215
 STYLE DS_SHELLFONT | WS_CHILD | WS_CAPTION
-CAPTION "Security"
+CAPTION "Güvenlik"
 FONT 8, "MS Shell Dlg"
 BEGIN
-    GROUPBOX "Security options", 1580, 8, 3, 215, 139
-    AUTORADIOBUTTON "&Typical (recommended settings)", 1540, 14, 16, 201, 9, BS_NOTIFY | WS_GROUP
-    AUTORADIOBUTTON "A&dvanced (custom settings)", 1541, 14, 102, 198, 8, BS_NOTIFY
-    LTEXT "&Validate my identity as follows:", 1537, 26, 29, 187, 8, NOT WS_GROUP
+    GROUPBOX "Güvenlik Seçenekleri", 1580, 8, 3, 215, 139
+    AUTORADIOBUTTON "&Tipik (Önerilen Ayarlar)", 1540, 14, 16, 201, 9, BS_NOTIFY | WS_GROUP
+    AUTORADIOBUTTON "&Gelişmiş (Husûsî Ayarlar)", 1541, 14, 102, 198, 8, BS_NOTIFY
+    LTEXT "&Kimliğimi Aşağıdaki Gibi Onayla:", 1537, 26, 29, 187, 8, NOT WS_GROUP
     COMBOBOX 1178, 26, 40, 184, 78, CBS_DROPDOWNLIST | CBS_AUTOHSCROLL | WS_VSCROLL | NOT WS_TABSTOP
-    AUTOCHECKBOX "A&utomatically use my ReactOS logon name and  password (and domain if any)", 1174, 26, 58, 184, 20, BS_TOP | BS_MULTILINE
-    AUTOCHECKBOX "Requ&ire data encryption (disconnect if none)", 1169, 26, 82, 183, 10, BS_TOP | BS_MULTILINE
-    LTEXT "Using these settings requires a knowledge of security protocols.", 1539, 15, 114, 134, 20
-    PUSHBUTTON "&Settings...", 1180, 151, 115, 60, 14
-    GROUPBOX "Interactive logon and scripting", 1177, 8, 146, 215, 62, WS_GROUP
-    AUTOCHECKBOX "S&how terminal window", 1173, 14, 159, 198, 11, BS_TOP | BS_MULTILINE
-    AUTOCHECKBOX "&Run script:", 1172, 14, 172, 57, 10, BS_TOP | BS_MULTILINE
+    AUTOCHECKBOX "&ReactOS Oturum Açma Adımı ve Şifremi Kendiliğinden Kullan (Eğer Varsa Etki Alanını Da)", 1174, 26, 58, 184, 20, BS_TOP | BS_MULTILINE
+    AUTOCHECKBOX "&Veri Sıkıştırmasını Gerektir (Eğer Yoksa Bağlantıyı Kes)", 1169, 26, 82, 183, 10, BS_TOP | BS_MULTILINE
+    LTEXT "Bu ayarları kullanmak güvenlik iletişim kâidelerinin bir bilgisini gerektirir.", 1539, 15, 114, 134, 20
+    PUSHBUTTON "&Ayarlar...", 1180, 151, 115, 60, 14
+    GROUPBOX "Etkileşimli Oturum Açma ve Betikleme", 1177, 8, 146, 215, 62, WS_GROUP
+    AUTOCHECKBOX "&Uçbirim Penceresini Göster", 1173, 14, 159, 198, 11, BS_TOP | BS_MULTILINE
+    AUTOCHECKBOX "&Betiği Çalıştır:", 1172, 14, 172, 57, 10, BS_TOP | BS_MULTILINE
     COMBOBOX 1179, 72, 171, 140, 104, CBS_DROPDOWN | CBS_AUTOHSCROLL | WS_VSCROLL | NOT WS_TABSTOP
-    PUSHBUTTON "&Edit...", 1182, 87, 187, 60, 14
-    PUSHBUTTON "&Browse...", 1181, 151, 187, 60, 14
+    PUSHBUTTON "&Düzenle...", 1182, 87, 187, 60, 14
+    PUSHBUTTON "G&öz At...", 1181, 151, 187, 60, 14
 END
 
 163 DIALOGEX 0, 0, 317, 143
 STYLE DS_SHELLFONT | WS_CHILD | WS_DISABLED | WS_CAPTION
 FONT 8, "MS Shell Dlg"
 BEGIN
-    LTEXT "You have more than one dial-up device on your computer.", -1, 6, 3, 307, 13
-    LTEXT "&Select the devices to use in this connection:", -1, 6, 15, 307, 11
+    LTEXT "Bilgisayarınızda birden çok çevirme aygıtınız var.", -1, 6, 3, 307, 13
+    LTEXT "&Bu bağlantıda kullanmak için aygıtları seçiniz:", -1, 6, 15, 307, 11
     CONTROL "", 1228, "SYSLISTVIEW32", WS_BORDER | WS_TABSTOP | 0x0000C415, 7, 28, 304, 77
 END
 
 165 DIALOGEX 0, 0, 230, 215
 STYLE DS_SHELLFONT | DS_MODALFRAME | WS_POPUPWINDOW | WS_CAPTION
-CAPTION "Networking"
+CAPTION "Ağ Kurma"
 FONT 8, "MS Shell Dlg"
 BEGIN
-    LTEXT "Typ&e of dial-up server I am calling:", 1583, 7, 4, 219, 8
+    LTEXT "&Aradığım Çevirme Sunucusunun Türü:", 1583, 7, 4, 219, 8
     COMBOBOX 1418, 7, 17, 215, 46, CBS_DROPDOWNLIST | WS_VSCROLL | NOT WS_TABSTOP
-    PUSHBUTTON "&Settings", 1419, 160, 35, 60, 14
-    LTEXT "This c&onnection uses the following items:", 1684, 8, 64, 219, 10
+    PUSHBUTTON "A&yarlar", 1419, 160, 35, 60, 14
+    LTEXT "&Bu Bağlantı Aşağıdaki Öğeleri Kullanır:", 1684, 8, 64, 219, 10
     CONTROL "", 1251, "SYSLISTVIEW32", WS_BORDER | WS_TABSTOP | 0x0000C40D, 7, 75, 216, 53
-    PUSHBUTTON "I&nstall...", 1252, 7, 133, 67, 14
-    PUSHBUTTON "&Uninstall", 1254, 80, 133, 67, 14
-    PUSHBUTTON "P&roperties", 1253, 153, 133, 67, 14
-    GROUPBOX "Description", 1585, 9, 158, 213, 43
+    PUSHBUTTON "&Kur...", 1252, 7, 133, 67, 14
+    PUSHBUTTON "Ka&ldır", 1254, 80, 133, 67, 14
+    PUSHBUTTON "&Husûsiyetler", 1253, 153, 133, 67, 14
+    GROUPBOX "Tanım", 1585, 9, 158, 213, 43
     LTEXT "", 1250, 18, 167, 195, 25
 END
 
diff --git a/drivers/bus/acpi/main.c b/drivers/bus/acpi/main.c
index afc9a1f2e4f..32b74c5d496 100644
--- a/drivers/bus/acpi/main.c
+++ b/drivers/bus/acpi/main.c
@@ -450,7 +450,7 @@ GetProcessorInformation(VOID)
     LPWSTR ProcessorVendorIdentifier = NULL;
     LPWSTR HardwareIdsBuffer = NULL;
     HANDLE ProcessorHandle = NULL;
-    ULONG Length, Level1Length = 0, Level2Length = 0, Level3Length = 0;
+    ULONG Length = 0, Level1Length = 0, Level2Length = 0, Level3Length = 0;
     SIZE_T HardwareIdsLength = 0;
     SIZE_T VendorIdentifierLength;
     ULONG i;
diff --git a/drivers/bus/pcix/fdo.c b/drivers/bus/pcix/fdo.c
index 77698b288ea..6d6e84e26fd 100644
--- a/drivers/bus/pcix/fdo.c
+++ b/drivers/bus/pcix/fdo.c
@@ -478,6 +478,8 @@ PciAddDevice(IN PDRIVER_OBJECT DriverObject,
     AttachedTo = NULL;
     FdoExtension = NULL;
     PdoExtension = NULL;
+    DeviceObject = NULL;
+
     do
     {
         /* Check if there's already a device extension for this bus */
diff --git a/drivers/filesystems/fastfat/create.c b/drivers/filesystems/fastfat/create.c
index 9352d1c0820..ffe23bc4edb 100644
--- a/drivers/filesystems/fastfat/create.c
+++ b/drivers/filesystems/fastfat/create.c
@@ -365,7 +365,7 @@ VfatOpenFile(
         DPRINT("'%wZ'\n", &FileObject->RelatedFileObject->FileName);
 
         *ParentFcb = FileObject->RelatedFileObject->FsContext;
-        (*ParentFcb)->RefCount++;
+        vfatGrabFCB(DeviceExt, *ParentFcb);
     }
     else
     {
@@ -391,7 +391,7 @@ VfatOpenFile(
 
     if (*ParentFcb)
     {
-        (*ParentFcb)->RefCount++;
+        vfatGrabFCB(DeviceExt, *ParentFcb);
     }
 
     /*  try first to find an existing FCB in memory  */
@@ -443,9 +443,9 @@ VfatCreateFile(
     PVFATFCB pFcb = NULL;
     PVFATFCB ParentFcb = NULL;
     PWCHAR c, last;
-    BOOLEAN PagingFileCreate = FALSE;
+    BOOLEAN PagingFileCreate;
     BOOLEAN Dots;
-    BOOLEAN OpenTargetDir = FALSE;
+    BOOLEAN OpenTargetDir;
     UNICODE_STRING FileNameU;
     UNICODE_STRING PathNameU;
     ULONG Attributes;
@@ -497,7 +497,7 @@ VfatCreateFile(
 
         pFcb = DeviceExt->VolumeFcb;
         vfatAttachFCBToFileObject(DeviceExt, pFcb, FileObject);
-        pFcb->RefCount++;
+        vfatGrabFCB(DeviceExt, pFcb);
 
         Irp->IoStatus.Information = FILE_OPENED;
         return STATUS_SUCCESS;
@@ -562,7 +562,7 @@ VfatCreateFile(
 
         if (Status == STATUS_SUCCESS)
         {
-            ParentFcb->RefCount++;
+            vfatGrabFCB(DeviceExt, ParentFcb);
             vfatReleaseFCB(DeviceExt, TargetFcb);
             Irp->IoStatus.Information = FILE_EXISTS;
         }
@@ -633,6 +633,7 @@ VfatCreateFile(
                                             FALSE);
                 if (!NT_SUCCESS(Status))
                 {
+                    vfatReleaseFCB(DeviceExt, ParentFcb);
                     VfatCloseFile(DeviceExt, FileObject);
                     return Status;
                 }
diff --git a/drivers/filesystems/fastfat/dir.c b/drivers/filesystems/fastfat/dir.c
index 57fda52556f..bf7dd1307da 100644
--- a/drivers/filesystems/fastfat/dir.c
+++ b/drivers/filesystems/fastfat/dir.c
@@ -504,6 +504,13 @@ DoQuery(
     DirContext.ShortNameU.Buffer = ShortNameBuffer;
     DirContext.ShortNameU.MaximumLength = sizeof(ShortNameBuffer);
 
+    if (!ExAcquireResourceExclusiveLite(&IrpContext->DeviceExt->DirResource,
+                                        (BOOLEAN)(IrpContext->Flags & IRPCONTEXT_CANWAIT)))
+    {
+        ExReleaseResourceLite(&pFcb->MainResource);
+        return VfatQueueRequest(IrpContext);
+    }
+
     while ((Status == STATUS_SUCCESS) && (BufferLength > 0))
     {
         Status = FindFile(IrpContext->DeviceExt,
@@ -579,6 +586,7 @@ DoQuery(
         IrpContext->Irp->IoStatus.Information = Stack->Parameters.QueryDirectory.Length - BufferLength;
     }
 
+    ExReleaseResourceLite(&IrpContext->DeviceExt->DirResource);
     ExReleaseResourceLite(&pFcb->MainResource);
 
     return Status;
diff --git a/drivers/filesystems/fastfat/direntry.c b/drivers/filesystems/fastfat/direntry.c
index 336f014ad5f..f3dc5b9fb06 100644
--- a/drivers/filesystems/fastfat/direntry.c
+++ b/drivers/filesystems/fastfat/direntry.c
@@ -201,6 +201,12 @@ FATGetNextDirEntry(
             CcUnpinData(*pContext);
         }
 
+        if (!pDirFcb->FileObject)
+        {
+            DPRINT1("Buggy FCB (cleaned up)! %S (%d / %u)\n", pDirFcb->PathNameBuffer, pDirFcb->RefCount, pDirFcb->OpenHandleCount);
+            return STATUS_NO_MORE_ENTRIES;
+        }
+
         if (FileOffset.u.LowPart >= pDirFcb->RFCB.FileSize.u.LowPart ||
             !CcMapData(pDirFcb->FileObject, &FileOffset, PAGE_SIZE, TRUE, pContext, pPage))
         {
diff --git a/drivers/filesystems/fastfat/dirwr.c b/drivers/filesystems/fastfat/dirwr.c
index 21b0e6945c0..e9622a846f1 100644
--- a/drivers/filesystems/fastfat/dirwr.c
+++ b/drivers/filesystems/fastfat/dirwr.c
@@ -167,6 +167,11 @@ vfatFindDirSpace(
             {
                 CcUnpinData(Context);
             }
+            if (!pDirFcb->FileObject)
+            {
+                DPRINT1("Buggy FCB (cleaned up)! %S (%d / %u)\n", pDirFcb->PathNameBuffer, pDirFcb->RefCount, pDirFcb->OpenHandleCount);
+                return FALSE;
+            }
             if (!CcPinRead(pDirFcb->FileObject, &FileOffset, DeviceExt->FatInfo.BytesPerCluster,
                       TRUE, &Context, (PVOID*)&pFatEntry))
             {
diff --git a/drivers/filesystems/fastfat/fcb.c b/drivers/filesystems/fastfat/fcb.c
index 251821bcf59..c698ba72efe 100644
--- a/drivers/filesystems/fastfat/fcb.c
+++ b/drivers/filesystems/fastfat/fcb.c
@@ -287,6 +287,16 @@ vfatFCBIsRoot(
     return FCB->PathNameU.Length == sizeof(WCHAR) && FCB->PathNameU.Buffer[0] == L'\\' ? TRUE : FALSE;
 }
 
+VOID
+vfatGrabFCB(
+    PDEVICE_EXTENSION pVCB,
+    PVFATFCB pFCB)
+{
+    ASSERT(ExIsResourceAcquiredExclusive(&pVCB->DirResource));
+
+    ++pFCB->RefCount;
+}
+
 VOID
 vfatReleaseFCB(
     PDEVICE_EXTENSION pVCB,
@@ -297,6 +307,8 @@ vfatReleaseFCB(
     DPRINT("releasing FCB at %p: %wZ, refCount:%d\n",
            pFCB, &pFCB->PathNameU, pFCB->RefCount);
 
+    ASSERT(ExIsResourceAcquiredExclusive(&pVCB->DirResource));
+
     while (pFCB)
     {
         pFCB->RefCount--;
@@ -338,7 +350,7 @@ vfatAddFCBToTable(
     }
     if (pFCB->parentFcb)
     {
-        pFCB->parentFcb->RefCount++;
+        vfatGrabFCB(pVCB, pFCB->parentFcb);
     }
 }
 
@@ -403,12 +415,6 @@ vfatUpdateFCB(
      */
     vfatReleaseFCB(pVCB, OldParent);
 
-    /* In case we were moving accross directories, reset caching on old parent */
-    //if (OldParent != ParentFcb)
-    //{
-    //    CcUninitializeCacheMap(OldParent->FileObject, NULL, NULL);
-    //}
-
     return STATUS_SUCCESS;
 }
 
@@ -455,7 +461,7 @@ vfatGrabFCBFromTable(
                 DPRINT("'%wZ' '%wZ'\n", &FileNameU, FcbNameU);
                 if (RtlEqualUnicodeString(&FileNameU, FcbNameU, TRUE))
                 {
-                    rcFCB->RefCount++;
+                    vfatGrabFCB(pVCB, rcFCB);
                     return rcFCB;
                 }
             }
@@ -489,7 +495,7 @@ vfatFCBInitializeCacheFromVolume(
     fileObject->FsContext = fcb;
     fileObject->FsContext2 = newCCB;
     fcb->FileObject = fileObject;
-    fcb->RefCount++;
+    vfatGrabFCB(vcb, fcb);
 
     _SEH2_TRY
     {
@@ -655,7 +661,7 @@ vfatMakeFCBFromDirEntry(
     rcFCB->RFCB.FileSize.QuadPart = Size;
     rcFCB->RFCB.ValidDataLength.QuadPart = Size;
     rcFCB->RFCB.AllocationSize.QuadPart = ROUND_UP(Size, vcb->FatInfo.BytesPerCluster);
-    rcFCB->RefCount++;
+    vfatGrabFCB(vcb, rcFCB);
     if (vfatFCBIsDirectory(rcFCB))
     {
         vfatFCBInitializeCacheFromVolume(vcb, rcFCB);
@@ -817,7 +823,7 @@ vfatGetFCBForFile(
         {
             *pFCB = FCB;
             *pParentFCB = FCB->parentFcb;
-            (*pParentFCB)->RefCount++;
+            vfatGrabFCB(pVCB, *pParentFCB);
             return STATUS_SUCCESS;
         }
 
diff --git a/drivers/filesystems/fastfat/finfo.c b/drivers/filesystems/fastfat/finfo.c
index 87a30843b4b..6ed6745e97b 100644
--- a/drivers/filesystems/fastfat/finfo.c
+++ b/drivers/filesystems/fastfat/finfo.c
@@ -400,6 +400,7 @@ vfatPrepareTargetForRename(
             /* If that's a directory or a read-only file, we're not allowed */
             if (vfatFCBIsDirectory(TargetFcb) || ((*TargetFcb->Attributes & FILE_ATTRIBUTE_READONLY) == FILE_ATTRIBUTE_READONLY));
             {
+                vfatReleaseFCB(DeviceExt, *ParentFCB);
                 *ParentFCB = NULL;
                 vfatReleaseFCB(DeviceExt, TargetFcb);
                 return STATUS_OBJECT_NAME_COLLISION;
@@ -408,6 +409,7 @@ vfatPrepareTargetForRename(
             /* Attempt to flush (might close the file) */
             if (!MmFlushImageSection(TargetFcb->FileObject->SectionObjectPointer, MmFlushForDelete))
             {
+                vfatReleaseFCB(DeviceExt, *ParentFCB);
                 *ParentFCB = NULL;
                 vfatReleaseFCB(DeviceExt, TargetFcb);
                 return STATUS_ACCESS_DENIED;
@@ -416,6 +418,7 @@ vfatPrepareTargetForRename(
             /* If we are, ensure the file isn't open by anyone! */
             if (TargetFcb->OpenHandleCount != 0)
             {
+                vfatReleaseFCB(DeviceExt, *ParentFCB);
                 *ParentFCB = NULL;
                 vfatReleaseFCB(DeviceExt, TargetFcb);
                 return STATUS_ACCESS_DENIED;
@@ -423,12 +426,13 @@ vfatPrepareTargetForRename(
 
             /* Effectively delete old file to allow renaming */
             VfatDelEntry(DeviceExt, TargetFcb, NULL);
-            (*ParentFCB)->RefCount++;
+            vfatGrabFCB(DeviceExt, *ParentFCB);
             vfatReleaseFCB(DeviceExt, TargetFcb);
             *Deleted = TRUE;
         }
         else
         {
+            vfatReleaseFCB(DeviceExt, *ParentFCB);
             *ParentFCB = NULL;
             vfatReleaseFCB(DeviceExt, TargetFcb);
             return STATUS_OBJECT_NAME_COLLISION;
@@ -451,7 +455,7 @@ NTSTATUS
 VfatSetRenameInformation(
     PFILE_OBJECT FileObject,
     PVFATFCB FCB,
-    PDEVICE_EXTENSION DeviceObject,
+    PDEVICE_EXTENSION DeviceExt,
     PFILE_RENAME_INFORMATION RenameInfo,
     PFILE_OBJECT TargetFileObject)
 {
@@ -469,8 +473,10 @@ VfatSetRenameInformation(
     OBJECT_ATTRIBUTES ObjectAttributes;
     HANDLE TargetHandle;
     BOOLEAN DeletedTarget;
+    ULONG OldReferences, NewReferences;
+    PVFATFCB OldParent;
 
-    DPRINT("VfatSetRenameInfo(%p, %p, %p, %p, %p)\n", FileObject, FCB, DeviceObject, RenameInfo, TargetFileObject);
+    DPRINT("VfatSetRenameInfo(%p, %p, %p, %p, %p)\n", FileObject, FCB, DeviceExt, RenameInfo, TargetFileObject);
 
     /* Disallow renaming root */
     if (vfatFCBIsRoot(FCB))
@@ -478,6 +484,8 @@ VfatSetRenameInformation(
         return STATUS_INVALID_PARAMETER;
     }
 
+    OldReferences = FCB->parentFcb->RefCount;
+
     /* If we are performing relative opening for rename, get FO for getting FCB and path name */
     if (RenameInfo->RootDirectory != NULL)
     {
@@ -682,13 +690,14 @@ VfatSetRenameInformation(
         if (FsRtlAreNamesEqual(&SourceFile, &NewFile, FALSE, NULL))
         {
             Status = STATUS_SUCCESS;
+            ASSERT(OldReferences == FCB->parentFcb->RefCount);
             goto Cleanup;
         }
 
         if (FsRtlAreNamesEqual(&SourceFile, &NewFile, TRUE, NULL))
         {
-            FsRtlNotifyFullReportChange(DeviceObject->NotifySync,
-                                        &(DeviceObject->NotifyList),
+            FsRtlNotifyFullReportChange(DeviceExt->NotifySync,
+                                        &(DeviceExt->NotifyList),
                                         (PSTRING)&FCB->PathNameU,
                                         FCB->PathNameU.Length - FCB->LongNameU.Length,
                                         NULL,
@@ -697,11 +706,11 @@ VfatSetRenameInformation(
                                         FILE_NOTIFY_CHANGE_DIR_NAME : FILE_NOTIFY_CHANGE_FILE_NAME),
                                         FILE_ACTION_RENAMED_OLD_NAME,
                                         NULL);
-            Status = vfatRenameEntry(DeviceObject, FCB, &NewFile, TRUE);
+            Status = vfatRenameEntry(DeviceExt, FCB, &NewFile, TRUE);
             if (NT_SUCCESS(Status))
             {
-                FsRtlNotifyFullReportChange(DeviceObject->NotifySync,
-                                            &(DeviceObject->NotifyList),
+                FsRtlNotifyFullReportChange(DeviceExt->NotifySync,
+                                            &(DeviceExt->NotifyList),
                                             (PSTRING)&FCB->PathNameU,
                                             FCB->PathNameU.Length - FCB->LongNameU.Length,
                                             NULL,
@@ -716,8 +725,8 @@ VfatSetRenameInformation(
         {
             /* Try to find target */
             ParentFCB = FCB->parentFcb;
-            ParentFCB->RefCount++;
-            Status = vfatPrepareTargetForRename(DeviceObject,
+            vfatGrabFCB(DeviceExt, ParentFCB);
+            Status = vfatPrepareTargetForRename(DeviceExt,
                                                 &ParentFCB,
                                                 &NewFile,
                                                 RenameInfo->ReplaceIfExists,
@@ -725,11 +734,13 @@ VfatSetRenameInformation(
                                                 &DeletedTarget);
             if (!NT_SUCCESS(Status))
             {
+                ASSERT(OldReferences == FCB->parentFcb->RefCount - 1);
+                ASSERT(OldReferences == ParentFCB->RefCount - 1);
                 goto Cleanup;
             }
 
-            FsRtlNotifyFullReportChange(DeviceObject->NotifySync,
-                                        &(DeviceObject->NotifyList),
+            FsRtlNotifyFullReportChange(DeviceExt->NotifySync,
+                                        &(DeviceExt->NotifyList),
                                         (PSTRING)&FCB->PathNameU,
                                         FCB->PathNameU.Length - FCB->LongNameU.Length,
                                         NULL,
@@ -738,13 +749,13 @@ VfatSetRenameInformation(
                                         FILE_NOTIFY_CHANGE_DIR_NAME : FILE_NOTIFY_CHANGE_FILE_NAME),
                                         (DeletedTarget ? FILE_ACTION_REMOVED : FILE_ACTION_RENAMED_OLD_NAME),
                                         NULL);
-            Status = vfatRenameEntry(DeviceObject, FCB, &NewFile, FALSE);
+            Status = vfatRenameEntry(DeviceExt, FCB, &NewFile, FALSE);
             if (NT_SUCCESS(Status))
             {
                 if (DeletedTarget)
                 {
-                    FsRtlNotifyFullReportChange(DeviceObject->NotifySync,
-                                                &(DeviceObject->NotifyList),
+                    FsRtlNotifyFullReportChange(DeviceExt->NotifySync,
+                                                &(DeviceExt->NotifyList),
                                                 (PSTRING)&FCB->PathNameU,
                                                 FCB->PathNameU.Length - FCB->LongNameU.Length,
                                                 NULL,
@@ -756,8 +767,8 @@ VfatSetRenameInformation(
                 }
                 else
                 {
-                    FsRtlNotifyFullReportChange(DeviceObject->NotifySync,
-                                                &(DeviceObject->NotifyList),
+                    FsRtlNotifyFullReportChange(DeviceExt->NotifySync,
+                                                &(DeviceExt->NotifyList),
                                                 (PSTRING)&FCB->PathNameU,
                                                 FCB->PathNameU.Length - FCB->LongNameU.Length,
                                                 NULL,
@@ -769,12 +780,17 @@ VfatSetRenameInformation(
                 }
             }
         }
+
+        ASSERT(OldReferences == FCB->parentFcb->RefCount - 1); // extra grab
+        ASSERT(OldReferences == ParentFCB->RefCount - 1); // extra grab
     }
     else
     {
+
         /* Try to find target */
         ParentFCB = NULL;
-        Status = vfatPrepareTargetForRename(DeviceObject,
+        OldParent = FCB->parentFcb;
+        Status = vfatPrepareTargetForRename(DeviceExt,
                                             &ParentFCB,
                                             &NewName,
                                             RenameInfo->ReplaceIfExists,
@@ -782,11 +798,14 @@ VfatSetRenameInformation(
                                             &DeletedTarget);
         if (!NT_SUCCESS(Status))
         {
+            ASSERT(OldReferences == FCB->parentFcb->RefCount);
             goto Cleanup;
         }
 
-        FsRtlNotifyFullReportChange(DeviceObject->NotifySync,
-                                    &(DeviceObject->NotifyList),
+        NewReferences = ParentFCB->RefCount;
+
+        FsRtlNotifyFullReportChange(DeviceExt->NotifySync,
+                                    &(DeviceExt->NotifyList),
                                     (PSTRING)&FCB->PathNameU,
                                     FCB->PathNameU.Length - FCB->LongNameU.Length,
                                     NULL,
@@ -795,13 +814,13 @@ VfatSetRenameInformation(
                                     FILE_NOTIFY_CHANGE_DIR_NAME : FILE_NOTIFY_CHANGE_FILE_NAME),
                                     FILE_ACTION_REMOVED,
                                     NULL);
-        Status = VfatMoveEntry(DeviceObject, FCB, &NewFile, ParentFCB);
+        Status = VfatMoveEntry(DeviceExt, FCB, &NewFile, ParentFCB);
         if (NT_SUCCESS(Status))
         {
             if (DeletedTarget)
             {
-                FsRtlNotifyFullReportChange(DeviceObject->NotifySync,
-                                            &(DeviceObject->NotifyList),
+                FsRtlNotifyFullReportChange(DeviceExt->NotifySync,
+                                            &(DeviceExt->NotifyList),
                                             (PSTRING)&FCB->PathNameU,
                                             FCB->PathNameU.Length - FCB->LongNameU.Length,
                                             NULL,
@@ -813,8 +832,8 @@ VfatSetRenameInformation(
             }
             else
             {
-                FsRtlNotifyFullReportChange(DeviceObject->NotifySync,
-                                            &(DeviceObject->NotifyList),
+                FsRtlNotifyFullReportChange(DeviceExt->NotifySync,
+                                            &(DeviceExt->NotifyList),
                                             (PSTRING)&FCB->PathNameU,
                                             FCB->PathNameU.Length - FCB->LongNameU.Length,
                                             NULL,
@@ -827,8 +846,10 @@ VfatSetRenameInformation(
         }
     }
 
+    ASSERT(OldReferences == OldParent->RefCount + 1); // removed file
+    ASSERT(NewReferences == ParentFCB->RefCount - 1); // new file
 Cleanup:
-    if (ParentFCB != NULL) vfatReleaseFCB(DeviceObject, ParentFCB);
+    if (ParentFCB != NULL) vfatReleaseFCB(DeviceExt, ParentFCB);
     if (NewName.Buffer != NULL) ExFreePoolWithTag(NewName.Buffer, TAG_VFAT);
     if (RenameInfo->RootDirectory != NULL) ObDereferenceObject(RootFileObject);
 
diff --git a/drivers/filesystems/ntfs/attrib.c b/drivers/filesystems/ntfs/attrib.c
index aa525475015..9d00a794f6b 100644
--- a/drivers/filesystems/ntfs/attrib.c
+++ b/drivers/filesystems/ntfs/attrib.c
@@ -287,16 +287,25 @@ NtfsDumpFileAttributes(PFILE_RECORD_HEADER FileRecord)
 }
 
 PFILENAME_ATTRIBUTE
-GetFileNameFromRecord(PFILE_RECORD_HEADER FileRecord)
+GetFileNameFromRecord(PFILE_RECORD_HEADER FileRecord, UCHAR NameType)
 {
     PNTFS_ATTR_RECORD Attribute;
+    PFILENAME_ATTRIBUTE Name;
 
     Attribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)FileRecord + FileRecord->AttributeOffset);
     while (Attribute < (PNTFS_ATTR_RECORD)((ULONG_PTR)FileRecord + FileRecord->BytesInUse) &&
            Attribute->Type != AttributeEnd)
     {
         if (Attribute->Type == AttributeFileName)
-            return (PFILENAME_ATTRIBUTE)((ULONG_PTR)Attribute + Attribute->Resident.ValueOffset);
+        {
+            Name = (PFILENAME_ATTRIBUTE)((ULONG_PTR)Attribute + Attribute->Resident.ValueOffset);
+            if (Name->NameType == NameType ||
+                (Name->NameType == NTFS_FILE_NAME_WIN32_AND_DOS && NameType == NTFS_FILE_NAME_WIN32) ||
+                (Name->NameType == NTFS_FILE_NAME_WIN32_AND_DOS && NameType == NTFS_FILE_NAME_DOS))
+            {
+                return Name;
+            }
+        }
 
         Attribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)Attribute + Attribute->Length);
     }
diff --git a/drivers/filesystems/ntfs/dirctl.c b/drivers/filesystems/ntfs/dirctl.c
index a078686edd7..0d943493386 100644
--- a/drivers/filesystems/ntfs/dirctl.c
+++ b/drivers/filesystems/ntfs/dirctl.c
@@ -135,7 +135,7 @@ NtfsGetNameInformation(PDEVICE_EXTENSION DeviceExt,
 
     DPRINT("NtfsGetNameInformation() called\n");
 
-    FileName = GetFileNameFromRecord(FileRecord);
+    FileName = GetFileNameFromRecord(FileRecord, NTFS_FILE_NAME_WIN32);
     ASSERT(FileName != NULL);
 
     Length = FileName->NameLength * sizeof (WCHAR);
@@ -163,7 +163,7 @@ NtfsGetDirectoryInformation(PDEVICE_EXTENSION DeviceExt,
 
     DPRINT("NtfsGetDirectoryInformation() called\n");
 
-    FileName = GetFileNameFromRecord(FileRecord);
+    FileName = GetFileNameFromRecord(FileRecord, NTFS_FILE_NAME_WIN32);
     ASSERT(FileName != NULL);
 
     Length = FileName->NameLength * sizeof (WCHAR);
@@ -204,7 +204,7 @@ NtfsGetFullDirectoryInformation(PDEVICE_EXTENSION DeviceExt,
 
     DPRINT("NtfsGetFullDirectoryInformation() called\n");
 
-    FileName = GetFileNameFromRecord(FileRecord);
+    FileName = GetFileNameFromRecord(FileRecord, NTFS_FILE_NAME_WIN32);
     ASSERT(FileName != NULL);
 
     Length = FileName->NameLength * sizeof (WCHAR);
@@ -242,12 +242,13 @@ NtfsGetBothDirectoryInformation(PDEVICE_EXTENSION DeviceExt,
                                 ULONG BufferLength)
 {
     ULONG Length;
-    PFILENAME_ATTRIBUTE FileName;
+    PFILENAME_ATTRIBUTE FileName, ShortFileName;
 
     DPRINT("NtfsGetBothDirectoryInformation() called\n");
 
-    FileName = GetFileNameFromRecord(FileRecord);
+    FileName = GetFileNameFromRecord(FileRecord, NTFS_FILE_NAME_WIN32);
     ASSERT(FileName != NULL);
+    ShortFileName = GetFileNameFromRecord(FileRecord, NTFS_FILE_NAME_DOS);
 
     Length = FileName->NameLength * sizeof (WCHAR);
     if ((sizeof(FILE_BOTH_DIR_INFORMATION) + Length) > BufferLength)
@@ -258,6 +259,19 @@ NtfsGetBothDirectoryInformation(PDEVICE_EXTENSION DeviceExt,
         ROUND_UP(sizeof(FILE_BOTH_DIR_INFORMATION) + Length, sizeof(ULONG));
     RtlCopyMemory(Info->FileName, FileName->Name, Length);
 
+    if (ShortFileName)
+    {
+        /* Should we upcase the filename? */
+        ASSERT(ShortFileName->NameLength <= ARRAYSIZE(Info->ShortName));
+        Info->ShortNameLength = ShortFileName->NameLength * sizeof(WCHAR);
+        RtlCopyMemory(Info->ShortName, ShortFileName->Name, Info->ShortNameLength);
+    }
+    else
+    {
+        Info->ShortName[0] = 0;
+        Info->ShortNameLength = 0;
+    }
+
     Info->CreationTime.QuadPart = FileName->CreationTime;
     Info->LastAccessTime.QuadPart = FileName->LastAccessTime;
     Info->LastWriteTime.QuadPart = FileName->LastWriteTime;
@@ -272,9 +286,6 @@ NtfsGetBothDirectoryInformation(PDEVICE_EXTENSION DeviceExt,
 //  Info->FileIndex=;
     Info->EaSize = 0;
 
-    Info->ShortName[0] = 0;
-    Info->ShortNameLength = 0;
-
     return STATUS_SUCCESS;
 }
 
diff --git a/drivers/filesystems/ntfs/fcb.c b/drivers/filesystems/ntfs/fcb.c
index c6765a5b268..1e71fd4db51 100644
--- a/drivers/filesystems/ntfs/fcb.c
+++ b/drivers/filesystems/ntfs/fcb.c
@@ -289,7 +289,7 @@ NtfsMakeRootFCB(PNTFS_VCB Vcb)
         return NULL;
     }
 
-    FileName = GetFileNameFromRecord(MftRecord);
+    FileName = GetFileNameFromRecord(MftRecord, NTFS_FILE_NAME_WIN32);
     if (!FileName)
     {
         ExFreePoolWithTag(MftRecord, TAG_NTFS);
@@ -391,7 +391,7 @@ NtfsMakeFCBFromDirEntry(PNTFS_VCB Vcb,
 
     DPRINT1("NtfsMakeFCBFromDirEntry(%p, %p, %wZ, %p, %p)\n", Vcb, DirectoryFCB, Name, Record, fileFCB);
 
-    FileName = GetFileNameFromRecord(Record);
+    FileName = GetFileNameFromRecord(Record, NTFS_FILE_NAME_WIN32);
     if (!FileName)
     {
         return STATUS_OBJECT_NAME_NOT_FOUND; // Not sure that's the best here
diff --git a/drivers/filesystems/ntfs/mft.c b/drivers/filesystems/ntfs/mft.c
index 864547ff3ae..a882700acd4 100644
--- a/drivers/filesystems/ntfs/mft.c
+++ b/drivers/filesystems/ntfs/mft.c
@@ -85,7 +85,7 @@ FindAttributeHelper(PDEVICE_EXTENSION Vcb,
                     PCWSTR Name,
                     ULONG NameLength)
 {
-    DPRINT1("FindAttributeHelper(%p, %p, %p, 0x%x, %S, %u)\n", Vcb, AttrRecord, AttrRecordEnd, Type, Name, NameLength);
+    DPRINT("FindAttributeHelper(%p, %p, %p, 0x%x, %S, %u)\n", Vcb, AttrRecord, AttrRecordEnd, Type, Name, NameLength);
 
     while (AttrRecord < AttrRecordEnd)
     {
@@ -146,7 +146,7 @@ FindAttributeHelper(PDEVICE_EXTENSION Vcb,
                 PWCHAR AttrName;
 
                 AttrName = (PWCHAR)((PCHAR)AttrRecord + AttrRecord->NameOffset);
-                DPRINT("%s, %s\n", AttrName, Name);
+                DPRINT("%.*S, %.*S\n", AttrRecord->NameLength, AttrName, NameLength, Name);
                 if (RtlCompareMemory(AttrName, Name, NameLength << 1) == (NameLength << 1))
                 {
                     /* Found it, fill up the context and return. */
@@ -180,7 +180,7 @@ FindAttribute(PDEVICE_EXTENSION Vcb,
     PNTFS_ATTR_RECORD AttrRecord;
     PNTFS_ATTR_RECORD AttrRecordEnd;
 
-    DPRINT1("FindAttribute(%p, %p, %u, %S, %u, %p)\n", Vcb, MftRecord, Type, Name, NameLength, AttrCtx);
+    DPRINT("FindAttribute(%p, %p, 0x%x, %S, %u, %p)\n", Vcb, MftRecord, Type, Name, NameLength, AttrCtx);
 
     AttrRecord = (PNTFS_ATTR_RECORD)((PCHAR)MftRecord + MftRecord->AttributeOffset);
     AttrRecordEnd = (PNTFS_ATTR_RECORD)((PCHAR)MftRecord + Vcb->NtfsInfo.BytesPerFileRecord);
@@ -397,12 +397,12 @@ ReadFileRecord(PDEVICE_EXTENSION Vcb,
 {
     ULONGLONG BytesRead;
 
-    DPRINT1("ReadFileRecord(%p, %I64x, %p)\n", Vcb, index, file);
+    DPRINT("ReadFileRecord(%p, %I64x, %p)\n", Vcb, index, file);
 
     BytesRead = ReadAttribute(Vcb, Vcb->MFTContext, index * Vcb->NtfsInfo.BytesPerFileRecord, (PCHAR)file, Vcb->NtfsInfo.BytesPerFileRecord);
     if (BytesRead != Vcb->NtfsInfo.BytesPerFileRecord)
     {
-        DPRINT1("ReadFileRecord failed: %u read, %u expected\n", BytesRead, Vcb->NtfsInfo.BytesPerFileRecord);
+        DPRINT1("ReadFileRecord failed: %I64u read, %u expected\n", BytesRead, Vcb->NtfsInfo.BytesPerFileRecord);
         return STATUS_PARTIAL_COPY;
     }
 
@@ -469,7 +469,7 @@ CompareFileName(PUNICODE_STRING FileName,
 
     EntryName.Buffer = IndexEntry->FileName.Name;
     EntryName.Length = 
-    EntryName.MaximumLength = IndexEntry->FileName.NameLength;
+    EntryName.MaximumLength = IndexEntry->FileName.NameLength * sizeof(WCHAR);
 
     if (DirSearch)
     {
@@ -477,7 +477,7 @@ CompareFileName(PUNICODE_STRING FileName,
     }
     else
     {
-        return (RtlCompareUnicodeString(FileName, &EntryName, (IndexEntry->FileName.NameType != NTFS_FILE_NAME_POSIX)) == TRUE);
+        return (RtlCompareUnicodeString(FileName, &EntryName, (IndexEntry->FileName.NameType != NTFS_FILE_NAME_POSIX)) == 0);
     }
 }
 
@@ -507,7 +507,7 @@ NtfsFindMftRecord(PDEVICE_EXTENSION Vcb,
     NTSTATUS Status;
     ULONG CurrentEntry = 0;
 
-    DPRINT1("NtfsFindMftRecord(%p, %I64d, %wZ, %p, %u, %p)\n", Vcb, MFTIndex, FileName, FirstEntry, DirSearch, OutMFTIndex);
+    DPRINT("NtfsFindMftRecord(%p, %I64d, %wZ, %p, %u, %p)\n", Vcb, MFTIndex, FileName, FirstEntry, DirSearch, OutMFTIndex);
 
     MftRecord = ExAllocatePoolWithTag(NonPagedPool,
                                       Vcb->NtfsInfo.BytesPerFileRecord,
@@ -631,9 +631,9 @@ NtfsFindMftRecord(PDEVICE_EXTENSION Vcb,
                 IndexBuffer = (PINDEX_BUFFER)IndexRecord;
                 ASSERT(IndexBuffer->Ntfs.Type == 'XDNI');
                 ASSERT(IndexBuffer->Header.AllocatedSize + 0x18 == IndexBlockSize);
-                IndexEntry = (PINDEX_ENTRY_ATTRIBUTE)(&IndexBuffer->Header + IndexBuffer->Header.FirstEntryOffset);
-                IndexEntryEnd = (PINDEX_ENTRY_ATTRIBUTE)(&IndexBuffer->Header + IndexBuffer->Header.TotalSizeOfEntries);
-                //ASSERT(IndexEntryEnd <= (PINDEX_ENTRY_ATTRIBUTE)((ULONG_PTR)IndexBuffer + IndexBlockSize)); FIXME: Why doesn't it work?
+                IndexEntry = (PINDEX_ENTRY_ATTRIBUTE)((ULONG_PTR)&IndexBuffer->Header + IndexBuffer->Header.FirstEntryOffset);
+                IndexEntryEnd = (PINDEX_ENTRY_ATTRIBUTE)((ULONG_PTR)&IndexBuffer->Header + IndexBuffer->Header.TotalSizeOfEntries);
+                ASSERT(IndexEntryEnd <= (PINDEX_ENTRY_ATTRIBUTE)((ULONG_PTR)IndexBuffer + IndexBlockSize));
 
                 while (IndexEntry < IndexEntryEnd &&
                        !(IndexEntry->Flags & NTFS_INDEX_ENTRY_END))
@@ -653,6 +653,7 @@ NtfsFindMftRecord(PDEVICE_EXTENSION Vcb,
                     }
 
                     ++CurrentEntry;
+                    ASSERT(IndexEntry->Length >= sizeof(INDEX_ENTRY_ATTRIBUTE));
                     IndexEntry = (PINDEX_ENTRY_ATTRIBUTE)((PCHAR)IndexEntry + IndexEntry->Length);
                 }
 
@@ -686,13 +687,13 @@ NtfsLookupFileAt(PDEVICE_EXTENSION Vcb,
     NTSTATUS Status;
     ULONG FirstEntry = 0;
 
-    DPRINT1("NtfsLookupFileAt(%p, %wZ, %p, %p, %I64x)\n", Vcb, PathName, FileRecord, DataContext, CurrentMFTIndex);
+    DPRINT("NtfsLookupFileAt(%p, %wZ, %p, %p, %I64x)\n", Vcb, PathName, FileRecord, DataContext, CurrentMFTIndex);
 
     FsRtlDissectName(*PathName, &Current, &Remaining);
 
     while (Current.Length != 0)
     {
-        DPRINT1("Current: %wZ\n", &Current);
+        DPRINT("Current: %wZ\n", &Current);
 
         Status = NtfsFindMftRecord(Vcb, CurrentMFTIndex, &Current, &FirstEntry, FALSE, &CurrentMFTIndex);
         if (!NT_SUCCESS(Status))
@@ -701,7 +702,7 @@ NtfsLookupFileAt(PDEVICE_EXTENSION Vcb,
         }
 
         if (Remaining.Length == 0)
-            return STATUS_OBJECT_PATH_NOT_FOUND;
+            break;
 
         FsRtlDissectName(Current, &Current, &Remaining);
     }
@@ -762,11 +763,12 @@ NtfsFindFileAt(PDEVICE_EXTENSION Vcb,
 {
     NTSTATUS Status;
 
-    DPRINT1("NtfsFindFileAt(%p, %wZ, %p, %p, %p, %p, %I64x)\n", Vcb, SearchPattern, FirstEntry, FileRecord, DataContext, MFTIndex, CurrentMFTIndex);
+    DPRINT("NtfsFindFileAt(%p, %wZ, %p, %p, %p, %p, %I64x)\n", Vcb, SearchPattern, FirstEntry, FileRecord, DataContext, MFTIndex, CurrentMFTIndex);
 
     Status = NtfsFindMftRecord(Vcb, CurrentMFTIndex, SearchPattern, FirstEntry, TRUE, &CurrentMFTIndex);
     if (!NT_SUCCESS(Status))
     {
+        DPRINT("NtfsFindFileAt: NtfsFindMftRecord() failed with status 0x%08lx\n", Status);
         return Status;
     }
 
diff --git a/drivers/filesystems/ntfs/ntfs.h b/drivers/filesystems/ntfs/ntfs.h
index 663cba24a37..504473b58c3 100644
--- a/drivers/filesystems/ntfs/ntfs.h
+++ b/drivers/filesystems/ntfs/ntfs.h
@@ -448,7 +448,7 @@ VOID
 NtfsDumpFileAttributes(PFILE_RECORD_HEADER FileRecord);
 
 PFILENAME_ATTRIBUTE
-GetFileNameFromRecord(PFILE_RECORD_HEADER FileRecord);
+GetFileNameFromRecord(PFILE_RECORD_HEADER FileRecord, UCHAR NameType);
 
 /* blockdev.c */
 
@@ -600,6 +600,9 @@ NtfsFsdFileSystemControl(PDEVICE_OBJECT DeviceObject,
 
 
 /* mft.c */
+VOID
+ReleaseAttributeContext(PNTFS_ATTR_CONTEXT Context);
+
 ULONG
 ReadAttribute(PDEVICE_EXTENSION Vcb,
               PNTFS_ATTR_CONTEXT Context,
diff --git a/include/ddk/nt_vdd.h b/include/ddk/nt_vdd.h
index b4b6c7df67d..e3fa8debb45 100644
--- a/include/ddk/nt_vdd.h
+++ b/include/ddk/nt_vdd.h
@@ -45,14 +45,14 @@ VDDTerminateVDM(VOID);
  * I/O Port services
  */
 
-typedef VOID (*PFNVDD_INB)   (WORD iport, PBYTE data);
-typedef VOID (*PFNVDD_INW)   (WORD iport, PWORD data);
-typedef VOID (*PFNVDD_INSB)  (WORD iport, PBYTE data, WORD count);
-typedef VOID (*PFNVDD_INSW)  (WORD iport, PWORD data, WORD count);
-typedef VOID (*PFNVDD_OUTB)  (WORD iport, BYTE  data);
-typedef VOID (*PFNVDD_OUTW)  (WORD iport, WORD  data);
-typedef VOID (*PFNVDD_OUTSB) (WORD iport, PBYTE data, WORD count);
-typedef VOID (*PFNVDD_OUTSW) (WORD iport, PWORD data, WORD count);
+typedef VOID (WINAPI *PFNVDD_INB)   (WORD iport, PBYTE data);
+typedef VOID (WINAPI *PFNVDD_INW)   (WORD iport, PWORD data);
+typedef VOID (WINAPI *PFNVDD_INSB)  (WORD iport, PBYTE data, WORD count);
+typedef VOID (WINAPI *PFNVDD_INSW)  (WORD iport, PWORD data, WORD count);
+typedef VOID (WINAPI *PFNVDD_OUTB)  (WORD iport, BYTE  data);
+typedef VOID (WINAPI *PFNVDD_OUTW)  (WORD iport, WORD  data);
+typedef VOID (WINAPI *PFNVDD_OUTSB) (WORD iport, PBYTE data, WORD count);
+typedef VOID (WINAPI *PFNVDD_OUTSW) (WORD iport, PWORD data, WORD count);
 
 typedef struct _VDD_IO_HANDLERS
 {
diff --git a/include/reactos/libs/fast486/fast486.h b/include/reactos/libs/fast486/fast486.h
index efc87fefc73..379ad081afa 100644
--- a/include/reactos/libs/fast486/fast486.h
+++ b/include/reactos/libs/fast486/fast486.h
@@ -93,6 +93,18 @@
 
 #define FAST486_FPU_DEFAULT_CONTROL 0x037F
 
+#define FAST486_PAGE_SIZE 4096
+#define FAST486_CACHE_SIZE 32
+
+/*
+ * These are condiciones sine quibus non that should be respected, because
+ * otherwise when fetching DWORDs you would read extra garbage bytes
+ * (by reading outside of the prefetch buffer). The prefetch cache must
+ * also not cross a page boundary.
+ */
+C_ASSERT((FAST486_CACHE_SIZE >= sizeof(DWORD))
+         && (FAST486_CACHE_SIZE <= FAST486_PAGE_SIZE));
+
 struct _FAST486_STATE;
 typedef struct _FAST486_STATE FAST486_STATE, *PFAST486_STATE;
 
@@ -157,14 +169,6 @@ typedef enum _FAST486_EXCEPTIONS
     FAST486_EXCEPTION_MC = 0x12
 } FAST486_EXCEPTIONS, *PFAST486_EXCEPTIONS;
 
-typedef enum _FAST486_INT_STATUS
-{
-    FAST486_INT_NONE = 0,
-    FAST486_INT_EXECUTE = 1,
-    FAST486_INT_SIGNAL = 2,
-    FAST486_INT_DELAYED = 3
-} FAST486_INT_STATUS, *PFAST486_INT_STATUS;
-
 typedef
 VOID
 (NTAPI *FAST486_MEM_READ_PROC)
@@ -483,9 +487,14 @@ struct _FAST486_STATE
     ULONG PrefixFlags;
     FAST486_SEG_REGS SegmentOverride;
     BOOLEAN Halted;
-    FAST486_INT_STATUS IntStatus;
-    UCHAR PendingIntNum;
+    BOOLEAN IntSignaled;
+    BOOLEAN DoNotInterrupt;
     PULONG Tlb;
+#ifndef FAST486_NO_PREFETCH
+    BOOLEAN PrefetchValid;
+    ULONG PrefetchAddress;
+    UCHAR PrefetchCache[FAST486_CACHE_SIZE];
+#endif
 #ifndef FAST486_NO_FPU
     FAST486_FPU_DATA_REG FpuRegisters[FAST486_NUM_FPU_REGS];
     FAST486_FPU_STATUS_REG FpuStatus;
@@ -531,10 +540,6 @@ VOID
 NTAPI
 Fast486DumpState(PFAST486_STATE State);
 
-VOID
-NTAPI
-Fast486Interrupt(PFAST486_STATE State, UCHAR Number);
-
 VOID
 NTAPI
 Fast486InterruptSignal(PFAST486_STATE State);
diff --git a/lib/fast486/common.c b/lib/fast486/common.c
index 1e9311ae00b..a9fb89c168f 100644
--- a/lib/fast486/common.c
+++ b/lib/fast486/common.c
@@ -95,8 +95,44 @@ Fast486ReadMemory(PFAST486_STATE State,
     /* Find the linear address */
     LinearAddress = CachedDescriptor->Base + Offset;
 
-    /* Read from the linear address */
-    return Fast486ReadLinearMemory(State, LinearAddress, Buffer, Size);
+#ifndef FAST486_NO_PREFETCH
+    if (InstFetch && ((Offset + FAST486_CACHE_SIZE - 1) <= CachedDescriptor->Limit))
+    {
+        State->PrefetchAddress = LinearAddress;
+
+        if ((State->ControlRegisters[FAST486_REG_CR0] & FAST486_CR0_PG)
+            && (PAGE_OFFSET(State->PrefetchAddress) > (FAST486_PAGE_SIZE - FAST486_CACHE_SIZE)))
+        {
+            /* We mustn't prefetch across a page boundary */
+            State->PrefetchAddress = PAGE_ALIGN(State->PrefetchAddress)
+                                     | (FAST486_PAGE_SIZE - FAST486_CACHE_SIZE);
+        }
+
+        /* Prefetch */
+        if (Fast486ReadLinearMemory(State,
+                                    State->PrefetchAddress,
+                                    State->PrefetchCache,
+                                    FAST486_CACHE_SIZE))
+        {
+            State->PrefetchValid = TRUE;
+
+            RtlMoveMemory(Buffer,
+                          &State->PrefetchCache[LinearAddress - State->PrefetchAddress],
+                          Size);
+            return TRUE;
+        }
+        else
+        {
+            State->PrefetchValid = FALSE;
+            return FALSE;
+        }
+    }
+    else
+#endif
+    {
+        /* Read from the linear address */
+        return Fast486ReadLinearMemory(State, LinearAddress, Buffer, Size);
+    }
 }
 
 BOOLEAN
@@ -156,6 +192,18 @@ Fast486WriteMemory(PFAST486_STATE State,
     /* Find the linear address */
     LinearAddress = CachedDescriptor->Base + Offset;
 
+#ifndef FAST486_NO_PREFETCH
+    if (State->PrefetchValid
+        && (LinearAddress >= State->PrefetchAddress)
+        && ((LinearAddress + Size) <= (State->PrefetchAddress + FAST486_CACHE_SIZE)))
+    {
+        /* Update the prefetch */
+        RtlMoveMemory(&State->PrefetchCache[LinearAddress - State->PrefetchAddress],
+                      Buffer,
+                      min(Size, FAST486_CACHE_SIZE + State->PrefetchAddress - LinearAddress));
+    }
+#endif
+
     /* Write to the linear address */
     return Fast486WriteLinearMemory(State, LinearAddress, Buffer, Size);
 }
diff --git a/lib/fast486/common.h b/lib/fast486/common.h
index 6b9cb6aa09e..a87a3eeb7a1 100644
--- a/lib/fast486/common.h
+++ b/lib/fast486/common.h
@@ -70,10 +70,6 @@ if (State->PrefixFlags & FAST486_PREFIX_LOCK)\
 #define GET_ADDR_PTE(x) (((x) >> 12) & 0x3FF)
 #define INVALID_TLB_FIELD 0xFFFFFFFF
 
-#ifndef PAGE_SIZE
-#define PAGE_SIZE   4096
-#endif
-
 typedef struct _FAST486_MOD_REG_RM
 {
     FAST486_GEN_REGS Register;
diff --git a/lib/fast486/common.inl b/lib/fast486/common.inl
index 4990172fb1a..53d1deeb246 100644
--- a/lib/fast486/common.inl
+++ b/lib/fast486/common.inl
@@ -163,9 +163,9 @@ Fast486ReadLinearMemory(PFAST486_STATE State,
 
         for (Page = PAGE_ALIGN(LinearAddress);
              Page <= PAGE_ALIGN(LinearAddress + Size - 1);
-             Page += PAGE_SIZE)
+             Page += FAST486_PAGE_SIZE)
         {
-            ULONG PageOffset = 0, PageLength = PAGE_SIZE;
+            ULONG PageOffset = 0, PageLength = FAST486_PAGE_SIZE;
 
             /* Get the table entry */
             TableEntry.Value = Fast486GetPageTableEntry(State, Page, FALSE);
@@ -230,9 +230,9 @@ Fast486WriteLinearMemory(PFAST486_STATE State,
 
         for (Page = PAGE_ALIGN(LinearAddress);
              Page <= PAGE_ALIGN(LinearAddress + Size - 1);
-             Page += PAGE_SIZE)
+             Page += FAST486_PAGE_SIZE)
         {
-            ULONG PageOffset = 0, PageLength = PAGE_SIZE;
+            ULONG PageOffset = 0, PageLength = FAST486_PAGE_SIZE;
 
             /* Get the table entry */
             TableEntry.Value = Fast486GetPageTableEntry(State, Page, TRUE);
@@ -522,6 +522,11 @@ Fast486LoadSegment(PFAST486_STATE State,
         {
             /* Loading the code segment */
 
+#ifndef FAST486_NO_PREFETCH
+            /* Invalidate the prefetch */
+            State->PrefetchValid = FALSE;
+#endif
+
             if (GET_SEGMENT_INDEX(Selector) == 0)
             {
                 Fast486Exception(State, FAST486_EXCEPTION_GP);
@@ -641,21 +646,39 @@ Fast486FetchByte(PFAST486_STATE State,
                  PUCHAR Data)
 {
     PFAST486_SEG_REG CachedDescriptor;
+    ULONG Offset;
+#ifndef FAST486_NO_PREFETCH
+    ULONG LinearAddress;
+#endif
 
     /* Get the cached descriptor of CS */
     CachedDescriptor = &State->SegmentRegs[FAST486_REG_CS];
 
-    /* Read from memory */
-    if (!Fast486ReadMemory(State,
-                           FAST486_REG_CS,
-                           (CachedDescriptor->Size) ? State->InstPtr.Long
-                                                    : State->InstPtr.LowWord,
-                           TRUE,
-                           Data,
-                           sizeof(UCHAR)))
+    Offset = (CachedDescriptor->Size) ? State->InstPtr.Long
+                                      : State->InstPtr.LowWord;
+#ifndef FAST486_NO_PREFETCH
+    LinearAddress = CachedDescriptor->Base + Offset;
+
+    if (State->PrefetchValid
+        && (LinearAddress >= State->PrefetchAddress)
+        && ((LinearAddress + sizeof(UCHAR)) <= (State->PrefetchAddress + FAST486_CACHE_SIZE)))
     {
-        /* Exception occurred during instruction fetch */
-        return FALSE;
+        *Data = *(PUCHAR)&State->PrefetchCache[LinearAddress - State->PrefetchAddress];
+    }
+    else
+#endif
+    {
+        /* Read from memory */
+        if (!Fast486ReadMemory(State,
+                               FAST486_REG_CS,
+                               Offset,
+                               TRUE,
+                               Data,
+                               sizeof(UCHAR)))
+        {
+            /* Exception occurred during instruction fetch */
+            return FALSE;
+        }
     }
 
     /* Advance the instruction pointer */
@@ -672,22 +695,41 @@ Fast486FetchWord(PFAST486_STATE State,
                  PUSHORT Data)
 {
     PFAST486_SEG_REG CachedDescriptor;
+    ULONG Offset;
+#ifndef FAST486_NO_PREFETCH
+    ULONG LinearAddress;
+#endif
 
     /* Get the cached descriptor of CS */
     CachedDescriptor = &State->SegmentRegs[FAST486_REG_CS];
 
-    /* Read from memory */
-    // FIXME: Fix byte order on big-endian machines
-    if (!Fast486ReadMemory(State,
-                           FAST486_REG_CS,
-                           (CachedDescriptor->Size) ? State->InstPtr.Long
-                                                    : State->InstPtr.LowWord,
-                           TRUE,
-                           Data,
-                           sizeof(USHORT)))
+    Offset = (CachedDescriptor->Size) ? State->InstPtr.Long
+                                      : State->InstPtr.LowWord;
+
+#ifndef FAST486_NO_PREFETCH
+    LinearAddress = CachedDescriptor->Base + Offset;
+
+    if (State->PrefetchValid
+        && (LinearAddress >= State->PrefetchAddress)
+        && ((LinearAddress + sizeof(USHORT)) <= (State->PrefetchAddress + FAST486_CACHE_SIZE)))
     {
-        /* Exception occurred during instruction fetch */
-        return FALSE;
+        *Data = *(PUSHORT)&State->PrefetchCache[LinearAddress - State->PrefetchAddress];
+    }
+    else
+#endif
+    {
+        /* Read from memory */
+        // FIXME: Fix byte order on big-endian machines
+        if (!Fast486ReadMemory(State,
+                               FAST486_REG_CS,
+                               Offset,
+                               TRUE,
+                               Data,
+                               sizeof(USHORT)))
+        {
+            /* Exception occurred during instruction fetch */
+            return FALSE;
+        }
     }
 
     /* Advance the instruction pointer */
@@ -704,22 +746,41 @@ Fast486FetchDword(PFAST486_STATE State,
                   PULONG Data)
 {
     PFAST486_SEG_REG CachedDescriptor;
+    ULONG Offset;
+#ifndef FAST486_NO_PREFETCH
+    ULONG LinearAddress;
+#endif
 
     /* Get the cached descriptor of CS */
     CachedDescriptor = &State->SegmentRegs[FAST486_REG_CS];
 
-    /* Read from memory */
-    // FIXME: Fix byte order on big-endian machines
-    if (!Fast486ReadMemory(State,
-                           FAST486_REG_CS,
-                           (CachedDescriptor->Size) ? State->InstPtr.Long
-                                                    : State->InstPtr.LowWord,
-                           TRUE,
-                           Data,
-                           sizeof(ULONG)))
+    Offset = (CachedDescriptor->Size) ? State->InstPtr.Long
+                                      : State->InstPtr.LowWord;
+
+#ifndef FAST486_NO_PREFETCH
+    LinearAddress = CachedDescriptor->Base + Offset;
+
+    if (State->PrefetchValid
+        && (LinearAddress >= State->PrefetchAddress)
+        && ((LinearAddress + sizeof(ULONG)) <= (State->PrefetchAddress + FAST486_CACHE_SIZE)))
     {
-        /* Exception occurred during instruction fetch */
-        return FALSE;
+        *Data = *(PULONG)&State->PrefetchCache[LinearAddress - State->PrefetchAddress];
+    }
+    else
+#endif
+    {
+        /* Read from memory */
+        // FIXME: Fix byte order on big-endian machines
+        if (!Fast486ReadMemory(State,
+                               FAST486_REG_CS,
+                               Offset,
+                               TRUE,
+                               Data,
+                               sizeof(ULONG)))
+        {
+            /* Exception occurred during instruction fetch */
+            return FALSE;
+        }
     }
 
     /* Advance the instruction pointer */
diff --git a/lib/fast486/extraops.c b/lib/fast486/extraops.c
index 9d23cb97394..eefd918aa6f 100644
--- a/lib/fast486/extraops.c
+++ b/lib/fast486/extraops.c
@@ -686,6 +686,11 @@ FAST486_OPCODE_HANDLER(Fast486ExtOpcodeLoadControlReg)
         }
     }
 
+#ifndef FAST486_NO_PREFETCH
+    /* Changing CR0 or CR3 can interfere with prefetching (because of paging) */
+    State->PrefetchValid = FALSE;
+#endif
+
     /* Load a value to the control register */
     State->ControlRegisters[ModRegRm.Register] = Value;
 }
diff --git a/lib/fast486/fast486.c b/lib/fast486/fast486.c
index 12a37685869..bc9748d5791 100644
--- a/lib/fast486/fast486.c
+++ b/lib/fast486/fast486.c
@@ -85,7 +85,12 @@ NextInst:
          * Check if there is an interrupt to execute, or a hardware interrupt signal
          * while interrupts are enabled.
          */
-        if (State->Flags.Tf && !State->Halted)
+        if (State->DoNotInterrupt)
+        {
+            /* Clear the interrupt delay flag */
+            State->DoNotInterrupt = FALSE;
+        }
+        else if (State->Flags.Tf && !State->Halted)
         {
             /* Perform the interrupt */
             Fast486PerformInterrupt(State, 0x01);
@@ -99,29 +104,16 @@ NextInst:
              */
             State->Flags.Tf = FALSE;
         }
-        else if (State->IntStatus == FAST486_INT_EXECUTE)
+        else if (State->Flags.If && State->IntSignaled)
         {
             /* No longer halted */
             State->Halted = FALSE;
 
-            /* Perform the interrupt */
-            Fast486PerformInterrupt(State, State->PendingIntNum);
+            /* Acknowledge the interrupt and perform it */
+            Fast486PerformInterrupt(State, State->IntAckCallback(State));
 
             /* Clear the interrupt status */
-            State->IntStatus = FAST486_INT_NONE;
-        }
-        else if (State->Flags.If && (State->IntStatus == FAST486_INT_SIGNAL))
-        {
-            /* Acknowledge the interrupt to get the number */
-            State->PendingIntNum = State->IntAckCallback(State);
-
-            /* Set the interrupt status to execute on the next instruction */
-            State->IntStatus = FAST486_INT_EXECUTE;
-        }
-        else if (State->IntStatus == FAST486_INT_DELAYED)
-        {
-            /* Restore the old state */
-            State->IntStatus = FAST486_INT_EXECUTE;
+            State->IntSignaled = FALSE;
         }
     }
     while ((Command == FAST486_CONTINUE) ||
@@ -284,21 +276,11 @@ Fast486Reset(PFAST486_STATE State)
     State->Tlb              = Tlb;
 }
 
-VOID
-NTAPI
-Fast486Interrupt(PFAST486_STATE State, UCHAR Number)
-{
-    /* Set the interrupt status and the number */
-    State->IntStatus = FAST486_INT_EXECUTE;
-    State->PendingIntNum = Number;
-}
-
 VOID
 NTAPI
 Fast486InterruptSignal(PFAST486_STATE State)
 {
-    /* Set the interrupt status */
-    State->IntStatus = FAST486_INT_SIGNAL;
+    State->IntSignaled = TRUE;
 }
 
 VOID
diff --git a/lib/fast486/fpu.c b/lib/fast486/fpu.c
index a0399e57ebf..3da63f4b368 100644
--- a/lib/fast486/fpu.c
+++ b/lib/fast486/fpu.c
@@ -32,6 +32,8 @@
 
 /* PRIVATE FUNCTIONS **********************************************************/
 
+#ifndef FAST486_NO_FPU
+
 static ULONGLONG
 UnsignedMult128(ULONGLONG Multiplicand,
                 ULONGLONG Multiplier,
@@ -303,6 +305,8 @@ Fast486FpuDivide(PFAST486_STATE State,
     UNIMPLEMENTED;
 }
 
+#endif
+
 /* PUBLIC FUNCTIONS ***********************************************************/
 
 FAST486_OPCODE_HANDLER(Fast486FpuOpcodeD8DC)
diff --git a/lib/fast486/opcodes.c b/lib/fast486/opcodes.c
index f31ce73d7f6..1a8e247acee 100644
--- a/lib/fast486/opcodes.c
+++ b/lib/fast486/opcodes.c
@@ -2635,7 +2635,11 @@ FAST486_OPCODE_HANDLER(Fast486OpcodePopSs)
     }
 
     /* Call the internal API */
-    Fast486LoadSegment(State, FAST486_REG_SS, LOWORD(NewSelector));
+    if (Fast486LoadSegment(State, FAST486_REG_SS, LOWORD(NewSelector)))
+    {
+        /* Inhibit all interrupts until the next instruction */
+        State->DoNotInterrupt = TRUE;
+    }
 }
 
 FAST486_OPCODE_HANDLER(Fast486OpcodeSbbByteModrm)
@@ -3953,7 +3957,11 @@ FAST486_OPCODE_HANDLER(Fast486OpcodeMovLoadSeg)
             return;
         }
 
-        Fast486LoadSegment(State, ModRegRm.Register, LOWORD(Selector));
+        if (!Fast486LoadSegment(State, ModRegRm.Register, LOWORD(Selector)))
+        {
+            /* Exception occurred */
+            return;
+        }
     }
     else
     {
@@ -3965,7 +3973,17 @@ FAST486_OPCODE_HANDLER(Fast486OpcodeMovLoadSeg)
             return;
         }
 
-        Fast486LoadSegment(State, ModRegRm.Register, Selector);
+        if (!Fast486LoadSegment(State, ModRegRm.Register, Selector))
+        {
+            /* Exception occurred */
+            return;
+        }
+    }
+
+    if ((INT)ModRegRm.Register == FAST486_REG_SS)
+    {
+        /* Inhibit all interrupts until the next instruction */
+        State->DoNotInterrupt = TRUE;
     }
 }
 
@@ -4247,6 +4265,11 @@ FAST486_OPCODE_HANDLER(Fast486OpcodeLdsLes)
                 return;
             }
 
+#ifndef FAST486_NO_PREFETCH
+            /* Invalidate the prefetch since BOP handlers can alter the memory */
+            State->PrefetchValid = FALSE;
+#endif
+
             /* Call the BOP handler */
             State->BopCallback(State, BopCode);
 
@@ -4256,10 +4279,7 @@ FAST486_OPCODE_HANDLER(Fast486OpcodeLdsLes)
              * changes the CS:IP, the interrupt handler won't execute and the
              * stack pointer will never be restored.
              */
-            if (State->IntStatus == FAST486_INT_EXECUTE)
-            {
-                State->IntStatus = FAST486_INT_DELAYED;
-            }
+            State->DoNotInterrupt = TRUE;
 
             return;
         }
diff --git a/lib/fast486/opgroups.c b/lib/fast486/opgroups.c
index 03eb09181d2..bca294d2c96 100644
--- a/lib/fast486/opgroups.c
+++ b/lib/fast486/opgroups.c
@@ -2177,7 +2177,31 @@ FAST486_OPCODE_HANDLER(Fast486ExtOpcodeGroup0F01)
         /* INVLPG */
         case 7:
         {
-            UNIMPLEMENTED;
+#ifndef FAST486_NO_PREFETCH
+            /* Invalidate the prefetch */
+            State->PrefetchValid = FALSE;
+#endif
+
+            /* This is a privileged instruction */
+            if (Fast486GetCurrentPrivLevel(State) != 0)
+            {
+                Fast486Exception(State, FAST486_EXCEPTION_GP);
+                return;
+            }
+
+            if (!ModRegRm.Memory)
+            {
+                /* The second operand must be a memory location */
+                Fast486Exception(State, FAST486_EXCEPTION_UD);
+                return;
+            }
+
+            if (State->Tlb != NULL)
+            {
+                /* Clear the TLB entry */
+                State->Tlb[ModRegRm.MemoryAddress >> 12] = INVALID_TLB_FIELD;
+            }
+
             break;
         }
 
diff --git a/lib/sdk/crt/mem/i386/memchr_asm.s b/lib/sdk/crt/mem/i386/memchr_asm.s
index 37e5deb9f52..5a72c94e691 100644
--- a/lib/sdk/crt/mem/i386/memchr_asm.s
+++ b/lib/sdk/crt/mem/i386/memchr_asm.s
@@ -14,7 +14,8 @@
 PUBLIC	_memchr
 .code
 
-_memchr:
+FUNC _memchr
+	FPO 0, 3, 4, 1, 1, FRAME_NONFPO
 	push ebp
 	mov ebp, esp
 	push edi
@@ -33,5 +34,6 @@ _memchr:
 	pop edi
 	leave
 	ret
+ENDFUNC
 
 END
diff --git a/lib/sdk/crt/mem/i386/memmove_asm.s b/lib/sdk/crt/mem/i386/memmove_asm.s
index 476f843befe..299b2cc8d38 100644
--- a/lib/sdk/crt/mem/i386/memmove_asm.s
+++ b/lib/sdk/crt/mem/i386/memmove_asm.s
@@ -11,7 +11,8 @@ PUBLIC _memmove
 .code
 
 _memcpy:
-_memmove:
+FUNC _memmove
+	FPO 0, 3, 5, 2, 1, FRAME_NONFPO
 	push ebp
 	mov ebp, esp
 	
@@ -116,5 +117,6 @@ _memmove:
 	dec esi
 	dec edi
 	jmp .L8
+ENDFUNC
 
 END
diff --git a/lib/sdk/crt/mem/i386/memset_asm.s b/lib/sdk/crt/mem/i386/memset_asm.s
index dc964ac3969..ba04724b443 100644
--- a/lib/sdk/crt/mem/i386/memset_asm.s
+++ b/lib/sdk/crt/mem/i386/memset_asm.s
@@ -9,7 +9,8 @@
 PUBLIC _memset
 .code
 
-_memset:
+FUNC _memset
+	FPO 0, 3, 4, 1, 1, FRAME_NONFPO
 	push ebp
 	mov ebp, esp
 	push edi
@@ -45,5 +46,6 @@ _memset:
 	mov eax, [ebp + 8]
 	leave
 	ret
+ENDFUNC
 
 END
diff --git a/lib/sdk/crt/string/i386/tcsnlen.inc b/lib/sdk/crt/string/i386/tcsnlen.inc
index d8741188c59..58febca97a6 100644
--- a/lib/sdk/crt/string/i386/tcsnlen.inc
+++ b/lib/sdk/crt/string/i386/tcsnlen.inc
@@ -6,7 +6,7 @@ PUBLIC _tcsnlen
 .code
 
 FUNC _tcsnlen
-    FPO 0, 1, 1, 1, 0, FRAME_FPO
+    FPO 0, 2, 1, 1, 0, FRAME_FPO
     push edi
     mov edi, [esp + 8]
     mov ecx, [esp + 12]
diff --git a/ntoskrnl/se/accesschk.c b/ntoskrnl/se/accesschk.c
index 32daa917c86..5f59f5ab89e 100644
--- a/ntoskrnl/se/accesschk.c
+++ b/ntoskrnl/se/accesschk.c
@@ -18,8 +18,6 @@
 
 /* PRIVATE FUNCTIONS **********************************************************/
 
-#define OLD_ACCESS_CHECK
-
 BOOLEAN NTAPI
 SepAccessCheckEx(IN PSECURITY_DESCRIPTOR SecurityDescriptor,
                IN PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext,
@@ -48,6 +46,8 @@ SepAccessCheckEx(IN PSECURITY_DESCRIPTOR SecurityDescriptor,
     NTSTATUS Status;
     PAGED_CODE();
 
+    DPRINT("SepAccessCheckEx()\n");
+
     /* Check for no access desired */
     if (!DesiredAccess)
     {
@@ -210,11 +210,6 @@ SepAccessCheckEx(IN PSECURITY_DESCRIPTOR SecurityDescriptor,
             {
                 if (SepSidInToken(Token, Sid))
                 {
-#ifdef OLD_ACCESS_CHECK
-                    PreviouslyGrantedAccess = 0;
-                    Status = STATUS_ACCESS_DENIED;
-                    goto ReturnCommonStatus;
-#else
                     /* Map access rights from the ACE */
                     TempAccess = CurrentAce->AccessMask;
                     RtlMapGenericMask(&TempAccess, GenericMapping);
@@ -222,25 +217,21 @@ SepAccessCheckEx(IN PSECURITY_DESCRIPTOR SecurityDescriptor,
                     /* Leave if a remaining right must be denied */
                     if (RemainingAccess & TempAccess)
                         break;
-#endif
                 }
             }
             else if (CurrentAce->Header.AceType == ACCESS_ALLOWED_ACE_TYPE)
             {
                 if (SepSidInToken(Token, Sid))
                 {
-#ifdef OLD_ACCESS_CHECK
-                    TempAccess = CurrentAce->AccessMask;
-                    RtlMapGenericMask(&TempAccess, GenericMapping);
-                    PreviouslyGrantedAccess |= TempAccess;
-#else
                     /* Map access rights from the ACE */
                     TempAccess = CurrentAce->AccessMask;
+                    DPRINT("TempAccess 0x%08lx\n", TempAccess);
                     RtlMapGenericMask(&TempAccess, GenericMapping);
 
                     /* Remove granted rights */
+                    DPRINT("RemainingAccess 0x%08lx  TempAccess 0x%08lx\n", RemainingAccess, TempAccess);
                     RemainingAccess &= ~TempAccess;
-#endif
+                    DPRINT("RemainingAccess 0x%08lx\n", RemainingAccess);
                 }
             }
             else
@@ -253,58 +244,35 @@ SepAccessCheckEx(IN PSECURITY_DESCRIPTOR SecurityDescriptor,
         CurrentAce = (PACE)((ULONG_PTR)CurrentAce + CurrentAce->Header.AceSize);
     }
 
-#ifdef OLD_ACCESS_CHECK
-    DPRINT("PreviouslyGrantedAccess %08lx\n DesiredAccess %08lx\n",
-           PreviouslyGrantedAccess, DesiredAccess);
-
-    PreviouslyGrantedAccess &= DesiredAccess;
-
-    if ((PreviouslyGrantedAccess & ~VALID_INHERIT_FLAGS) ==
-        (DesiredAccess & ~VALID_INHERIT_FLAGS))
-    {
-        Status = STATUS_SUCCESS;
-        goto ReturnCommonStatus;
-    }
-    else
-    {
-        DPRINT1("HACK: Should deny access for caller: granted 0x%lx, desired 0x%lx (generic mapping %p).\n",
-                PreviouslyGrantedAccess, DesiredAccess, GenericMapping);
-        //*AccessStatus = STATUS_ACCESS_DENIED;
-        //return FALSE;
-        PreviouslyGrantedAccess = DesiredAccess;
-        Status = STATUS_SUCCESS;
-        goto ReturnCommonStatus;
-    }
-#else
     DPRINT("DesiredAccess %08lx\nPreviouslyGrantedAccess %08lx\nRemainingAccess %08lx\n",
            DesiredAccess, PreviouslyGrantedAccess, RemainingAccess);
 
     /* Fail if some rights have not been granted */
     if (RemainingAccess != 0)
     {
-        *GrantedAccess = 0;
+        DPRINT1("HACK: RemainingAccess = 0x%08lx  DesiredAccess = 0x%08lx\n", RemainingAccess, DesiredAccess);
+#if 0
+        /* HACK HACK HACK */
         Status = STATUS_ACCESS_DENIED;
         goto ReturnCommonStatus;
+#endif
     }
 
     /* Set granted access rights */
     PreviouslyGrantedAccess |= DesiredAccess;
 
-    DPRINT("GrantedAccess %08lx\n", *GrantedAccess);
-
     /* Fail if no rights have been granted */
     if (PreviouslyGrantedAccess == 0)
     {
+        DPRINT1("PreviouslyGrantedAccess == 0  DesiredAccess = %08lx\n", DesiredAccess);
         Status = STATUS_ACCESS_DENIED;
         goto ReturnCommonStatus;
     }
 
     Status = STATUS_SUCCESS;
     goto ReturnCommonStatus;
-#endif
 
 ReturnCommonStatus:
-
     ResultListLength = UseResultList ? ObjectTypeListLength : 1;
     for (i = 0; i < ResultListLength; i++)
     {
diff --git a/subsystems/ntvdm/bios/vidbios.c b/subsystems/ntvdm/bios/vidbios.c
index 3948121b74c..bb5e5376136 100644
--- a/subsystems/ntvdm/bios/vidbios.c
+++ b/subsystems/ntvdm/bios/vidbios.c
@@ -2296,9 +2296,16 @@ static BOOLEAN VidBiosSetVideoMode(BYTE ModeNumber)
 {
     BYTE Page;
     COORD Resolution;
-    BOOLEAN DoNotClear = !!(ModeNumber & 0x80);
     PVGA_REGISTERS VgaMode;
 
+    /*
+     * IBM standard modes do not clear the screen if the
+     * high bit of AL is set (EGA or higher only).
+     * See Ralf Brown: http://www.ctyme.com/intr/rb-0069.htm
+     * for more information.
+     */
+    BOOLEAN DoNotClear = !!(ModeNumber & 0x80);
+
     /* Retrieve the real mode number and check its validity */
     ModeNumber &= 0x7F;
     // if (ModeNumber >= sizeof(VideoModes)/sizeof(VideoModes[0]))
@@ -2308,6 +2315,14 @@ static BOOLEAN VidBiosSetVideoMode(BYTE ModeNumber)
         return FALSE;
     }
 
+    /* Check if this is the current mode */
+    if (ModeNumber == Bda->VideoMode)
+    {
+        /* Just clear the VGA memory if needed */
+        if (!DoNotClear) VgaClearMemory();
+        return TRUE;
+    }
+
     VgaMode = VideoModes[ModeNumber];
 
     DPRINT1("Switching to mode %02Xh %s clearing the screen; VgaMode = 0x%p\n",
@@ -2317,12 +2332,7 @@ static BOOLEAN VidBiosSetVideoMode(BYTE ModeNumber)
 
     VgaChangePalette(ModeNumber);
 
-    /*
-     * IBM standard modes do not clear the screen if the
-     * high bit of AL is set (EGA or higher only).
-     * See Ralf Brown: http://www.ctyme.com/intr/rb-0069.htm
-     * for more information.
-     */
+    /* Clear the VGA memory if needed */
     if (!DoNotClear) VgaClearMemory();
 
     // Bda->CrtModeControl;
diff --git a/subsystems/ntvdm/clock.c b/subsystems/ntvdm/clock.c
index bd4ff2e55ca..45b440a51f0 100644
--- a/subsystems/ntvdm/clock.c
+++ b/subsystems/ntvdm/clock.c
@@ -149,7 +149,7 @@ VOID ClockUpdate(VOID)
 #ifdef IPS_DISPLAY
     if ((CurrentTickCount - LastCyclePrintout) >= 1000)
     {
-        DPRINT1("NTVDM: %lu Instructions Per Second; TimerTicks = %I64d\n", Cycles * 1000 / (CurrentTickCount - LastCyclePrintout), TimerTicks);
+        DPRINT1("NTVDM: %I64u Instructions Per Second; TimerTicks = %I64d\n", Cycles * 1000 / (CurrentTickCount - LastCyclePrintout), TimerTicks);
         LastCyclePrintout = CurrentTickCount;
         Cycles = 0;
     }
diff --git a/subsystems/ntvdm/cpu/registers.c b/subsystems/ntvdm/cpu/registers.c
index a326fda00d1..7056787e0e5 100644
--- a/subsystems/ntvdm/cpu/registers.c
+++ b/subsystems/ntvdm/cpu/registers.c
@@ -39,6 +39,7 @@ getIntelRegistersPointer(VOID)
         IntelRegPtr.Dr7 = EmulatorContext.DebugRegisters[FAST486_REG_DR7];
     }
 
+#ifndef FAST486_NO_FPU
     if (IntelRegPtr.ContextFlags & CONTEXT_FLOATING_POINT)
     {
         // IntelRegPtr.FloatSave = ;
@@ -52,6 +53,7 @@ getIntelRegistersPointer(VOID)
         // IntelRegPtr.FloatSave.RegisterArea  = ; // This is a region of size SIZE_OF_80387_REGISTERS == 80 bytes
         // IntelRegPtr.FloatSave.Cr0NpxState   = ;
     }
+#endif
 
     if (IntelRegPtr.ContextFlags & CONTEXT_SEGMENTS)
     {
diff --git a/subsystems/ntvdm/dos/dos32krnl/dos.c b/subsystems/ntvdm/dos/dos32krnl/dos.c
index f98ef757ba0..582e43c558a 100644
--- a/subsystems/ntvdm/dos/dos32krnl/dos.c
+++ b/subsystems/ntvdm/dos/dos32krnl/dos.c
@@ -20,6 +20,9 @@
 
 #include "bios/bios.h"
 
+#include "io.h"
+#include "hardware/ps2.h"
+
 /* PRIVATE VARIABLES **********************************************************/
 
 CALLBACK16 DosContext;
@@ -1164,6 +1167,12 @@ DWORD DosStartProcess(IN LPCSTR ExecutablePath,
     /* Attach to the console */
     VidBiosAttachToConsole(); // FIXME: And in fact, attach the full NTVDM UI to the console
 
+    // HACK: Simulate a ENTER key release scancode on the PS/2 port because
+    // some apps expect to read a key release scancode (> 0x80) when they
+    // are started.
+    IOWriteB(PS2_CONTROL_PORT, 0xD2);     // Next write is for the first PS/2 port
+    IOWriteB(PS2_DATA_PORT, 0x80 | 0x1C); // ENTER key release
+
     /* Start simulation */
     SetEvent(VdmTaskEvent);
     CpuSimulate();
diff --git a/subsystems/ntvdm/emulator.c b/subsystems/ntvdm/emulator.c
index b8a43b6aeae..d2e95e27e15 100644
--- a/subsystems/ntvdm/emulator.c
+++ b/subsystems/ntvdm/emulator.c
@@ -250,12 +250,6 @@ VOID EmulatorTerminate(VOID)
     VdmRunning = FALSE;
 }
 
-VOID EmulatorInterrupt(BYTE Number)
-{
-    /* Call the Fast486 API */
-    Fast486Interrupt(&EmulatorContext, Number);
-}
-
 VOID EmulatorInterruptSignal(VOID)
 {
     /* Call the Fast486 API */
diff --git a/subsystems/ntvdm/emulator.h b/subsystems/ntvdm/emulator.h
index 4b4928e3313..3c209ccedf2 100644
--- a/subsystems/ntvdm/emulator.h
+++ b/subsystems/ntvdm/emulator.h
@@ -96,7 +96,6 @@ VOID EmulatorException(BYTE ExceptionNumber, LPWORD Stack);
 
 VOID EmulatorTerminate(VOID);
 
-VOID EmulatorInterrupt(BYTE Number);
 VOID EmulatorInterruptSignal(VOID);
 VOID EmulatorSetA20(BOOLEAN Enabled);
 
diff --git a/subsystems/ntvdm/hardware/keyboard.c b/subsystems/ntvdm/hardware/keyboard.c
index 5e98bf73e89..fbd1d7ac265 100644
--- a/subsystems/ntvdm/hardware/keyboard.c
+++ b/subsystems/ntvdm/hardware/keyboard.c
@@ -47,7 +47,7 @@ VOID KeyboardEventHandler(PKEY_EVENT_RECORD KeyEvent)
 
 BOOLEAN KeyboardInit(BYTE PS2Connector)
 {
-    /* Finish to plug the mouse to the specified PS/2 port */
+    /* Finish to plug the keyboard to the specified PS/2 port */
     PS2Port = PS2Connector;
     PS2SetDeviceCmdProc(PS2Port, NULL, KeyboardCommand);
 
diff --git a/subsystems/ntvdm/hardware/pic.c b/subsystems/ntvdm/hardware/pic.c
index b5de2b407c2..624c825c084 100644
--- a/subsystems/ntvdm/hardware/pic.c
+++ b/subsystems/ntvdm/hardware/pic.c
@@ -85,6 +85,12 @@ static VOID PicWriteCommand(BYTE Port, BYTE Value)
             /* Otherwise, clear all of them */
             Pic->InServiceRegister = 0;
         }
+
+        if (MasterPic.IntRequestRegister || SlavePic.IntRequestRegister)
+        {
+            /* Signal the next IRQ */
+            EmulatorInterruptSignal();
+        }
     }
 }
 
diff --git a/subsystems/ntvdm/hardware/ps2.c b/subsystems/ntvdm/hardware/ps2.c
index bfede556a03..b7e6c13a9af 100644
--- a/subsystems/ntvdm/hardware/ps2.c
+++ b/subsystems/ntvdm/hardware/ps2.c
@@ -80,11 +80,14 @@ static BYTE WINAPI PS2ReadPort(USHORT Port)
         if (StatusRegister &   (1 << 0)) // || StatusRegister &   (1 << 5) for second PS/2 port
             StatusRegister &= ~(1 << 0); //    StatusRegister &= ~(1 << 5);
 
+        // FIXME: We may check there whether there is data latched in
+        // PS2 ports 1 or 2 (keyboard or mouse) and retrieve it there...
+
         /* Always return the available byte stored in the output buffer */
         return OutputBuffer;
     }
 
-    return 0;
+    return 0x00;
 }
 
 static VOID WINAPI PS2WritePort(USHORT Port, BYTE Data)
@@ -270,7 +273,18 @@ static BOOLEAN PS2PortQueueRead(BYTE PS2Port)
     if (!Port->IsEnabled) return FALSE;
 
     /* Make sure the queue is not empty (fast check) */
-    if (Port->QueueEmpty) return FALSE;
+    if (Port->QueueEmpty)
+    {
+        /* Only the keyboard should have its last data latched */
+        // FIXME: Alternatively this can be done in PS2ReadPort when
+        // we read PS2_DATA_PORT. What is the best solution??
+        if (PS2Port == 0)
+        {
+            OutputBuffer = Port->Queue[(Port->QueueStart - 1) % BUFFER_SIZE];
+        }
+
+        return FALSE;
+    }
 
     WaitForSingleObject(Port->QueueMutex, INFINITE);
 
@@ -337,7 +351,7 @@ BOOLEAN PS2QueuePush(BYTE PS2Port, BYTE Data)
     Port->QueueEnd++;
     Port->QueueEnd %= BUFFER_SIZE;
 
-    /* Since we inserted a value, it's not empty anymore */
+    /* The queue is not empty anymore */
     Port->QueueEmpty = FALSE;
 
 /*
diff --git a/subsystems/ntvdm/hardware/vga.c b/subsystems/ntvdm/hardware/vga.c
index f2d34639720..5eaa863d3b8 100644
--- a/subsystems/ntvdm/hardware/vga.c
+++ b/subsystems/ntvdm/hardware/vga.c
@@ -1200,16 +1200,16 @@ static VOID VgaUpdateFramebuffer(VOID)
                     {
                         /* One byte per pixel */
                         PixelData = VgaMemory[(j % VGA_NUM_BANKS) * VGA_BANK_SIZE
-                                              + (Address + (j / VGA_NUM_BANKS))
-                                                * AddressSize];
+                                              + LOWORD((Address + (j / VGA_NUM_BANKS))
+                                              * AddressSize)];
                     }
                     else
                     {
                         /* 4-bits per pixel */
 
                         PixelData = VgaMemory[(j % VGA_NUM_BANKS) * VGA_BANK_SIZE
-                                              + (Address + (j / (VGA_NUM_BANKS * 2)))
-                                                * AddressSize];
+                                              + LOWORD((Address + (j / (VGA_NUM_BANKS * 2)))
+                                              * AddressSize)];
 
                         /* Check if we should use the highest 4 bits or lowest 4 */
                         if (((j / VGA_NUM_BANKS) % 2) == 0)
@@ -1240,8 +1240,8 @@ static VOID VgaUpdateFramebuffer(VOID)
                          */
                         DWORD BankNumber = (j / 4) % 2;
                         DWORD Offset = Address + (j / 8);
-                        BYTE LowPlaneData = VgaMemory[BankNumber * VGA_BANK_SIZE + Offset * AddressSize];
-                        BYTE HighPlaneData = VgaMemory[(BankNumber + 2) * VGA_BANK_SIZE + Offset * AddressSize];
+                        BYTE LowPlaneData = VgaMemory[BankNumber * VGA_BANK_SIZE + LOWORD(Offset * AddressSize)];
+                        BYTE HighPlaneData = VgaMemory[(BankNumber + 2) * VGA_BANK_SIZE + LOWORD(Offset * AddressSize)];
 
                         /* Extract the two bits from each plane */
                         LowPlaneData = (LowPlaneData >> (6 - ((j % 4) * 2))) & 3;
@@ -1264,8 +1264,8 @@ static VOID VgaUpdateFramebuffer(VOID)
                         {
                             /* The data is on plane k, 4 pixels per byte */
                             BYTE PlaneData = VgaMemory[k * VGA_BANK_SIZE
-                                                       + (Address + (j / VGA_NUM_BANKS))
-                                                         * AddressSize];
+                                                       + LOWORD((Address + (j / VGA_NUM_BANKS))
+                                                       * AddressSize)];
 
                             /* The mask of the first bit in the pair */
                             BYTE BitMask = 1 << (((3 - (j % VGA_NUM_BANKS)) * 2) + 1);
@@ -1284,8 +1284,8 @@ static VOID VgaUpdateFramebuffer(VOID)
                         for (k = 0; k < VGA_NUM_BANKS; k++)
                         {
                             BYTE PlaneData = VgaMemory[k * VGA_BANK_SIZE
-                                                       + (Address + (j / (VGA_NUM_BANKS * 2)))
-                                                         * AddressSize];
+                                                       + LOWORD((Address + (j / (VGA_NUM_BANKS * 2)))
+                                                       * AddressSize)];
 
                             /* If the bit on that plane is set, set it */
                             if (PlaneData & (1 << (7 - (j % 8)))) PixelData |= 1 << k;
@@ -1866,15 +1866,15 @@ VOID VgaReadMemory(DWORD Address, LPBYTE Buffer, DWORD Size)
     {
         VideoAddress = VgaTranslateReadAddress(Address + i);
 
-        /* Load the latch registers */
-        VgaLatchRegisters[0] = VgaMemory[LOWORD(VideoAddress)];
-        VgaLatchRegisters[1] = VgaMemory[VGA_BANK_SIZE + LOWORD(VideoAddress)];
-        VgaLatchRegisters[2] = VgaMemory[(2 * VGA_BANK_SIZE) + LOWORD(VideoAddress)];
-        VgaLatchRegisters[3] = VgaMemory[(3 * VGA_BANK_SIZE) + LOWORD(VideoAddress)];
-
         /* Copy the value to the buffer */
         Buffer[i] = VgaMemory[VideoAddress];
     }
+
+    /* Load the latch registers */
+    VgaLatchRegisters[0] = VgaMemory[LOWORD(VideoAddress)];
+    VgaLatchRegisters[1] = VgaMemory[VGA_BANK_SIZE + LOWORD(VideoAddress)];
+    VgaLatchRegisters[2] = VgaMemory[(2 * VGA_BANK_SIZE) + LOWORD(VideoAddress)];
+    VgaLatchRegisters[3] = VgaMemory[(3 * VGA_BANK_SIZE) + LOWORD(VideoAddress)];
 }
 
 VOID VgaWriteMemory(DWORD Address, LPBYTE Buffer, DWORD Size)
diff --git a/subsystems/ntvdm/io.c b/subsystems/ntvdm/io.c
index 2fd081bd85c..5ecce93c49f 100644
--- a/subsystems/ntvdm/io.c
+++ b/subsystems/ntvdm/io.c
@@ -37,7 +37,7 @@ typedef struct _EMULATOR_IO_HANDLERS
 
 typedef struct _EMULATOR_IOPORT_HANDLERS
 {
-    HANDLE hVdd; // == 0 if unused,
+    HANDLE hVdd; // == NULL if unused,
                  //    INVALID_HANDLE_VALUE if handled internally,
                  //    a valid VDD handle   if handled externally.
     union
@@ -65,7 +65,7 @@ IOReadB(USHORT Port)
     {
         return IoPortProc[Port].IoHandlers.InB(Port);
     }
-    else if (IoPortProc[Port].hVdd > 0 &&
+    else if (IoPortProc[Port].hVdd != NULL && IoPortProc[Port].hVdd != INVALID_HANDLE_VALUE &&
              IoPortProc[Port].VddIoHandlers.inb_handler)
     {
         UCHAR Data;
@@ -91,7 +91,7 @@ IOReadStrB(USHORT Port,
     {
         IoPortProc[Port].IoHandlers.InsB(Port, Buffer, Count);
     }
-    else if (IoPortProc[Port].hVdd > 0 &&
+    else if (IoPortProc[Port].hVdd != NULL && IoPortProc[Port].hVdd != INVALID_HANDLE_VALUE &&
              IoPortProc[Port].VddIoHandlers.insb_handler)
     {
         ASSERT(Port  <= MAXWORD);
@@ -113,7 +113,7 @@ IOWriteB(USHORT Port,
     {
         IoPortProc[Port].IoHandlers.OutB(Port, Buffer);
     }
-    else if (IoPortProc[Port].hVdd > 0 &&
+    else if (IoPortProc[Port].hVdd != NULL && IoPortProc[Port].hVdd != INVALID_HANDLE_VALUE &&
              IoPortProc[Port].VddIoHandlers.outb_handler)
     {
         ASSERT(Port <= MAXWORD);
@@ -136,7 +136,7 @@ IOWriteStrB(USHORT Port,
     {
         IoPortProc[Port].IoHandlers.OutsB(Port, Buffer, Count);
     }
-    else if (IoPortProc[Port].hVdd > 0 &&
+    else if (IoPortProc[Port].hVdd != NULL && IoPortProc[Port].hVdd != INVALID_HANDLE_VALUE &&
              IoPortProc[Port].VddIoHandlers.outsb_handler)
     {
         ASSERT(Port  <= MAXWORD);
@@ -157,7 +157,7 @@ IOReadW(USHORT Port)
     {
         return IoPortProc[Port].IoHandlers.InW(Port);
     }
-    else if (IoPortProc[Port].hVdd > 0 &&
+    else if (IoPortProc[Port].hVdd != NULL && IoPortProc[Port].hVdd != INVALID_HANDLE_VALUE &&
              IoPortProc[Port].VddIoHandlers.inw_handler)
     {
         USHORT Data;
@@ -186,7 +186,7 @@ IOReadStrW(USHORT  Port,
     {
         IoPortProc[Port].IoHandlers.InsW(Port, Buffer, Count);
     }
-    else if (IoPortProc[Port].hVdd > 0 &&
+    else if (IoPortProc[Port].hVdd != NULL && IoPortProc[Port].hVdd != INVALID_HANDLE_VALUE &&
              IoPortProc[Port].VddIoHandlers.insw_handler)
     {
         ASSERT(Port  <= MAXWORD);
@@ -208,7 +208,7 @@ IOWriteW(USHORT Port,
     {
         IoPortProc[Port].IoHandlers.OutW(Port, Buffer);
     }
-    else if (IoPortProc[Port].hVdd > 0 &&
+    else if (IoPortProc[Port].hVdd != NULL && IoPortProc[Port].hVdd != INVALID_HANDLE_VALUE &&
              IoPortProc[Port].VddIoHandlers.outw_handler)
     {
         ASSERT(Port <= MAXWORD);
@@ -232,7 +232,7 @@ IOWriteStrW(USHORT  Port,
     {
         IoPortProc[Port].IoHandlers.OutsW(Port, Buffer, Count);
     }
-    else if (IoPortProc[Port].hVdd > 0 &&
+    else if (IoPortProc[Port].hVdd != NULL && IoPortProc[Port].hVdd != INVALID_HANDLE_VALUE &&
              IoPortProc[Port].VddIoHandlers.outsw_handler)
     {
         ASSERT(Port  <= MAXWORD);
@@ -501,8 +501,8 @@ VDDInstallIOHook(HANDLE            hVdd,
                  PVDD_IO_PORTRANGE pPortRange,
                  PVDD_IO_HANDLERS  IOhandler)
 {
-    /* Check possible validity of the VDD handle */
-    if (hVdd == 0 || hVdd == INVALID_HANDLE_VALUE) return FALSE;
+    /* Check validity of the VDD handle */
+    if (hVdd == NULL || hVdd == INVALID_HANDLE_VALUE) return FALSE;
 
     /* Loop for each range of I/O ports */
     while (cPortRange--)
@@ -516,7 +516,7 @@ VDDInstallIOHook(HANDLE            hVdd,
              * Don't do anything if the I/O port is already
              * handled internally or externally.
              */
-            if (IoPortProc[i].hVdd != 0)
+            if (IoPortProc[i].hVdd != NULL)
             {
                 DPRINT1("IoPortProc[0x%X] already registered\n", i);
                 continue;
@@ -560,8 +560,8 @@ VDDDeInstallIOHook(HANDLE            hVdd,
                    WORD              cPortRange,
                    PVDD_IO_PORTRANGE pPortRange)
 {
-    /* Check possible validity of the VDD handle */
-    if (hVdd == 0 || hVdd == INVALID_HANDLE_VALUE) return;
+    /* Check validity of the VDD handle */
+    if (hVdd == NULL || hVdd == INVALID_HANDLE_VALUE) return;
 
     /* Loop for each range of I/O ports */
     while (cPortRange--)
diff --git a/subsystems/ntvdm/ntvdm.c b/subsystems/ntvdm/ntvdm.c
index ab75aff6530..8a194e16ce3 100644
--- a/subsystems/ntvdm/ntvdm.c
+++ b/subsystems/ntvdm/ntvdm.c
@@ -204,9 +204,9 @@ ConsoleCtrlHandler(DWORD ControlType)
         case CTRL_C_EVENT:
         case CTRL_BREAK_EVENT:
         {
-            /* Call INT 23h */
-            DPRINT1("Ctrl-C/Break: Call INT 23h\n");
-            EmulatorInterrupt(0x23);
+            /* HACK: Stop the VDM */
+            EmulatorTerminate();
+
             break;
         }
         case CTRL_LAST_CLOSE_EVENT:
diff --git a/win32ss/gdi/gdi32/CMakeLists.txt b/win32ss/gdi/gdi32/CMakeLists.txt
index 9ee18750776..1d60fe3e092 100644
--- a/win32ss/gdi/gdi32/CMakeLists.txt
+++ b/win32ss/gdi/gdi32/CMakeLists.txt
@@ -24,6 +24,7 @@ list(APPEND SOURCE
     objects/arc.c
     objects/bitmap.c
     objects/brush.c
+    objects/clientobj.c
     objects/coord.c
     objects/dc.c
     objects/eng.c
diff --git a/win32ss/gdi/gdi32/include/gdi32p.h b/win32ss/gdi/gdi32/include/gdi32p.h
index 8dc34994166..c453784036e 100644
--- a/win32ss/gdi/gdi32/include/gdi32p.h
+++ b/win32ss/gdi/gdi32/include/gdi32p.h
@@ -213,6 +213,10 @@ PLDC
 FASTCALL
 GdiGetLDC(HDC hDC);
 
+BOOL
+FASTCALL
+GdiSetLDC(HDC hdc, PVOID pvLDC);
+
 HGDIOBJ
 WINAPI
 GdiFixUpHandle(HGDIOBJ hGO);
@@ -236,11 +240,20 @@ ConvertBitmapInfo(
 
 DWORD
 WINAPI
-GetAndSetDCDWord( HDC, INT, DWORD, DWORD, DWORD, DWORD );
+GetAndSetDCDWord(
+    _In_ HDC hdc,
+    _In_ UINT u,
+    _In_ DWORD dwIn,
+    _In_ ULONG ulMFId,
+    _In_ USHORT usMF16Id,
+    _In_ DWORD dwError);
 
 DWORD
 WINAPI
-GetDCDWord( HDC, INT, DWORD);
+GetDCDWord(
+    _In_ HDC hdc,
+    _In_ UINT u,
+    _In_ DWORD dwError);
 
 HGDIOBJ
 WINAPI
@@ -360,9 +373,23 @@ FORCEINLINE
 PDC_ATTR
 GdiGetDcAttr(HDC hdc)
 {
+    GDILOOBJTYPE eDcObjType;
     PDC_ATTR pdcattr;
 
-    if (!GdiGetHandleUserData((HGDIOBJ)hdc, GDI_OBJECT_TYPE_DC, (PVOID*)&pdcattr)) return NULL;
+    /* Check DC object type */
+    eDcObjType = GDI_HANDLE_GET_TYPE(hdc);
+    if ((eDcObjType != GDILoObjType_LO_DC_TYPE) &&
+        (eDcObjType != GDILoObjType_LO_ALTDC_TYPE))
+    {
+        return NULL;
+    }
+
+    /* Get the DC attribute */
+    if (!GdiGetHandleUserData((HGDIOBJ)hdc, eDcObjType, (PVOID*)&pdcattr))
+    {
+        return NULL;
+    }
+
     return pdcattr;
 }
 
@@ -395,4 +422,20 @@ _lrintf(float f)
 #endif
 }
 
+HGDIOBJ
+WINAPI
+GdiInsertClientObj(
+    _In_ PVOID pvObject,
+    _In_ GDILOOBJTYPE eObjType);
+
+PVOID
+WINAPI
+GdiGetClientObject(
+    _In_ HGDIOBJ hobj);
+
+PVOID
+WINAPI
+GdiRemoveClientObject(
+    _In_ HGDIOBJ hobj);
+
 /* EOF */
diff --git a/win32ss/gdi/gdi32/main/dllmain.c b/win32ss/gdi/gdi32/main/dllmain.c
index c3a42a6746b..d6521c374bd 100644
--- a/win32ss/gdi/gdi32/main/dllmain.c
+++ b/win32ss/gdi/gdi32/main/dllmain.c
@@ -10,6 +10,7 @@ PDEVCAPS GdiDevCaps = NULL;
 PGDIHANDLECACHE GdiHandleCache = NULL;
 BOOL gbLpk = FALSE;
 RTL_CRITICAL_SECTION semLocal;
+extern CRITICAL_SECTION gcsClientObjLinks;
 
 /*
  * GDI32.DLL does have an entry point for disable threadlibrarycall,. The initialization is done by a call
@@ -49,6 +50,7 @@ GdiProcessSetup (VOID)
     GDI_BatchLimit = (DWORD) NtCurrentTeb()->ProcessEnvironmentBlock->GdiDCAttributeList;
     GdiHandleCache = (PGDIHANDLECACHE)NtCurrentTeb()->ProcessEnvironmentBlock->GdiHandleBuffer;
     RtlInitializeCriticalSection(&semLocal);
+    InitializeCriticalSection(&gcsClientObjLinks);
 }
 
 
diff --git a/win32ss/gdi/gdi32/misc/misc.c b/win32ss/gdi/gdi32/misc/misc.c
index f326114f129..9d6dae9e1df 100644
--- a/win32ss/gdi/gdi32/misc/misc.c
+++ b/win32ss/gdi/gdi32/misc/misc.c
@@ -145,41 +145,40 @@ BOOL GdiGetHandleUserData(HGDIOBJ hGdiObj, DWORD ObjectType, PVOID *UserData)
 
 PLDC
 FASTCALL
-GdiGetLDC(HDC hDC)
+GdiGetLDC(HDC hdc)
 {
-    PDC_ATTR Dc_Attr;
-    PGDI_TABLE_ENTRY Entry = GdiHandleTable + GDI_HANDLE_GET_INDEX((HGDIOBJ) hDC);
-    HANDLE pid = (HANDLE)((ULONG_PTR)Entry->ProcessId & ~0x1);
-    // Don't check the mask, just the object type.
-    if ( Entry->ObjectType == GDIObjType_DC_TYPE &&
-            (pid == NULL || pid == CurrentProcessId) )
-    {
-        BOOL Result = TRUE;
-        if (Entry->UserData)
-        {
-            volatile CHAR *Current = (volatile CHAR*)Entry->UserData;
-            _SEH2_TRY
-            {
-                *Current = *Current;
-            }
-            _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
-            {
-                Result = FALSE;
-            }
-            _SEH2_END
-        }
-        else
-            Result = FALSE;
+    PDC_ATTR pdcattr;
 
-        if (Result)
-        {
-            Dc_Attr = (PDC_ATTR)Entry->UserData;
-            return Dc_Attr->pvLDC;
-        }
+    /* Get the DC attribute */
+    pdcattr = GdiGetDcAttr(hdc);
+    if (pdcattr == NULL)
+    {
+        return NULL;
     }
-    return NULL;
+
+    /* Return the LDC pointer */
+    return pdcattr->pvLDC;
 }
 
+BOOL
+FASTCALL
+GdiSetLDC(HDC hdc, PVOID pvLDC)
+{
+    PDC_ATTR pdcattr;
+
+    /* Get the DC attribute */
+    pdcattr = GdiGetDcAttr(hdc);
+    if (pdcattr == NULL)
+    {
+        return FALSE;
+    }
+
+    /* Set the LDC pointer */
+    pdcattr->pvLDC = pvLDC;
+    return TRUE;
+}
+
+
 VOID GdiSAPCallback(PLDC pldc)
 {
     DWORD Time, NewTime = GetTickCount();
diff --git a/win32ss/gdi/gdi32/objects/clientobj.c b/win32ss/gdi/gdi32/objects/clientobj.c
new file mode 100644
index 00000000000..e59006f35a9
--- /dev/null
+++ b/win32ss/gdi/gdi32/objects/clientobj.c
@@ -0,0 +1,150 @@
+/*
+ * COPYRIGHT:       See COPYING in the top level directory
+ * PROJECT:         ReactOS WIN32 subsystem
+ * PURPOSE:         Support functions for GDI client objects
+ * PROGRAMMER:      Timo Kreuzer (timo.kreuzer@reactos.org)
+ */
+
+#include <precomp.h>
+
+CRITICAL_SECTION gcsClientObjLinks;
+
+typedef struct _CLIENTOBJLINK
+{
+    struct _CLIENTOBJLINK *pcolNext;
+    HGDIOBJ hobj;
+    PVOID pvObj;
+} CLIENTOBJLINK, *PCLIENTOBJLINK;
+
+PCLIENTOBJLINK gapcolHashTable[127];
+
+HGDIOBJ
+WINAPI
+GdiInsertClientObj(
+    _In_ PVOID pvObject,
+    _In_ GDILOOBJTYPE eObjType)
+{
+    PCLIENTOBJLINK pcol;
+    ULONG iHashIndex;
+    HGDIOBJ hobj;
+
+    /* Call win32k to create a client object handle */
+    hobj = NtGdiCreateClientObj(eObjType);
+    if (hobj == NULL)
+    {
+        return NULL;
+    }
+
+    /* Calculate the hash index */
+    iHashIndex = (ULONG_PTR)hobj % _countof(gapcolHashTable);
+
+    /* Allocate a link structure */
+    pcol = HeapAlloc(GetProcessHeap(), 0, sizeof(*pcol));
+    if (pcol == NULL)
+    {
+        NtGdiDeleteClientObj(hobj);
+        return NULL;
+    }
+
+    /* Setup the link structure */
+    pcol->hobj = hobj;
+    pcol->pvObj = pvObject;
+
+    /* Enter the critical section */
+    EnterCriticalSection(&gcsClientObjLinks);
+
+    /* Insert the link structure */
+    pcol->pcolNext = gapcolHashTable[iHashIndex];
+    gapcolHashTable[iHashIndex] = pcol;
+
+    /* Leave the critical section */
+    LeaveCriticalSection(&gcsClientObjLinks);
+
+    return hobj;
+}
+
+PVOID
+WINAPI
+GdiGetClientObject(
+    _In_ HGDIOBJ hobj)
+{
+    ULONG iHashIndex;
+    PCLIENTOBJLINK pcol;
+    PVOID pvObject = NULL;
+
+    /* Calculate the hash index */
+    iHashIndex = (ULONG_PTR)hobj % _countof(gapcolHashTable);
+
+    /* Enter the critical section */
+    EnterCriticalSection(&gcsClientObjLinks);
+
+    /* Loop the link entries in this hash bucket */
+    pcol = gapcolHashTable[iHashIndex];
+    while (pcol != NULL)
+    {
+        /* Check if this is the object we want */
+        if (pcol->hobj == hobj)
+        {
+            /* Get the object pointer and bail out */
+            pvObject = pcol->pvObj;
+            break;
+        }
+
+        /* Go to the next entry */
+        pcol = pcol->pcolNext;
+    }
+
+    /* Leave the critical section */
+    LeaveCriticalSection(&gcsClientObjLinks);
+
+    return pvObject;
+}
+
+PVOID
+WINAPI
+GdiRemoveClientObject(
+    _In_ HGDIOBJ hobj)
+{
+    PCLIENTOBJLINK pcol, *ppcol;
+    ULONG iHashIndex;
+    PVOID pvObject = NULL;
+
+    /* Calculate the hash index */
+    iHashIndex = (ULONG_PTR)hobj % _countof(gapcolHashTable);
+
+    /* Enter the critical section */
+    EnterCriticalSection(&gcsClientObjLinks);
+
+    /* Loop the link entries in this hash bucket */
+    ppcol = &gapcolHashTable[iHashIndex];
+    while (*ppcol != NULL)
+    {
+        /* Get the current client object link */
+        pcol = *ppcol;
+
+        /* Check if this is the one we want */
+        if (pcol->hobj == hobj)
+        {
+            /* Update the link pointer, removing this link */
+            *ppcol = pcol->pcolNext;
+
+            /* Get the object pointer */
+            pvObject = pcol->pvObj;
+
+            /* Free the link structure */
+            HeapFree(GetProcessHeap(), 0, pcol);
+
+            /* We're done */
+            break;
+        }
+
+        /* Go to the next link pointer */
+        ppcol = &(pcol->pcolNext);
+    }
+
+    /* Leave the critical section */
+    LeaveCriticalSection(&gcsClientObjLinks);
+
+    /* Return the object pointer, or NULL if we did not find it */
+    return pvObject;
+}
diff --git a/win32ss/gdi/gdi32/objects/dc.c b/win32ss/gdi/gdi32/objects/dc.c
index 3e0d52477b9..07eac4fb885 100644
--- a/win32ss/gdi/gdi32/objects/dc.c
+++ b/win32ss/gdi/gdi32/objects/dc.c
@@ -7,14 +7,15 @@ HGDIOBJ stock_objects[NB_STOCK_OBJECTS]; // temp location.
 
 HDC
 FASTCALL
-IntCreateDICW ( LPCWSTR   lpwszDriver,
-                LPCWSTR   lpwszDevice,
-                LPCWSTR   lpwszOutput,
-                PDEVMODEW lpInitData,
-                ULONG     iType )
+IntCreateDICW(
+    LPCWSTR lpwszDriver,
+    LPCWSTR lpwszDevice,
+    LPCWSTR lpwszOutput,
+    PDEVMODEW lpInitData,
+    ULONG iType)
 {
     UNICODE_STRING Device, Output;
-    HDC hDC = NULL;
+    HDC hdc = NULL;
     BOOL Display = FALSE, Default = FALSE;
     ULONG UMdhpdev = 0;
 
@@ -60,32 +61,32 @@ IntCreateDICW ( LPCWSTR   lpwszDriver,
         DPRINT1("Not a DISPLAY device! %wZ\n", &Device);
     }
 
-    hDC = NtGdiOpenDCW( (Default ? NULL : &Device),
-                        (PDEVMODEW) lpInitData,
-                        (lpwszOutput ? &Output : NULL),
-                        iType,             // DCW 0 and ICW 1.
-                        Display,
-                        hspool,
-                        (PVOID) NULL,       // NULL for now.
-                        (PVOID) &UMdhpdev );
+    hdc = NtGdiOpenDCW((Default ? NULL : &Device),
+                       (PDEVMODEW) lpInitData,
+                       (lpwszOutput ? &Output : NULL),
+                       iType,             // DCW 0 and ICW 1.
+                       Display,
+                       hspool,
+                       (PVOID) NULL,       // NULL for now.
+                       (PVOID) &UMdhpdev );
 #if 0
 // Handle something other than a normal dc object.
-    if (GDI_HANDLE_GET_TYPE(hDC) != GDI_OBJECT_TYPE_DC)
+    if (GDI_HANDLE_GET_TYPE(hdc) != GDI_OBJECT_TYPE_DC)
     {
         PDC_ATTR Dc_Attr;
         PLDC pLDC;
 
-        GdiGetHandleUserData((HGDIOBJ) hDC, GDI_OBJECT_TYPE_DC, (PVOID) &Dc_Attr);
+        GdiGetHandleUserData(hdc, GDI_OBJECT_TYPE_DC, (PVOID*)&Dc_Attr);
 
         pLDC = LocalAlloc(LMEM_ZEROINIT, sizeof(LDC));
 
         Dc_Attr->pvLDC = pLDC;
-        pLDC->hDC = hDC;
+        pLDC->hDC = hdc;
         pLDC->iType = LDC_LDC; // 1 (init) local DC, 2 EMF LDC
         DbgPrint("DC_ATTR Allocated -> 0x%x\n",Dc_Attr);
     }
 #endif
-    return hDC;
+    return hdc;
 }
 
 
@@ -94,22 +95,24 @@ IntCreateDICW ( LPCWSTR   lpwszDriver,
  */
 HDC
 WINAPI
-CreateCompatibleDC ( HDC hdc)
+CreateCompatibleDC(
+    _In_ HDC hdc)
 {
-    HDC rhDC;
-// PDC_ATTR Dc_Attr;
+    HDC hdcNew;
+// PDC_ATTR pdcattr;
 
-    rhDC = NtGdiCreateCompatibleDC(hdc);
+    hdcNew = NtGdiCreateCompatibleDC(hdc);
 #if 0
-    if ( hdc && rhDC)
+    if ( hdc && hdcNew)
     {
-        if (GdiGetHandleUserData((HGDIOBJ) hdc, GDI_OBJECT_TYPE_DC, (PVOID) &Dc_Attr))
+        if (GdiGetHandleUserData(hdc, GDI_OBJECT_TYPE_DC, (PVOID*)&pdcattr))
         {
-            if ( Dc_Attr->pvLIcm ) IcmCompatibleDC(rhDC, hdc, Dc_Attr);
+            if (pdcattr->pvLIcm) IcmCompatibleDC(hdcNew, hdc, pdcattr);
         }
     }
 #endif
-    return rhDC;
+
+    return hdcNew;
 }
 
 /*
@@ -118,64 +121,68 @@ CreateCompatibleDC ( HDC hdc)
 HDC
 WINAPI
 CreateDCA (
-    LPCSTR		lpszDriver,
-    LPCSTR		lpszDevice,
-    LPCSTR		lpszOutput,
-    CONST DEVMODEA	* lpdvmInit
-)
+    LPCSTR lpszDriver,
+    LPCSTR lpszDevice,
+    LPCSTR lpszOutput,
+    CONST DEVMODEA * lpdvmInit)
 {
     ANSI_STRING DriverA, DeviceA, OutputA;
     UNICODE_STRING DriverU, DeviceU, OutputU;
     LPDEVMODEW dvmInitW = NULL;
-    HDC hDC;
+    HDC hdc;
 
     /*
      * If needed, convert to Unicode
      * any string parameter.
      */
 
-    if (NULL != lpszDriver)
+    if (lpszDriver != NULL)
     {
         RtlInitAnsiString(&DriverA, (LPSTR)lpszDriver);
         RtlAnsiStringToUnicodeString(&DriverU, &DriverA, TRUE);
     }
     else
+    {
         DriverU.Buffer = NULL;
-    if (NULL != lpszDevice)
+    }
+
+    if (lpszDevice != NULL)
     {
         RtlInitAnsiString(&DeviceA, (LPSTR)lpszDevice);
         RtlAnsiStringToUnicodeString(&DeviceU, &DeviceA, TRUE);
     }
     else
+    {
         DeviceU.Buffer = NULL;
-    if (NULL != lpszOutput)
+    }
+
+    if (lpszOutput != NULL)
     {
         RtlInitAnsiString(&OutputA, (LPSTR)lpszOutput);
         RtlAnsiStringToUnicodeString(&OutputU, &OutputA, TRUE);
     }
     else
+    {
         OutputU.Buffer = NULL;
+    }
 
-    if ( lpdvmInit )
+    if (lpdvmInit != NULL)
         dvmInitW = GdiConvertToDevmodeW((LPDEVMODEA)lpdvmInit);
 
-    hDC = IntCreateDICW ( DriverU.Buffer,
-                          DeviceU.Buffer,
-                          OutputU.Buffer,
-                          lpdvmInit ? dvmInitW : NULL,
-                          0 );
-    HEAP_free (dvmInitW);
-    /*
-     * Free Unicode parameters.
-     */
+    hdc = IntCreateDICW(DriverU.Buffer,
+                        DeviceU.Buffer,
+                        OutputU.Buffer,
+                        lpdvmInit ? dvmInitW : NULL,
+                        0);
+    HEAP_free(dvmInitW);
+
+    /* Free Unicode parameters. */
     RtlFreeUnicodeString(&DriverU);
     RtlFreeUnicodeString(&DeviceU);
     RtlFreeUnicodeString(&OutputU);
 
-    /*
-     * Return the possible DC handle.
-     */
-    return hDC;
+    /* Return the DC handle. */
+    return hdc;
 }
 
 
@@ -185,18 +192,16 @@ CreateDCA (
 HDC
 WINAPI
 CreateDCW (
-    LPCWSTR		lpwszDriver,
-    LPCWSTR		lpwszDevice,
-    LPCWSTR		lpwszOutput,
-    CONST DEVMODEW	*lpInitData
-)
+    LPCWSTR lpwszDriver,
+    LPCWSTR lpwszDevice,
+    LPCWSTR lpwszOutput,
+    CONST DEVMODEW *lpInitData)
 {
-
-    return  IntCreateDICW ( lpwszDriver,
-                            lpwszDevice,
-                            lpwszOutput,
-                            (PDEVMODEW) lpInitData,
-                            0 );
+    return IntCreateDICW(lpwszDriver,
+                         lpwszDevice,
+                         lpwszOutput,
+                         (PDEVMODEW)lpInitData,
+                         0);
 }
 
 
@@ -206,17 +211,16 @@ CreateDCW (
 HDC
 WINAPI
 CreateICW(
-    LPCWSTR		lpszDriver,
-    LPCWSTR		lpszDevice,
-    LPCWSTR		lpszOutput,
-    CONST DEVMODEW *lpdvmInit
-)
+    LPCWSTR lpszDriver,
+    LPCWSTR lpszDevice,
+    LPCWSTR lpszOutput,
+    CONST DEVMODEW *lpdvmInit)
 {
-    return IntCreateDICW ( lpszDriver,
-                           lpszDevice,
-                           lpszOutput,
-                           (PDEVMODEW) lpdvmInit,
-                           1 );
+    return IntCreateDICW(lpszDriver,
+                         lpszDevice,
+                         lpszOutput,
+                         (PDEVMODEW)lpdvmInit,
+                         1);
 }
 
 
@@ -226,48 +230,48 @@ CreateICW(
 HDC
 WINAPI
 CreateICA(
-    LPCSTR		lpszDriver,
-    LPCSTR		lpszDevice,
-    LPCSTR		lpszOutput,
-    CONST DEVMODEA *lpdvmInit
-)
+    LPCSTR lpszDriver,
+    LPCSTR lpszDevice,
+    LPCSTR lpszOutput,
+    CONST DEVMODEA *lpdvmInit)
 {
     NTSTATUS Status;
     LPWSTR lpszDriverW, lpszDeviceW, lpszOutputW;
     LPDEVMODEW dvmInitW = NULL;
-    HDC rc = 0;
+    HDC hdc = 0;
 
-    Status = HEAP_strdupA2W ( &lpszDriverW, lpszDriver );
-    if (!NT_SUCCESS (Status))
-        SetLastError (RtlNtStatusToDosError(Status));
+    Status = HEAP_strdupA2W(&lpszDriverW, lpszDriver);
+    if (!NT_SUCCESS(Status))
+        SetLastError(RtlNtStatusToDosError(Status));
     else
     {
-        Status = HEAP_strdupA2W ( &lpszDeviceW, lpszDevice );
-        if (!NT_SUCCESS (Status))
-            SetLastError (RtlNtStatusToDosError(Status));
+        Status = HEAP_strdupA2W(&lpszDeviceW, lpszDevice);
+        if (!NT_SUCCESS(Status))
+            SetLastError(RtlNtStatusToDosError(Status));
         else
         {
-            Status = HEAP_strdupA2W ( &lpszOutputW, lpszOutput );
-            if (!NT_SUCCESS (Status))
-                SetLastError (RtlNtStatusToDosError(Status));
+            Status = HEAP_strdupA2W(&lpszOutputW, lpszOutput);
+            if (!NT_SUCCESS(Status))
+                SetLastError(RtlNtStatusToDosError(Status));
             else
             {
-                if ( lpdvmInit )
+                if (lpdvmInit)
                     dvmInitW = GdiConvertToDevmodeW((LPDEVMODEA)lpdvmInit);
 
-                rc = IntCreateDICW ( lpszDriverW,
-                                     lpszDeviceW,
-                                     lpszOutputW,
-                                     lpdvmInit ? dvmInitW : NULL,
-                                     1 );
-                HEAP_free (dvmInitW);
-                HEAP_free ( lpszOutputW );
+                hdc = IntCreateDICW(lpszDriverW,
+                                    lpszDeviceW,
+                                    lpszOutputW,
+                                    lpdvmInit ? dvmInitW : NULL,
+                                    1 );
+                HEAP_free(dvmInitW);
+                HEAP_free(lpszOutputW);
             }
-            HEAP_free ( lpszDeviceW );
+            HEAP_free(lpszDeviceW);
         }
-        HEAP_free ( lpszDriverW );
+        HEAP_free(lpszDriverW);
     }
-    return rc;
+
+    return hdc;
 }
 
 
@@ -276,14 +280,14 @@ CreateICA(
  */
 BOOL
 WINAPI
-DeleteDC(HDC hDC)
+DeleteDC(HDC hdc)
 {
-    BOOL Ret = TRUE;
+    BOOL bResult = TRUE;
     PLDC pLDC = NULL;
     HANDLE hPrinter = NULL;
-    ULONG hType = GDI_HANDLE_GET_TYPE(hDC);
+    ULONG hType = GDI_HANDLE_GET_TYPE(hdc);
 
-    pLDC = GdiGetLDC(hDC);
+    pLDC = GdiGetLDC(hdc);
 
     if (hType != GDILoObjType_LO_DC_TYPE)
     {
@@ -293,24 +297,27 @@ DeleteDC(HDC hDC)
             SetLastError(ERROR_INVALID_HANDLE);
             return FALSE;
         }
-        if (pLDC->Flags & LDC_INIT_DOCUMENT) AbortDoc(hDC);
+        if (pLDC->Flags & LDC_INIT_DOCUMENT) AbortDoc(hdc);
         if (pLDC->hPrinter)
         {
-            DocumentEventEx(NULL, pLDC->hPrinter, hDC, DOCUMENTEVENT_DELETEDC, 0, NULL, 0, NULL);
+            DocumentEventEx(NULL, pLDC->hPrinter, hdc, DOCUMENTEVENT_DELETEDC, 0, NULL, 0, NULL);
             hPrinter = pLDC->hPrinter;
             pLDC->hPrinter = NULL;
         }
     }
 
-    Ret = NtGdiDeleteObjectApp(hDC);
+    bResult = NtGdiDeleteObjectApp(hdc);
 
-    if (Ret && pLDC )
+    if (bResult && pLDC)
     {
         DPRINT1("Delete the Local DC structure\n");
         LocalFree( pLDC );
     }
-    if (hPrinter) fpClosePrinter(hPrinter);
-    return Ret;
+
+    if (hPrinter)
+        fpClosePrinter(hPrinter);
+
+    return bResult;
 }
 
 /*
@@ -370,7 +377,7 @@ DeleteObject(HGDIOBJ hObject)
         PTEB pTeb;
         PGDIBSOBJECT pgO;
 
-        if ((!GdiGetHandleUserData(hObject, dwType, (PVOID) &Brh_Attr)) ||
+        if ((!GdiGetHandleUserData(hObject, dwType, (PVOID*)&Brh_Attr)) ||
             (Brh_Attr == NULL)) break;
 
         pTeb = NtCurrentTeb();
@@ -397,7 +404,8 @@ DeleteObject(HGDIOBJ hObject)
 
 INT
 WINAPI
-GetArcDirection( HDC hdc )
+GetArcDirection(
+    _In_ HDC hdc)
 {
     return GetDCDWord( hdc, GdiGetArcDirection, 0);
 }
@@ -405,9 +413,11 @@ GetArcDirection( HDC hdc )
 
 INT
 WINAPI
-SetArcDirection( HDC hdc, INT nDirection )
+SetArcDirection(
+   _In_ HDC hdc,
+   _In_ INT nDirection)
 {
-    return GetAndSetDCDWord( hdc, GdiGetSetArcDirection, nDirection, 0, 0, 0 );
+    return GetAndSetDCDWord(hdc, GdiGetSetArcDirection, nDirection, 0, 0, 0);
 }
 
 /*
@@ -428,9 +438,12 @@ GetCurrentObject(
         (uObjectType == OBJ_BRUSH) ||
         (uObjectType == OBJ_COLORSPACE))
     {
-        /* Get the dc attribute */
+        /* Get the DC attribute */
         pdcattr = GdiGetDcAttr(hdc);
-        if (!pdcattr) return NULL;
+        if (pdcattr == NULL)
+        {
+            return NULL;
+        }
     }
 
     /* Check what object was requested */
@@ -474,24 +487,25 @@ GetCurrentObject(
  */
 int
 WINAPI
-GetDeviceCaps(HDC hDC,
-              int i)
+GetDeviceCaps(
+    _In_ HDC hdc,
+    _In_ int nIndex)
 {
-    PDC_ATTR Dc_Attr;
+    PDC_ATTR pdcattr;
     PLDC pLDC;
     PDEVCAPS pDevCaps = GdiDevCaps; // Primary display device capabilities.
     DPRINT("Device CAPS1\n");
 
-    if (GDI_HANDLE_GET_TYPE(hDC) != GDI_OBJECT_TYPE_DC)
+    if (GDI_HANDLE_GET_TYPE(hdc) != GDI_OBJECT_TYPE_DC)
     {
-        if (GDI_HANDLE_GET_TYPE(hDC) == GDI_OBJECT_TYPE_METADC)
+        if (GDI_HANDLE_GET_TYPE(hdc) == GDI_OBJECT_TYPE_METADC)
         {
-            if ( i == TECHNOLOGY) return DT_METAFILE;
+            if (nIndex == TECHNOLOGY) return DT_METAFILE;
             return 0;
         }
         else
         {
-            pLDC = GdiGetLDC(hDC);
+            pLDC = GdiGetLDC(hdc);
             if ( !pLDC )
             {
                 SetLastError(ERROR_INVALID_HANDLE);
@@ -499,7 +513,7 @@ GetDeviceCaps(HDC hDC,
             }
             if (!(pLDC->Flags & LDC_DEVCAPS))
             {
-                if (!NtGdiGetDeviceCapsAll(hDC, &pLDC->DevCaps))
+                if (!NtGdiGetDeviceCapsAll(hdc, &pLDC->DevCaps))
                     SetLastError(ERROR_INVALID_PARAMETER);
                 pLDC->Flags |= LDC_DEVCAPS;
             }
@@ -508,14 +522,20 @@ GetDeviceCaps(HDC hDC,
     }
     else
     {
-        if (!GdiGetHandleUserData((HGDIOBJ) hDC, GDI_OBJECT_TYPE_DC, (PVOID) &Dc_Attr))
+        /* Get the DC attribute */
+        pdcattr = GdiGetDcAttr(hdc);
+        if (pdcattr == NULL)
+        {
+            SetLastError(ERROR_INVALID_PARAMETER);
             return 0;
-        if (!(Dc_Attr->ulDirty_ & DC_PRIMARY_DISPLAY) )
-            return NtGdiGetDeviceCaps(hDC,i);
+        }
+
+        if (!(pdcattr->ulDirty_ & DC_PRIMARY_DISPLAY) )
+            return NtGdiGetDeviceCaps(hdc, nIndex);
     }
     DPRINT("Device CAPS2\n");
 
-    switch (i)
+    switch (nIndex)
     {
     case DRIVERVERSION:
         return pDevCaps->ulVersion;
@@ -643,11 +663,10 @@ GetDeviceCaps(HDC hDC,
 DWORD
 WINAPI
 GetRelAbs(
-    HDC  hdc,
-    DWORD dwIgnore
-)
+    _In_ HDC hdc,
+    _In_ DWORD dwIgnore)
 {
-    return GetDCDWord( hdc, GdiGetRelAbs, 0);
+    return GetDCDWord(hdc, GdiGetRelAbs, 0);
 }
 
 
@@ -658,10 +677,9 @@ INT
 WINAPI
 SetRelAbs(
     HDC hdc,
-    INT Mode
-)
+    INT Mode)
 {
-    return GetAndSetDCDWord( hdc, GdiGetSetRelAbs, Mode, 0, 0, 0 );
+    return GetAndSetDCDWord(hdc, GdiGetSetRelAbs, Mode, 0, 0, 0);
 }
 
 
@@ -670,17 +688,25 @@ SetRelAbs(
  */
 DWORD
 WINAPI
-GetAndSetDCDWord( HDC hDC, INT u, DWORD dwIn, DWORD Unk1, DWORD Unk2, DWORD Unk3 )
+GetAndSetDCDWord(
+    _In_ HDC hdc,
+    _In_ UINT u,
+    _In_ DWORD dwIn,
+    _In_ ULONG ulMFId,
+    _In_ USHORT usMF16Id,
+    _In_ DWORD dwError)
 {
+    DWORD dwResult;
     BOOL Ret = TRUE;
-// Handle something other than a normal dc object.
-    if (GDI_HANDLE_GET_TYPE(hDC) != GDI_OBJECT_TYPE_DC)
+
+    /* Handle something other than a normal dc object. */
+    if (GDI_HANDLE_GET_TYPE(hdc) != GDI_OBJECT_TYPE_DC)
     {
-        if (GDI_HANDLE_GET_TYPE(hDC) == GDI_OBJECT_TYPE_METADC)
+        if (GDI_HANDLE_GET_TYPE(hdc) == GDI_OBJECT_TYPE_METADC)
             return 0; //call MFDRV
         else
         {
-            PLDC pLDC = GdiGetLDC(hDC);
+            PLDC pLDC = GdiGetLDC(hdc);
             if ( !pLDC )
             {
                 SetLastError(ERROR_INVALID_HANDLE);
@@ -695,12 +721,14 @@ GetAndSetDCDWord( HDC hDC, INT u, DWORD dwIn, DWORD Unk1, DWORD Unk2, DWORD Unk3
             }
         }
     }
-    Ret = NtGdiGetAndSetDCDword( hDC, u, dwIn, (DWORD*) &u );
-    if (Ret)
-        return u;
-    else
+
+    if (!NtGdiGetAndSetDCDword(hdc, u, dwIn, &dwResult))
+    {
         SetLastError(ERROR_INVALID_HANDLE);
-    return 0;
+        return 0;
+    }
+
+    return dwResult;
 }
 
 
@@ -709,11 +737,19 @@ GetAndSetDCDWord( HDC hDC, INT u, DWORD dwIn, DWORD Unk1, DWORD Unk2, DWORD Unk3
  */
 DWORD
 WINAPI
-GetDCDWord( HDC hDC, INT u, DWORD Result )
+GetDCDWord(
+    _In_ HDC hdc,
+    _In_ UINT u,
+    _In_ DWORD dwError)
 {
-    BOOL Ret = NtGdiGetDCDword( hDC, u, (DWORD*) &u );
-    if (!Ret) return Result;
-    else return u;
+    DWORD dwResult;
+
+    if (!NtGdiGetDCDword(hdc, u, &dwResult))
+    {
+        return dwError;
+    }
+
+    return dwResult;
 }
 
 
@@ -724,10 +760,9 @@ BOOL
 WINAPI
 GetAspectRatioFilterEx(
     HDC hdc,
-    LPSIZE lpAspectRatio
-)
+    LPSIZE lpAspectRatio)
 {
-    return NtGdiGetDCPoint( hdc, GdiGetAspectRatioFilter, (PPOINTL) lpAspectRatio );
+    return NtGdiGetDCPoint(hdc, GdiGetAspectRatioFilter, (PPOINTL)lpAspectRatio );
 }
 
 
@@ -738,8 +773,7 @@ BOOL
 WINAPI
 GetDCOrgEx(
     HDC hdc,
-    LPPOINT lpPoint
-)
+    LPPOINT lpPoint)
 {
     return NtGdiGetDCPoint( hdc, GdiGetDCOrg, (PPOINTL)lpPoint );
 }
@@ -766,7 +800,10 @@ GetDCOrg(
  */
 int
 WINAPI
-GetObjectW(HGDIOBJ hGdiObj, int cbSize, LPVOID lpBuffer)
+GetObjectW(
+    _In_ HGDIOBJ hGdiObj,
+    _In_ int cbSize,
+    _Out_ LPVOID lpBuffer)
 {
     DWORD dwType;
     INT cbResult = 0;
@@ -858,7 +895,10 @@ GetObjectW(HGDIOBJ hGdiObj, int cbSize, LPVOID lpBuffer)
 
 ULONG
 WINAPI
-GetFontObjectA(HGDIOBJ hfont, ULONG cbSize, LPVOID lpBuffer)
+GetFontObjectA(
+    _In_ HGDIOBJ hfont,
+    _In_ ULONG cbSize,
+    _Out_ LPVOID lpBuffer)
 {
     ENUMLOGFONTEXDVW elfedvW;
     ENUMLOGFONTEXDVA elfedvA;
@@ -904,7 +944,10 @@ GetFontObjectA(HGDIOBJ hfont, ULONG cbSize, LPVOID lpBuffer)
  */
 int
 WINAPI
-GetObjectA(HGDIOBJ hGdiObj, int cbSize, LPVOID lpBuffer)
+GetObjectA(
+    _In_ HGDIOBJ hGdiObj,
+    _In_ int cbSize,
+    _Out_ LPVOID lpBuffer)
 {
     DWORD dwType = GDI_HANDLE_GET_TYPE(hGdiObj);
 
@@ -927,13 +970,19 @@ GetObjectA(HGDIOBJ hGdiObj, int cbSize, LPVOID lpBuffer)
 COLORREF
 WINAPI
 GetDCBrushColor(
-    HDC hdc
-)
+    _In_ HDC hdc)
 {
-    PDC_ATTR Dc_Attr;
+    PDC_ATTR pdcattr;
 
-    if (!GdiGetHandleUserData((HGDIOBJ) hdc, GDI_OBJECT_TYPE_DC, (PVOID) &Dc_Attr)) return CLR_INVALID;
-    return (COLORREF) Dc_Attr->ulBrushClr;
+    /* Get the DC attribute */
+    pdcattr = GdiGetDcAttr(hdc);
+    if (pdcattr == NULL)
+    {
+        SetLastError(ERROR_INVALID_PARAMETER);
+        return CLR_INVALID;
+    }
+
+    return pdcattr->ulBrushClr;
 }
 
 /*
@@ -942,13 +991,19 @@ GetDCBrushColor(
 COLORREF
 WINAPI
 GetDCPenColor(
-    HDC hdc
-)
+    _In_ HDC hdc)
 {
-    PDC_ATTR Dc_Attr;
+    PDC_ATTR pdcattr;
 
-    if (!GdiGetHandleUserData((HGDIOBJ) hdc, GDI_OBJECT_TYPE_DC, (PVOID) &Dc_Attr)) return CLR_INVALID;
-    return (COLORREF) Dc_Attr->ulPenClr;
+    /* Get the DC attribute */
+    pdcattr = GdiGetDcAttr(hdc);
+    if (pdcattr == NULL)
+    {
+        SetLastError(ERROR_INVALID_PARAMETER);
+        return CLR_INVALID;
+    }
+
+    return pdcattr->ulPenClr;
 }
 
 /*
@@ -957,26 +1012,31 @@ GetDCPenColor(
 COLORREF
 WINAPI
 SetDCBrushColor(
-    HDC hdc,
-    COLORREF crColor
-)
+    _In_ HDC hdc,
+    _In_ COLORREF crColor)
 {
-    PDC_ATTR Dc_Attr;
-    COLORREF OldColor = CLR_INVALID;
+    PDC_ATTR pdcattr;
+    COLORREF crOldColor;
 
-    if (!GdiGetHandleUserData((HGDIOBJ) hdc, GDI_OBJECT_TYPE_DC, (PVOID) &Dc_Attr)) return OldColor;
-    else
+    /* Get the DC attribute */
+    pdcattr = GdiGetDcAttr(hdc);
+    if (pdcattr == NULL)
     {
-        OldColor = (COLORREF) Dc_Attr->ulBrushClr;
-        Dc_Attr->ulBrushClr = (ULONG) crColor;
-
-        if ( Dc_Attr->crBrushClr != crColor ) // if same, don't force a copy.
-        {
-            Dc_Attr->ulDirty_ |= DIRTY_FILL;
-            Dc_Attr->crBrushClr = crColor;
-        }
+        SetLastError(ERROR_INVALID_PARAMETER);
+        return CLR_INVALID;
     }
-    return OldColor;
+
+    /* Get old color and store the new */
+    crOldColor = pdcattr->ulBrushClr;
+    pdcattr->ulBrushClr = crColor;
+
+    if (pdcattr->crBrushClr != crColor)
+    {
+        pdcattr->ulDirty_ |= DIRTY_FILL;
+        pdcattr->crBrushClr = crColor;
+    }
+
+    return crOldColor;
 }
 
 /*
@@ -989,18 +1049,18 @@ SetDCPenColor(
     _In_ COLORREF crColor)
 {
     PDC_ATTR pdcattr;
-    COLORREF OldColor;
+    COLORREF crOldColor;
 
-    /* Get the dc attribute */
+    /* Get the DC attribute */
     pdcattr = GdiGetDcAttr(hdc);
-    if (!pdcattr)
+    if (pdcattr == NULL)
     {
         SetLastError(ERROR_INVALID_PARAMETER);
         return CLR_INVALID;
     }
 
     /* Get old color and store the new */
-    OldColor = (COLORREF)pdcattr->ulPenClr;
+    crOldColor = pdcattr->ulPenClr;
     pdcattr->ulPenClr = (ULONG)crColor;
 
     if (pdcattr->crPenClr != crColor)
@@ -1009,7 +1069,7 @@ SetDCPenColor(
         pdcattr->crPenClr = crColor;
     }
 
-    return OldColor;
+    return crOldColor;
 }
 
 /*
@@ -1018,11 +1078,20 @@ SetDCPenColor(
  */
 COLORREF
 WINAPI
-GetBkColor(HDC hdc)
+GetBkColor(
+    _In_ HDC hdc)
 {
-    PDC_ATTR Dc_Attr;
-    if (!GdiGetHandleUserData((HGDIOBJ) hdc, GDI_OBJECT_TYPE_DC, (PVOID) &Dc_Attr)) return 0;
-    return Dc_Attr->ulBackgroundClr;
+    PDC_ATTR pdcattr;
+
+    /* Get the DC attribute */
+    pdcattr = GdiGetDcAttr(hdc);
+    if (pdcattr == NULL)
+    {
+        /* Don't set LastError here! */
+        return CLR_INVALID;
+    }
+
+    return pdcattr->ulBackgroundClr;
 }
 
 /*
@@ -1031,22 +1100,28 @@ GetBkColor(HDC hdc)
 COLORREF
 WINAPI
 SetBkColor(
-    HDC hdc,
-    COLORREF crColor
-)
+    _In_ HDC hdc,
+    _In_ COLORREF crColor)
 {
-    PDC_ATTR Dc_Attr;
-    COLORREF OldColor = CLR_INVALID;
+    PDC_ATTR pdcattr;
+    COLORREF crOldColor;
 
-    if (!GdiGetHandleUserData((HGDIOBJ) hdc, GDI_OBJECT_TYPE_DC, (PVOID) &Dc_Attr)) return OldColor;
-#if 0
-    if (GDI_HANDLE_GET_TYPE(hDC) != GDI_OBJECT_TYPE_DC)
+    /* Get the DC attribute */
+    pdcattr = GdiGetDcAttr(hdc);
+    if (pdcattr == NULL)
     {
-        if (GDI_HANDLE_GET_TYPE(hDC) == GDI_OBJECT_TYPE_METADC)
-            return MFDRV_SetBkColor( hDC, crColor );
+        SetLastError(ERROR_INVALID_PARAMETER);
+        return CLR_INVALID;
+    }
+
+#if 0
+    if (GDI_HANDLE_GET_TYPE(hdc) != GDI_OBJECT_TYPE_DC)
+    {
+        if (GDI_HANDLE_GET_TYPE(hdc) == GDI_OBJECT_TYPE_METADC)
+            return MFDRV_SetBkColor(hdc, crColor );
         else
         {
-            PLDC pLDC = Dc_Attr->pvLDC;
+            PLDC pLDC = pdcattr->pvLDC;
             if ( !pLDC )
             {
                 SetLastError(ERROR_INVALID_HANDLE);
@@ -1054,20 +1129,23 @@ SetBkColor(
             }
             if (pLDC->iType == LDC_EMFLDC)
             {
-                return EMFDRV_SetBkColor( hDC, crColor );
+                return EMFDRV_SetBkColor(hdc, crColor );
             }
         }
     }
 #endif
-    OldColor = (COLORREF) Dc_Attr->ulBackgroundClr;
-    Dc_Attr->ulBackgroundClr = (ULONG) crColor;
 
-    if ( Dc_Attr->crBackgroundClr != crColor )
+    /* Get old color and store the new */
+    crOldColor = pdcattr->ulBackgroundClr;
+    pdcattr->ulBackgroundClr = crColor;
+
+    if (pdcattr->crBackgroundClr != crColor)
     {
-        Dc_Attr->ulDirty_ |= (DIRTY_BACKGROUND|DIRTY_LINE|DIRTY_FILL);
-        Dc_Attr->crBackgroundClr = crColor;
+        pdcattr->ulDirty_ |= (DIRTY_BACKGROUND|DIRTY_LINE|DIRTY_FILL);
+        pdcattr->crBackgroundClr = crColor;
     }
-    return OldColor;
+
+    return crOldColor;
 }
 
 /*
@@ -1078,9 +1156,17 @@ int
 WINAPI
 GetBkMode(HDC hdc)
 {
-    PDC_ATTR Dc_Attr;
-    if (!GdiGetHandleUserData((HGDIOBJ) hdc, GDI_OBJECT_TYPE_DC, (PVOID) &Dc_Attr)) return 0;
-    return Dc_Attr->lBkMode;
+    PDC_ATTR pdcattr;
+
+    /* Get the DC attribute */
+    pdcattr = GdiGetDcAttr(hdc);
+    if (pdcattr == NULL)
+    {
+        /* Don't set LastError here! */
+        return 0;
+    }
+
+    return pdcattr->lBkMode;
 }
 
 /*
@@ -1089,37 +1175,47 @@ GetBkMode(HDC hdc)
  */
 int
 WINAPI
-SetBkMode(HDC hdc,
-          int iBkMode)
+SetBkMode(
+    _In_ HDC hdc,
+    _In_ int iBkMode)
 {
-    PDC_ATTR Dc_Attr;
-    INT OldMode = 0;
+    PDC_ATTR pdcattr;
+    INT iOldMode;
+
+    /* Get the DC attribute */
+    pdcattr = GdiGetDcAttr(hdc);
+    if (pdcattr == NULL)
+    {
+        SetLastError(ERROR_INVALID_PARAMETER);
+        return 0;
+    }
 
-    if (!GdiGetHandleUserData((HGDIOBJ) hdc, GDI_OBJECT_TYPE_DC, (PVOID) &Dc_Attr)) return OldMode;
 #if 0
     if (GDI_HANDLE_GET_TYPE(hdc) != GDI_OBJECT_TYPE_DC)
     {
         if (GDI_HANDLE_GET_TYPE(hdc) == GDI_OBJECT_TYPE_METADC)
             return MFDRV_SetBkMode( hdc, iBkMode )
-                   else
+        else
+        {
+            PLDC pLDC = pdcattr->pvLDC;
+            if ( !pLDC )
             {
-                PLDC pLDC = Dc_Attr->pvLDC;
-                if ( !pLDC )
-                {
-                    SetLastError(ERROR_INVALID_HANDLE);
-                    return FALSE;
-                }
-                if (pLDC->iType == LDC_EMFLDC)
-                {
-                    return EMFDRV_SetBkMode( hdc, iBkMode )
-                       }
-                   }
-           }
+                SetLastError(ERROR_INVALID_HANDLE);
+                return FALSE;
+            }
+            if (pLDC->iType == LDC_EMFLDC)
+            {
+                return EMFDRV_SetBkMode(hdc, iBkMode)
+            }
+        }
+    }
 #endif
-           OldMode = Dc_Attr->lBkMode;
-    Dc_Attr->jBkMode = iBkMode; // Processed
-    Dc_Attr->lBkMode = iBkMode; // Raw
-    return OldMode;
+
+    iOldMode = pdcattr->lBkMode;
+    pdcattr->jBkMode = iBkMode; // Processed
+    pdcattr->lBkMode = iBkMode; // Raw
+
+    return iOldMode;
 }
 
 /*
@@ -1130,9 +1226,18 @@ int
 WINAPI
 GetPolyFillMode(HDC hdc)
 {
-    PDC_ATTR Dc_Attr;
-    if (!GdiGetHandleUserData((HGDIOBJ) hdc, GDI_OBJECT_TYPE_DC, (PVOID) &Dc_Attr)) return 0;
-    return Dc_Attr->lFillMode;
+    PDC_ATTR pdcattr;
+
+    /* Get DC attribute */
+    pdcattr = GdiGetDcAttr(hdc);
+    if (pdcattr == NULL)
+    {
+        /* Don't set LastError here! */
+        return 0;
+    }
+
+    /* Return current fill mode */
+    return pdcattr->lFillMode;
 }
 
 /*
@@ -1140,11 +1245,13 @@ GetPolyFillMode(HDC hdc)
  */
 int
 WINAPI
-SetPolyFillMode(HDC hdc,
-                int iPolyFillMode)
+SetPolyFillMode(
+    _In_ HDC hdc,
+    _In_ int iPolyFillMode)
 {
-    INT fmode;
-    PDC_ATTR Dc_Attr;
+    INT iOldPolyFillMode;
+    PDC_ATTR pdcattr;
+
 #if 0
     if (GDI_HANDLE_GET_TYPE(hdc) != GDI_OBJECT_TYPE_DC)
     {
@@ -1165,21 +1272,28 @@ SetPolyFillMode(HDC hdc,
                    }
            }
 #endif
-           if (!GdiGetHandleUserData((HGDIOBJ) hdc, GDI_OBJECT_TYPE_DC, (PVOID) &Dc_Attr)) return 0;
+
+    /* Get the DC attribute */
+    pdcattr = GdiGetDcAttr(hdc);
+    if (pdcattr == NULL)
+    {
+        SetLastError(ERROR_INVALID_PARAMETER);
+        return 0;
+    }
 
     if (NtCurrentTeb()->GdiTebBatch.HDC == hdc)
     {
-        if (Dc_Attr->ulDirty_ & DC_MODE_DIRTY)
+        if (pdcattr->ulDirty_ & DC_MODE_DIRTY)
         {
-            NtGdiFlush(); // Sync up Dc_Attr from Kernel space.
-            Dc_Attr->ulDirty_ &= ~(DC_MODE_DIRTY|DC_FONTTEXT_DIRTY);
+            NtGdiFlush(); // Sync up pdcattr from Kernel space.
+            pdcattr->ulDirty_ &= ~(DC_MODE_DIRTY|DC_FONTTEXT_DIRTY);
         }
     }
 
-    fmode = Dc_Attr->lFillMode;
-    Dc_Attr->lFillMode = iPolyFillMode;
+    iOldPolyFillMode = pdcattr->lFillMode;
+    pdcattr->lFillMode = iPolyFillMode;
 
-    return fmode;
+    return iOldPolyFillMode;
 }
 
 /*
@@ -1190,9 +1304,18 @@ int
 WINAPI
 GetGraphicsMode(HDC hdc)
 {
-    PDC_ATTR Dc_Attr;
-    if (!GdiGetHandleUserData((HGDIOBJ) hdc, GDI_OBJECT_TYPE_DC, (PVOID) &Dc_Attr)) return 0;
-    return Dc_Attr->iGraphicsMode;
+    PDC_ATTR pdcattr;
+
+    /* Get the DC attribute */
+    pdcattr = GdiGetDcAttr(hdc);
+    if (pdcattr == NULL)
+    {
+        /* Don't set LastError here! */
+        return 0;
+    }
+
+    /* Return current graphics mode */
+    return pdcattr->iGraphicsMode;
 }
 
 /*
@@ -1200,37 +1323,50 @@ GetGraphicsMode(HDC hdc)
  */
 int
 WINAPI
-SetGraphicsMode(HDC hdc,
-                int iMode)
+SetGraphicsMode(
+    _In_ HDC hdc,
+    _In_ int iMode)
 {
-    INT oMode;
-    PDC_ATTR Dc_Attr;
+    INT iOldMode;
+    PDC_ATTR pdcattr;
+
+    /* Check parameters */
     if ((iMode < GM_COMPATIBLE) || (iMode > GM_ADVANCED))
     {
         SetLastError(ERROR_INVALID_PARAMETER);
         return 0;
     }
-    if (!GdiGetHandleUserData((HGDIOBJ) hdc, GDI_OBJECT_TYPE_DC, (PVOID) &Dc_Attr)) return 0;
 
-    if (iMode == Dc_Attr->iGraphicsMode) return iMode;
+    /* Get the DC attribute */
+    pdcattr = GdiGetDcAttr(hdc);
+    if (pdcattr == NULL)
+    {
+        SetLastError(ERROR_INVALID_PARAMETER);
+        return 0;
+    }
+
+    /* Check for trivial case */
+    if (iMode == pdcattr->iGraphicsMode)
+        return iMode;
 
     if (NtCurrentTeb()->GdiTebBatch.HDC == hdc)
     {
-        if (Dc_Attr->ulDirty_ & DC_MODE_DIRTY)
+        if (pdcattr->ulDirty_ & DC_MODE_DIRTY)
         {
-            NtGdiFlush(); // Sync up Dc_Attr from Kernel space.
-            Dc_Attr->ulDirty_ &= ~(DC_MODE_DIRTY|DC_FONTTEXT_DIRTY);
+            NtGdiFlush(); // Sync up pdcattr from Kernel space.
+            pdcattr->ulDirty_ &= ~(DC_MODE_DIRTY|DC_FONTTEXT_DIRTY);
         }
     }
+
     /* One would think that setting the graphics mode to GM_COMPATIBLE
      * would also reset the world transformation matrix to the unity
      * matrix. However, in Windows, this is not the case. This doesn't
      * make a lot of sense to me, but that's the way it is.
      */
-    oMode = Dc_Attr->iGraphicsMode;
-    Dc_Attr->iGraphicsMode = iMode;
+    iOldMode = pdcattr->iGraphicsMode;
+    pdcattr->iGraphicsMode = iMode;
 
-    return oMode;
+    return iOldMode;
 }
 
 /*
@@ -1239,9 +1375,8 @@ SetGraphicsMode(HDC hdc,
 HDC
 WINAPI
 ResetDCW(
-    HDC		hdc,
-    CONST DEVMODEW	*lpInitData
-)
+    _In_ HDC hdc,
+    _In_ CONST DEVMODEW *lpInitData)
 {
     NtGdiResetDC ( hdc, (PDEVMODEW)lpInitData, NULL, NULL, NULL);
     return hdc;
@@ -1254,9 +1389,8 @@ ResetDCW(
 HDC
 WINAPI
 ResetDCA(
-    HDC		hdc,
-    CONST DEVMODEA	*lpInitData
-)
+    _In_ HDC hdc,
+    _In_ CONST DEVMODEA *lpInitData)
 {
     LPDEVMODEW InitDataW;
 
@@ -1274,12 +1408,11 @@ ResetDCA(
 DWORD
 WINAPI
 GetObjectType(
-    HGDIOBJ h
-)
+    HGDIOBJ h)
 {
     DWORD Ret = 0;
 
-    if(GdiIsHandleValid(h))
+    if (GdiIsHandleValid(h))
     {
         LONG Type = GDI_HANDLE_GET_TYPE(h);
         switch(Type)
@@ -1326,6 +1459,11 @@ GetObjectType(
             Ret = OBJ_EXTPEN;
             break;
 
+        case GDILoObjType_LO_ALTDC_TYPE:
+            // FIXME: could be something else?
+            Ret = OBJ_ENHMETADC;
+            break;
+
         default:
             DPRINT1("GetObjectType: Magic 0x%08x not implemented\n", Type);
             break;
@@ -1344,23 +1482,27 @@ GetObjectType(
 HGDIOBJ
 WINAPI
 GetStockObject(
-    INT h
-)
+    INT fnObject)
 {
-    HGDIOBJ Ret = NULL;
-    if ((h < 0) || (h >= NB_STOCK_OBJECTS)) return Ret;
-    Ret = stock_objects[h];
-    if (!Ret)
-    {
-        HGDIOBJ Obj = NtGdiGetStockObject( h );
+    HGDIOBJ hobj;
 
-        if (GdiIsHandleValid(Obj))
+    if ((fnObject < 0) || (fnObject >= NB_STOCK_OBJECTS))
+        return NULL;
+
+    hobj = stock_objects[fnObject];
+    if (hobj == NULL)
+    {
+        hobj = NtGdiGetStockObject(fnObject);
+
+        if (!GdiIsHandleValid(hobj))
         {
-            stock_objects[h] = Obj;
-            return Obj;
-        }// Returns Null anyway.
+            return NULL;
+        }
+
+        stock_objects[fnObject] = hobj;
     }
-    return Ret;
+
+    return hobj;
 }
 
 /* FIXME: include correct header */
@@ -1371,18 +1513,18 @@ HPALETTE WINAPI NtUserSelectPalette(HDC  hDC,
 HPALETTE
 WINAPI
 SelectPalette(
-    HDC hDC,
-    HPALETTE hPal,
+    HDC hdc,
+    HPALETTE hpal,
     BOOL bForceBackground)
 {
 #if 0
-    if (GDI_HANDLE_GET_TYPE(hDC) != GDI_OBJECT_TYPE_DC)
+    if (GDI_HANDLE_GET_TYPE(hdc) != GDI_OBJECT_TYPE_DC)
     {
-        if (GDI_HANDLE_GET_TYPE(hDC) == GDI_OBJECT_TYPE_METADC)
-            return MFDRV_SelectPalette( hDC, hPal, bForceBackground);
+        if (GDI_HANDLE_GET_TYPE(hdc) == GDI_OBJECT_TYPE_METADC)
+            return MFDRV_SelectPalette(hdc, hpal, bForceBackground);
         else
         {
-            PLDC pLDC = GdiGetLDC(hDC);
+            PLDC pLDC = GdiGetLDC(hdc);
             if ( !pLDC )
             {
                 SetLastError(ERROR_INVALID_HANDLE);
@@ -1390,12 +1532,12 @@ SelectPalette(
             }
             if (pLDC->iType == LDC_EMFLDC)
             {
-                if return EMFDRV_SelectPalette( hDC, hPal, bForceBackground);
+                if return EMFDRV_SelectPalette(hdc, hpal, bForceBackground);
             }
         }
     }
 #endif
-    return NtUserSelectPalette(hDC, hPal, bForceBackground);
+    return NtUserSelectPalette(hdc, hpal, bForceBackground);
 }
 
 /*
@@ -1406,9 +1548,17 @@ int
 WINAPI
 GetMapMode(HDC hdc)
 {
-    PDC_ATTR Dc_Attr;
-    if (!GdiGetHandleUserData((HGDIOBJ) hdc, GDI_OBJECT_TYPE_DC, (PVOID) &Dc_Attr)) return 0;
-    return Dc_Attr->iMapMode;
+    PDC_ATTR pdcattr;
+
+    /* Get the DC attribute */
+    pdcattr = GdiGetDcAttr(hdc);
+    if (pdcattr == NULL)
+    {
+        SetLastError(ERROR_INVALID_PARAMETER);
+        return 0;
+    }
+
+    return pdcattr->iMapMode;
 }
 
 /*
@@ -1422,30 +1572,33 @@ SetMapMode(
 {
     PDC_ATTR pdcattr;
 
+    /* Get the DC attribute */
     pdcattr = GdiGetDcAttr(hdc);
-    if (!pdcattr)
+    if (pdcattr == NULL)
     {
         SetLastError(ERROR_INVALID_PARAMETER);
         return 0;
     }
 
 #if 0
-    if (GDI_HANDLE_GET_TYPE(hDC) != GDI_OBJECT_TYPE_DC)
+    if (GDI_HANDLE_GET_TYPE(hdc) != GDI_OBJECT_TYPE_DC)
     {
-        if (GDI_HANDLE_GET_TYPE(hDC) == GDI_OBJECT_TYPE_METADC)
+        if (GDI_HANDLE_GET_TYPE(hdc) == GDI_OBJECT_TYPE_METADC)
             return MFDRV_SetMapMode(hdc, iMode);
         else
         {
             SetLastError(ERROR_INVALID_HANDLE);
             return 0;
         }
+    }
 #endif
-    // Force change if Isotropic is set for recompute.
+    /* Force change if Isotropic is set for recompute. */
     if ((iMode != pdcattr->iMapMode) || (iMode == MM_ISOTROPIC))
     {
         pdcattr->ulDirty_ &= ~SLOW_WIDTHS;
         return GetAndSetDCDWord( hdc, GdiGetSetMapMode, iMode, 0, 0, 0 );
     }
+
     return pdcattr->iMapMode;
 }
 
@@ -1457,9 +1610,17 @@ int
 WINAPI
 GetStretchBltMode(HDC hdc)
 {
-    PDC_ATTR Dc_Attr;
-    if (!GdiGetHandleUserData((HGDIOBJ) hdc, GDI_OBJECT_TYPE_DC, (PVOID) &Dc_Attr)) return 0;
-    return Dc_Attr->lStretchBltMode;
+    PDC_ATTR pdcattr;
+
+    /* Get the DC attribute */
+    pdcattr = GdiGetDcAttr(hdc);
+    if (pdcattr == NULL)
+    {
+        /* Don't set LastError here! */
+        return 0;
+    }
+
+    return pdcattr->lStretchBltMode;
 }
 
 /*
@@ -1467,10 +1628,12 @@ GetStretchBltMode(HDC hdc)
  */
 int
 WINAPI
-SetStretchBltMode(HDC hdc, int iStretchMode)
+SetStretchBltMode(
+    _In_ HDC hdc,
+    _In_ int iStretchMode)
 {
-    INT oSMode;
-    PDC_ATTR Dc_Attr;
+    INT iOldMode;
+    PDC_ATTR pdcattr;
 #if 0
     if (GDI_HANDLE_GET_TYPE(hdc) != GDI_OBJECT_TYPE_DC)
     {
@@ -1491,17 +1654,23 @@ SetStretchBltMode(HDC hdc, int iStretchMode)
         }
     }
 #endif
-    if (!GdiGetHandleUserData((HGDIOBJ) hdc, GDI_OBJECT_TYPE_DC, (PVOID) &Dc_Attr)) return 0;
+    /* Get the DC attribute */
+    pdcattr = GdiGetDcAttr(hdc);
+    if (pdcattr == NULL)
+    {
+        SetLastError(ERROR_INVALID_PARAMETER);
+        return 0;
+    }
 
-    oSMode = Dc_Attr->lStretchBltMode;
-    Dc_Attr->lStretchBltMode = iStretchMode;
+    iOldMode = pdcattr->lStretchBltMode;
+    pdcattr->lStretchBltMode = iStretchMode;
 
     // Wine returns an error here. We set the default.
     if ((iStretchMode <= 0) || (iStretchMode > MAXSTRETCHBLTMODE)) iStretchMode = WHITEONBLACK;
 
-    Dc_Attr->jStretchBltMode = iStretchMode;
+    pdcattr->jStretchBltMode = iStretchMode;
 
-    return oSMode;
+    return iOldMode;
 }
 
 /*
@@ -1511,9 +1680,128 @@ HFONT
 WINAPI
 GetHFONT(HDC hdc)
 {
-    PDC_ATTR Dc_Attr;
-    if (!GdiGetHandleUserData((HGDIOBJ) hdc, GDI_OBJECT_TYPE_DC, (PVOID) &Dc_Attr)) return NULL;
-    return Dc_Attr->hlfntNew;
+    PDC_ATTR pdcattr;
+
+    /* Get the DC attribute */
+    pdcattr = GdiGetDcAttr(hdc);
+    if (pdcattr == NULL)
+    {
+        /* Don't set LastError here! */
+        return NULL;
+    }
+
+    /* Return the current font */
+    return pdcattr->hlfntNew;
+}
+
+
+HBITMAP
+WINAPI
+GdiSelectBitmap(
+    _In_ HDC hdc,
+    _In_ HBITMAP hbmp)
+{
+    return NtGdiSelectBitmap(hdc, hbmp);
+}
+
+HBRUSH
+WINAPI
+GdiSelectBrush(
+    _In_ HDC hdc,
+    _In_ HBRUSH hbr)
+{
+    PDC_ATTR pdcattr;
+    HBRUSH hbrOld;
+
+    /* Get the DC attribute */
+    pdcattr = GdiGetDcAttr(hdc);
+    if (pdcattr == NULL)
+    {
+        SetLastError(ERROR_INVALID_PARAMETER);
+        return NULL;
+    }
+
+    /* Get the current brush. If it matches the new brush, we're done */
+    hbrOld = pdcattr->hbrush;
+    if (hbrOld == hbr)
+        return hbrOld;
+
+    /* Set the new brush and update dirty flags */
+    pdcattr->hbrush = hbr;
+    pdcattr->ulDirty_ |= DC_BRUSH_DIRTY;
+    return hbrOld;
+}
+
+HPEN
+WINAPI
+GdiSelectPen(
+    _In_ HDC hdc,
+    _In_ HPEN hpen)
+{
+    PDC_ATTR pdcattr;
+    HPEN hpenOld;
+
+    /* Get the DC attribute */
+    pdcattr = GdiGetDcAttr(hdc);
+    if (pdcattr == NULL)
+    {
+        SetLastError(ERROR_INVALID_PARAMETER);
+        return NULL;
+    }
+
+    /* Get the current pen. If it matches the new pen, we're done */
+    hpenOld = pdcattr->hpen;
+    if (hpenOld == hpen)
+        return hpenOld;
+
+    /* Set the new pen and update dirty flags */
+    pdcattr->ulDirty_ |= DC_PEN_DIRTY;
+    pdcattr->hpen = hpen;
+    return hpenOld;
+}
+
+HFONT
+WINAPI
+GdiSelectFont(
+    _In_ HDC hdc,
+    _In_ HFONT hfont)
+{
+    PDC_ATTR pdcattr;
+    HFONT hfontOld;
+
+    /* Get the DC attribute */
+    pdcattr = GdiGetDcAttr(hdc);
+    if (pdcattr == NULL)
+    {
+        SetLastError(ERROR_INVALID_PARAMETER);
+        return NULL;
+    }
+
+    /* Get the current font. If it matches the new font, we're done */
+    hfontOld = pdcattr->hlfntNew;
+    if (hfontOld == hfont)
+        return hfontOld;
+
+    /* Set the new font and update dirty flags */
+    pdcattr->hlfntNew = hfont;
+    pdcattr->ulDirty_ &= ~SLOW_WIDTHS;
+    pdcattr->ulDirty_ |= DIRTY_CHARSET;
+
+    /* If the DC does not have a DIB section selected, try a batch command */
+    if (!(pdcattr->ulDirty_ & DC_DIBSECTION))
+    {
+        PGDIBSOBJECT pgO;
+
+        pgO = GdiAllocBatchCommand(hdc, GdiBCSelObj);
+        if (pgO)
+        {
+            pgO->hgdiobj = hfont;
+            return hfontOld;
+        }
+    }
+
+    /* We could not use the batch command, call win32k */
+    return NtGdiSelectFont(hdc, hfont);
 }
 
 
@@ -1523,87 +1811,43 @@ GetHFONT(HDC hdc)
  */
 HGDIOBJ
 WINAPI
-SelectObject(HDC hDC,
-             HGDIOBJ hGdiObj)
+SelectObject(
+    _In_ HDC hdc,
+    _In_ HGDIOBJ hobj)
 {
-    PDC_ATTR pDc_Attr;
-    HGDIOBJ hOldObj = NULL;
-    UINT uType;
-
-    if(!GdiGetHandleUserData(hDC, GDI_OBJECT_TYPE_DC, (PVOID)&pDc_Attr))
-    {
-        SetLastError(ERROR_INVALID_HANDLE);
-        return NULL;
-    }
-
-    hGdiObj = GdiFixUpHandle(hGdiObj);
-    if (!GdiIsHandleValid(hGdiObj))
+    /* Fix up 16 bit handles */
+    hobj = GdiFixUpHandle(hobj);
+    if (!GdiIsHandleValid(hobj))
     {
         return NULL;
     }
 
-    uType = GDI_HANDLE_GET_TYPE(hGdiObj);
-
-    switch (uType)
+    /* Call the appropriate select function */
+    switch (GDI_HANDLE_GET_TYPE(hobj))
     {
-        case GDI_OBJECT_TYPE_REGION:
-            return (HGDIOBJ)ExtSelectClipRgn(hDC, hGdiObj, RGN_COPY);
+        case GDILoObjType_LO_REGION_TYPE:
+            return (HGDIOBJ)ExtSelectClipRgn(hdc, hobj, RGN_COPY);
 
-        case GDI_OBJECT_TYPE_BITMAP:
-            return NtGdiSelectBitmap(hDC, hGdiObj);
+        case GDILoObjType_LO_BITMAP_TYPE:
+        case GDILoObjType_LO_DIBSECTION_TYPE:
+            return GdiSelectBitmap(hdc, hobj);
 
-        case GDI_OBJECT_TYPE_BRUSH:
-            hOldObj = pDc_Attr->hbrush;
-            pDc_Attr->ulDirty_ |= DC_BRUSH_DIRTY;
-            pDc_Attr->hbrush = hGdiObj;
-            return hOldObj;
-//            return NtGdiSelectBrush(hDC, hGdiObj);
+        case GDILoObjType_LO_BRUSH_TYPE:
+            return GdiSelectBrush(hdc, hobj);
 
-        case GDI_OBJECT_TYPE_PEN:
-        case GDI_OBJECT_TYPE_EXTPEN:
-            hOldObj = pDc_Attr->hpen;
-            pDc_Attr->ulDirty_ |= DC_PEN_DIRTY;
-            pDc_Attr->hpen = hGdiObj;
-            return hOldObj;
-//            return NtGdiSelectPen(hDC, hGdiObj);
+        case GDILoObjType_LO_PEN_TYPE:
+        case GDILoObjType_LO_EXTPEN_TYPE:
+            return GdiSelectPen(hdc, hobj);
 
-        case GDI_OBJECT_TYPE_FONT:
-            hOldObj = pDc_Attr->hlfntNew;
-            if (hOldObj == hGdiObj) return hOldObj;
+        case GDILoObjType_LO_FONT_TYPE:
+            return GdiSelectFont(hdc, hobj);
 
-            pDc_Attr->ulDirty_ &= ~SLOW_WIDTHS;
-            pDc_Attr->ulDirty_ |= DIRTY_CHARSET;
-            pDc_Attr->hlfntNew = hGdiObj;
+        case GDILoObjType_LO_ICMLCS_TYPE:
+            return SetColorSpace(hdc, hobj);
 
-            if (!(pDc_Attr->ulDirty_ & DC_DIBSECTION))
-            {
-                PGDIBSOBJECT pgO;
-
-                pgO = GdiAllocBatchCommand(hDC, GdiBCSelObj);
-                if (pgO)
-                {
-                    pgO->hgdiobj = hGdiObj;
-                    return hOldObj;
-                }
-            }
-
-            // default for select object font
-            return NtGdiSelectFont(hDC, hGdiObj);
-
-#if 0
-        case GDI_OBJECT_TYPE_METADC:
-            return MFDRV_SelectObject( hDC, hGdiObj);
-        case GDI_OBJECT_TYPE_EMF:
-            PLDC pLDC = GdiGetLDC(hDC);
-            if ( !pLDC ) return NULL;
-            return EMFDRV_SelectObject( hDC, hGdiObj);
-#endif
-        case GDI_OBJECT_TYPE_COLORSPACE:
-            SetColorSpace(hDC, (HCOLORSPACE) hGdiObj);
-            return NULL;
-
-        case GDI_OBJECT_TYPE_PALETTE:
+        case GDILoObjType_LO_PALETTE_TYPE:
             SetLastError(ERROR_INVALID_FUNCTION);
+
         default:
             return NULL;
     }
diff --git a/win32ss/gdi/ntgdi/bitmaps.c b/win32ss/gdi/ntgdi/bitmaps.c
index e72dec295e7..2ded5a86e34 100644
--- a/win32ss/gdi/ntgdi/bitmaps.c
+++ b/win32ss/gdi/ntgdi/bitmaps.c
@@ -239,6 +239,12 @@ IntCreateCompatibleBitmap(
                               Planes ? Planes : 1,
                               Bpp ? Bpp : Dc->ppdev->gdiinfo.cBitsPixel,
                               NULL);
+        if (Bmp == NULL)
+        {
+            DPRINT1("Failed to allocate a bitmap!\n");
+            return NULL;
+        }
+
         psurf = SURFACE_ShareLockSurface(Bmp);
         ASSERT(psurf);
 
diff --git a/win32ss/gdi/ntgdi/gdiobj.c b/win32ss/gdi/ntgdi/gdiobj.c
index 7cfbf470a94..8aa9703b760 100644
--- a/win32ss/gdi/ntgdi/gdiobj.c
+++ b/win32ss/gdi/ntgdi/gdiobj.c
@@ -1272,6 +1272,15 @@ NtGdiCreateClientObj(
     POBJ pObject;
     HANDLE handle;
 
+    /* Check if ulType is valid */
+    if ((ulType != GDILoObjType_LO_METAFILE16_TYPE) &&
+        (ulType != GDILoObjType_LO_METAFILE_TYPE) &&
+        (ulType != GDILoObjType_LO_METADC16_TYPE))
+    {
+        DPRINT1("NtGdiCreateClientObj: Invalid object type 0x%lx.\n", ulType);
+        return NULL;
+    }
+
     /* Allocate a new object */
     pObject = GDIOBJ_AllocateObject(GDIObjType_CLIENTOBJ_TYPE,
                                     sizeof(CLIENTOBJ),
@@ -1282,9 +1291,6 @@ NtGdiCreateClientObj(
         return NULL;
     }
 
-    /* Mask out everything that would change the type in a wrong manner */
-    ulType &= (GDI_HANDLE_TYPE_MASK & ~GDI_HANDLE_BASETYPE_MASK);
-
     /* Set the real object type */
     pObject->hHmgr = UlongToHandle(ulType | GDILoObjType_LO_CLIENTOBJ_TYPE);
 
diff --git a/win32ss/user/ntuser/desktop.c b/win32ss/user/ntuser/desktop.c
index 2f7838b99e3..5759d260e6d 100644
--- a/win32ss/user/ntuser/desktop.c
+++ b/win32ss/user/ntuser/desktop.c
@@ -25,6 +25,10 @@ IntFreeDesktopHeap(IN PDESKTOP pdesk);
 
 /* GLOBALS *******************************************************************/
 
+/* These can be changed via csrss startup, these are defaults */
+DWORD gdwDesktopSectionSize = 512;
+DWORD gdwNOIOSectionSize    = 128; // A guess, for one or more of the first three system desktops.
+
 /* Currently active desktop */
 PDESKTOP gpdeskInputDesktop = NULL;
 HDC ScreenDeviceContext = NULL;
@@ -1194,7 +1198,7 @@ static NTSTATUS
 UserInitializeDesktop(PDESKTOP pdesk, PUNICODE_STRING DesktopName, PWINSTATION_OBJECT pwinsta)
 {
     PVOID DesktopHeapSystemBase = NULL;
-    ULONG_PTR HeapSize = 400 * 1024;
+    ULONG_PTR HeapSize = gdwDesktopSectionSize * 1024;
     SIZE_T DesktopInfoSize;
     ULONG i;
 
diff --git a/win32ss/user/ntuser/msgqueue.c b/win32ss/user/ntuser/msgqueue.c
index 3a7f3b3549f..812c8d1ae62 100644
--- a/win32ss/user/ntuser/msgqueue.c
+++ b/win32ss/user/ntuser/msgqueue.c
@@ -973,8 +973,15 @@ co_MsqSendMessage(PTHREADINFO ptirec,
    /* Don't send from or to a dying thread */
     if (pti->TIF_flags & TIF_INCLEANUP || ptirec->TIF_flags & TIF_INCLEANUP)
     {
+        // Unless we are dying and need to tell our parents.
+        if (pti->TIF_flags & TIF_INCLEANUP && !(ptirec->TIF_flags & TIF_INCLEANUP))
+        {
+           // Parent notify is the big one. Fire and forget!
+           TRACE("Send message from dying thread %d\n",Msg);
+           co_MsqSendMessageAsync(ptirec, Wnd, Msg, wParam, lParam, NULL, 0, FALSE, HookMessage);
+        }
         if (uResult) *uResult = -1;
-        ERR("MsqSM: Current pti %lu or Rec pti %lu\n", pti->TIF_flags & TIF_INCLEANUP, ptirec->TIF_flags & TIF_INCLEANUP);
+        TRACE("MsqSM: Msg %d Current pti %lu or Rec pti %lu\n", Msg, pti->TIF_flags & TIF_INCLEANUP, ptirec->TIF_flags & TIF_INCLEANUP);
         return STATUS_UNSUCCESSFUL;
     }