diff --git a/base/applications/notepad/lang/sq-AL.rc b/base/applications/notepad/lang/sq-AL.rc
index b40ea60b991..b0d97bf7d99 100644
--- a/base/applications/notepad/lang/sq-AL.rc
+++ b/base/applications/notepad/lang/sq-AL.rc
@@ -128,7 +128,7 @@ CAPTION "Rreth ReactOS Notepad"
 FONT 8, "MS Shell Dlg"
 BEGIN
     CONTROL "ReactOS Notepad v1.0\r\nCopyright 1997,98 Marcel Baur <mbaur@g26.ethz.ch>\r\nCopyright 2000 Mike McCormack <Mike_McCormack@looksmart.com.au>\r\nCopyright 2002 Sylvain Petreolle <spetreolle@yahoo.fr>\r\nCopyright 2002 Andriy Palamarchuk\r\n", -1, "Static", SS_LEFTNOWORDWRAP | WS_GROUP, 46, 7, 232, 39
-    CONTROL " ", -1, "Statik", 0x50000000, 8, 48, 272, 11
+    CONTROL " ", -1, "Static", 0x50000000, 8, 48, 272, 11
     DEFPUSHBUTTON "Mbyll", IDOK, 114, 149, 44, 15, WS_GROUP
     ICON IDI_NPICON, -1, 12, 9, 20, 30
     EDITTEXT IDC_LICENSE, 8, 64, 272, 81, ES_MULTILINE | ES_READONLY | WS_VSCROLL
diff --git a/base/setup/usetup/cabinet.c b/base/setup/usetup/cabinet.c
index 9f0242557bc..1d16ac0d956 100644
--- a/base/setup/usetup/cabinet.c
+++ b/base/setup/usetup/cabinet.c
@@ -1098,7 +1098,7 @@ CabinetExtractFile(PCAB_SEARCH Search)
         Size -= OutputLength;
         /* reduce remaining block size by bytes consumed */
         RemainingBlock -= InputLength;
-        if (RemainingBlock == 0)
+        if (Size > 0 && RemainingBlock == 0)
         {
             /* used up this block, move on to the next */
             DPRINT("Out of block data\n");
diff --git a/base/shell/explorer/explorer-sq.rc b/base/shell/explorer/explorer-sq.rc
index c4ac987ca2c..c0b7df1e095 100644
--- a/base/shell/explorer/explorer-sq.rc
+++ b/base/shell/explorer/explorer-sq.rc
@@ -117,8 +117,8 @@ STYLE DS_SHELLFONT | DS_MODALFRAME | WS_POPUP | WS_CAPTION | WS_SYSMENU
 CAPTION "Ekzekuto"
 FONT 8, "MS Shell Dlg"
 BEGIN
-    CONTROL "", 101, "Statik", SS_SIMPLE | SS_NOPREFIX, 3, 6, 150, 10
-    CONTROL "&Comanda:", -1, "Statik", SS_LEFTNOWORDWRAP | WS_GROUP, 3, 18, 60, 10
+    CONTROL "", 101, "Static", SS_SIMPLE | SS_NOPREFIX, 3, 6, 150, 10
+    CONTROL "&Comanda:", -1, "Static", SS_LEFTNOWORDWRAP | WS_GROUP, 3, 18, 60, 10
     EDITTEXT 201, 3, 29, 134, 12, ES_AUTOHSCROLL
     CONTROL "Si &Simbol", 214, "Button", BS_AUTOCHECKBOX | WS_TABSTOP, 3, 45, 71, 12
     DEFPUSHBUTTON "&OK", 1, 158, 6, 47, 14
diff --git a/boot/bootdata/packages/CMakeLists.txt b/boot/bootdata/packages/CMakeLists.txt
index 3344a23d95f..d65a1049cb6 100644
--- a/boot/bootdata/packages/CMakeLists.txt
+++ b/boot/bootdata/packages/CMakeLists.txt
@@ -31,24 +31,18 @@ add_custom_command(
     DEPENDS ${CMAKE_CURRENT_BINARY_DIR}/reactos.dff.dyn
 )
 
-# And now we build reactos.cab
-
-# First we create reactos.inf
+# And now we build reactos.inf
 add_custom_command(
     OUTPUT ${CMAKE_CURRENT_BINARY_DIR}/reactos.inf
     COMMAND native-cabman -C ${CMAKE_CURRENT_BINARY_DIR}/reactos.dff -L ${CMAKE_CURRENT_BINARY_DIR} -I -P ${REACTOS_SOURCE_DIR}
     DEPENDS ${CMAKE_CURRENT_BINARY_DIR}/reactos.dff native-cabman)
 
-# Then we create the actual cab file using a custom target
-add_custom_command(
-    OUTPUT ${CMAKE_CURRENT_BINARY_DIR}/reactos.cab
-    COMMAND native-cabman -C ${CMAKE_CURRENT_BINARY_DIR}/reactos.dff -RC ${CMAKE_CURRENT_BINARY_DIR}/reactos.inf -L ${CMAKE_CURRENT_BINARY_DIR} -N -P ${REACTOS_SOURCE_DIR}
-    DEPENDS ${CMAKE_CURRENT_BINARY_DIR}/reactos.inf native-cabman)
-
-add_custom_target(reactos_cab DEPENDS ${CMAKE_CURRENT_BINARY_DIR}/reactos.cab)
+# reactos.cab generation will be made later (cf. CMakeMacros.cmake - create iso lists)
+add_custom_target(reactos_cab_inf DEPENDS ${CMAKE_CURRENT_BINARY_DIR}/reactos.inf)
 
 add_cd_file(
     TARGET reactos_cab
-    FILE ${CMAKE_CURRENT_BINARY_DIR}/reactos.cab ${CMAKE_CURRENT_BINARY_DIR}/reactos.inf
+    FILE ${CMAKE_CURRENT_BINARY_DIR}/reactos.inf
     DESTINATION reactos
     NO_CAB FOR bootcd regtest)
+
diff --git a/cmake/CMakeMacros.cmake b/cmake/CMakeMacros.cmake
index 716ac07c75d..1a722fa0ded 100644
--- a/cmake/CMakeMacros.cmake
+++ b/cmake/CMakeMacros.cmake
@@ -316,15 +316,11 @@ function(add_cd_file)
             file(APPEND ${REACTOS_BINARY_DIR}/boot/bootdata/packages/reactos.dff.dyn "\"${__relative_file}\" ${_num}\n")
             unset(__relative_file)
             if(_CD_TARGET)
-                #manage dependency
-                add_dependencies(reactos_cab ${_CD_TARGET})
-                # add this so that the combination make target/fast reactos_cab/fast bootcd/fast properly detects that reactos.cab must be rebuilt
-                if (CMAKE_BUILD_TOOL STREQUAL "make")
-                    add_custom_command(TARGET ${_CD_TARGET}
-                                       POST_BUILD
-                                       COMMAND ${CMAKE_COMMAND} -E touch ${REACTOS_BINARY_DIR}/boot/bootdata/packages/reactos.dff)
-                endif()
+                #manage dependency - target level
+                add_dependencies(reactos_cab_inf ${_CD_TARGET})
             endif()
+            # manage dependency - file level
+            set_property(GLOBAL APPEND PROPERTY REACTOS_CAB_DEPENDS ${_CD_FILE})
         endif()
     endif() #end bootcd
 
@@ -378,6 +374,22 @@ function(add_cd_file)
 endfunction()
 
 function(create_iso_lists)
+    # generate reactos.cab before anything else
+    get_property(_filelist GLOBAL PROPERTY REACTOS_CAB_DEPENDS)
+    add_custom_command(
+        OUTPUT ${CMAKE_CURRENT_BINARY_DIR}/reactos.cab
+        COMMAND native-cabman -C ${REACTOS_BINARY_DIR}/boot/bootdata/packages/reactos.dff -RC ${REACTOS_BINARY_DIR}/boot/bootdata/packages/reactos.inf -N -P ${REACTOS_SOURCE_DIR}
+    DEPENDS ${REACTOS_BINARY_DIR}/boot/bootdata/packages/reactos.inf native-cabman ${_filelist})
+
+    add_custom_target(reactos_cab DEPENDS ${CMAKE_CURRENT_BINARY_DIR}/reactos.cab)
+    add_dependencies(reactos_cab reactos_cab_inf)
+
+    add_cd_file(
+        TARGET reactos_cab
+        FILE ${CMAKE_CURRENT_BINARY_DIR}/reactos.cab
+        DESTINATION reactos
+        NO_CAB FOR bootcd regtest)
+
     get_property(_filelist GLOBAL PROPERTY BOOTCD_FILE_LIST)
     string(REPLACE ";" "\n" _filelist "${_filelist}")
     file(APPEND ${REACTOS_BINARY_DIR}/boot/bootcd.lst "${_filelist}")
diff --git a/dll/cpl/console/console.c b/dll/cpl/console/console.c
index d26c23b21e2..436626b6087 100644
--- a/dll/cpl/console/console.c
+++ b/dll/cpl/console/console.c
@@ -118,7 +118,6 @@ InitConsoleDefaults(PCONSOLE_PROPS pConInfo)
     GuiInfo->FontSize.X = 0;
     GuiInfo->FontSize.Y = 0;
     GuiInfo->FontWeight = FW_DONTCARE;
-    GuiInfo->UseRasterFonts = TRUE;
 
     GuiInfo->FullScreen   = FALSE;
     GuiInfo->ShowWindow   = SW_SHOWNORMAL;
diff --git a/dll/cpl/console/font.c b/dll/cpl/console/font.c
index 58d7948975f..d714e63fa13 100644
--- a/dll/cpl/console/font.c
+++ b/dll/cpl/console/font.c
@@ -76,11 +76,25 @@
     if (GetTextExtentPoint32W(drawItem->hDC, L"R", 1, &CharSize))
         GuiData->CharWidth = CharSize.cx;
 }
+
+/*
+ * See also: Display_SetTypeFace in applications/fontview/display.c
+ */
 #endif
 
 
-BOOL CALLBACK
-EnumFontFamExProc(PLOGFONTW    lplf,
+/*
+ * Font pixel heights for TrueType fonts
+ */
+static SHORT TrueTypePoints[] =
+{
+    // 8, 9, 10, 11, 12, 14, 16, 18, 20,
+    // 22, 24, 26, 28, 36, 48, 72
+    5, 6, 7, 8, 10, 12, 14, 16, 18, 20, 24, 28, 36, 72
+};
+
+static BOOL CALLBACK
+EnumFontNamesProc(PLOGFONTW lplf,
                   PNEWTEXTMETRICW lpntm,
                   DWORD  FontType,
                   LPARAM lParam)
@@ -197,6 +211,161 @@ EnumFontFamExProc(PLOGFONTW    lplf,
     return TRUE;
 }
 
+static BOOL CALLBACK
+EnumFontSizesProc(PLOGFONTW lplf,
+                  PNEWTEXTMETRICW lpntm,
+                  DWORD  FontType,
+                  LPARAM lParam)
+{
+    HWND hwndCombo = (HWND)lParam;
+    WCHAR FontSize[100];
+
+    if (FontType != TRUETYPE_FONTTYPE)
+    {
+        // int logsize     = lpntm->tmHeight - lpntm->tmInternalLeading;
+        // LONG pointsize  = MulDiv(logsize, 72, GetDeviceCaps(hdc, LOGPIXELSY));
+
+        // swprintf(FontSize, L"%2d (%d x %d)", pointsize, lplf->lfWidth, lplf->lfHeight);
+        swprintf(FontSize, L"%d x %d", lplf->lfWidth, lplf->lfHeight);
+
+        /* Make sure the size doesn't already exist in the list */
+        if (SendMessageW(hwndCombo, LB_FINDSTRINGEXACT, 0, (LPARAM)FontSize) == LB_ERR)
+        {
+            /* Add the size */
+            INT idx = (INT)SendMessageW(hwndCombo, LB_ADDSTRING, 0, (LPARAM)FontSize);
+
+            /*
+             * Store this information in the list-item's userdata area.
+             * Format:
+             * Width  = FontSize.X = LOWORD(FontSize);
+             * Height = FontSize.Y = HIWORD(FontSize);
+             */
+            SendMessageW(hwndCombo, LB_SETITEMDATA, idx, MAKEWPARAM(lplf->lfWidth, lplf->lfHeight));
+        }
+
+        return TRUE;
+    }
+    else
+    {
+        int i;
+        for (i = 0; i < sizeof(TrueTypePoints) / sizeof(TrueTypePoints[0]); ++i)
+        {
+            swprintf(FontSize, L"%2d", TrueTypePoints[i]);
+
+            /* Make sure the size doesn't already exist in the list */
+            if (SendMessageW(hwndCombo, LB_FINDSTRINGEXACT, 0, (LPARAM)FontSize) == LB_ERR)
+            {
+                /* Add the size */
+                INT idx = (INT)SendMessageW(hwndCombo, LB_ADDSTRING, 0, (LPARAM)FontSize);
+
+                /*
+                 * Store this information in the list-item's userdata area.
+                 * Format:
+                 * Width  = FontSize.X = LOWORD(FontSize);
+                 * Height = FontSize.Y = HIWORD(FontSize);
+                 */
+                SendMessageW(hwndCombo, LB_SETITEMDATA, idx, MAKEWPARAM(0, TrueTypePoints[i]));
+            }
+        }
+
+        return FALSE;
+    }
+}
+
+
+
+static VOID
+FontSizeChange(HWND hwndDlg,
+               PGUI_CONSOLE_INFO GuiInfo);
+
+static VOID
+FontTypeChange(HWND hwndDlg,
+               PGUI_CONSOLE_INFO GuiInfo)
+{
+    INT Length, nSel;
+    LPWSTR FaceName;
+
+    HDC hDC;
+    LOGFONTW lf;
+
+    nSel = (INT)SendDlgItemMessageW(hwndDlg, IDC_LBOX_FONTTYPE,
+                                    LB_GETCURSEL, 0, 0);
+    if (nSel == LB_ERR) return;
+
+    Length = (INT)SendDlgItemMessageW(hwndDlg, IDC_LBOX_FONTTYPE,
+                                      LB_GETTEXTLEN, nSel, 0);
+    if (Length == LB_ERR) return;
+
+    FaceName = HeapAlloc(GetProcessHeap(),
+                         HEAP_ZERO_MEMORY,
+                         (Length + 1) * sizeof(WCHAR));
+    if (FaceName == NULL) return;
+
+    Length = (INT)SendDlgItemMessageW(hwndDlg, IDC_LBOX_FONTTYPE,
+                                      LB_GETTEXT, nSel, (LPARAM)FaceName);
+    FaceName[Length] = '\0';
+
+    Length = min(Length/*wcslen(FaceName) + 1*/, LF_FACESIZE); // wcsnlen
+    wcsncpy(GuiInfo->FaceName, FaceName, LF_FACESIZE);
+    GuiInfo->FaceName[Length] = L'\0';
+    DPRINT1("GuiInfo->FaceName = '%S'\n", GuiInfo->FaceName);
+
+    /* Enumerate the available sizes for the selected font */
+    ZeroMemory(&lf, sizeof(lf));
+    lf.lfCharSet  = DEFAULT_CHARSET; // OEM_CHARSET;
+    // lf.lfPitchAndFamily = FIXED_PITCH | FF_DONTCARE;
+    wcsncpy(lf.lfFaceName, FaceName, LF_FACESIZE);
+    lf.lfFaceName[Length] = L'\0';
+
+    hDC = GetDC(NULL);
+    EnumFontFamiliesExW(hDC, &lf, (FONTENUMPROCW)EnumFontSizesProc,
+                        (LPARAM)GetDlgItem(hwndDlg, IDC_LBOX_FONTSIZE), 0);
+    ReleaseDC(NULL, hDC);
+
+    HeapFree(GetProcessHeap(), 0, FaceName);
+
+    // TODO: Select a default font size????
+    FontSizeChange(hwndDlg, GuiInfo);
+
+    // InvalidateRect(GetDlgItem(hwndDlg, IDC_STATIC_FONT_WINDOW_PREVIEW), NULL, TRUE);
+    // InvalidateRect(GetDlgItem(hwndDlg, IDC_STATIC_SELECT_FONT_PREVIEW), NULL, TRUE);
+}
+
+static VOID
+FontSizeChange(HWND hwndDlg,
+               PGUI_CONSOLE_INFO GuiInfo)
+{
+    INT nSel;
+    ULONG FontSize;
+    WCHAR FontSizeStr[20];
+
+    nSel = (INT)SendDlgItemMessageW(hwndDlg, IDC_LBOX_FONTSIZE,
+                                    LB_GETCURSEL, 0, 0);
+    if (nSel == LB_ERR) return;
+
+    /*
+     * Format:
+     * Width  = FontSize.X = LOWORD(FontSize);
+     * Height = FontSize.Y = HIWORD(FontSize);
+     */
+    FontSize = (ULONG)SendDlgItemMessageW(hwndDlg, IDC_LBOX_FONTSIZE,
+                                          LB_GETITEMDATA, nSel, 0);
+    if (FontSize == LB_ERR) return;
+
+    GuiInfo->FontSize.X = LOWORD(FontSize);
+    GuiInfo->FontSize.Y = HIWORD(FontSize);
+    DPRINT1("GuiInfo->FontSize = (%d x %d)\n", GuiInfo->FontSize.X, GuiInfo->FontSize.Y);
+
+    InvalidateRect(GetDlgItem(hwndDlg, IDC_STATIC_FONT_WINDOW_PREVIEW), NULL, TRUE);
+    InvalidateRect(GetDlgItem(hwndDlg, IDC_STATIC_SELECT_FONT_PREVIEW), NULL, TRUE);
+
+    swprintf(FontSizeStr, L"%2d", GuiInfo->FontSize.X);
+    SetWindowText(GetDlgItem(hwndDlg, IDC_FONT_SIZE_X), FontSizeStr);
+    swprintf(FontSizeStr, L"%2d", GuiInfo->FontSize.Y);
+    SetWindowText(GetDlgItem(hwndDlg, IDC_FONT_SIZE_Y), FontSizeStr);
+}
+
+
 INT_PTR
 CALLBACK
 FontProc(HWND hwndDlg,
@@ -214,7 +383,6 @@ FontProc(HWND hwndDlg,
         case WM_INITDIALOG:
         {
             HDC  hDC;
-            HWND hwndCombo;
             LOGFONTW lf;
             INT idx;
 
@@ -225,19 +393,19 @@ FontProc(HWND hwndDlg,
             ZeroMemory(&lf, sizeof(lf));
             lf.lfCharSet  = DEFAULT_CHARSET; // OEM_CHARSET;
             // lf.lfPitchAndFamily = FIXED_PITCH | FF_DONTCARE;
-            // lf.lfFaceName = L"";
 
             hDC = GetDC(NULL);
-            hwndCombo = GetDlgItem(hwndDlg, IDC_LBOX_FONTTYPE);
-            EnumFontFamiliesExW(hDC, &lf, (FONTENUMPROCW)EnumFontFamExProc, (LPARAM)hwndCombo, 0);
+            EnumFontFamiliesExW(hDC, &lf, (FONTENUMPROCW)EnumFontNamesProc,
+                                (LPARAM)GetDlgItem(hwndDlg, IDC_LBOX_FONTTYPE), 0);
             ReleaseDC(NULL, hDC);
 
             DPRINT1("GuiInfo->FaceName = '%S'\n", GuiInfo->FaceName);
-            idx = (INT)SendMessageW(hwndCombo, LB_FINDSTRINGEXACT, 0, (LPARAM)GuiInfo->FaceName);
-            if (idx != LB_ERR)
-            {
-                SendMessageW(hwndCombo, LB_SETCURSEL, (WPARAM)idx, 0);
-            }
+            idx = (INT)SendDlgItemMessageW(hwndDlg, IDC_LBOX_FONTTYPE,
+                                           LB_FINDSTRINGEXACT, 0, (LPARAM)GuiInfo->FaceName);
+            if (idx != LB_ERR) SendDlgItemMessageW(hwndDlg, IDC_LBOX_FONTTYPE,
+                                                   LB_SETCURSEL, (WPARAM)idx, 0);
+
+            FontTypeChange(hwndDlg, GuiInfo);
 
             return TRUE;
         }
@@ -247,16 +415,66 @@ FontProc(HWND hwndDlg,
             LPDRAWITEMSTRUCT drawItem = (LPDRAWITEMSTRUCT)lParam;
 
             if (drawItem->CtlID == IDC_STATIC_FONT_WINDOW_PREVIEW)
-            {
                 PaintConsole(drawItem, pConInfo);
-            }
             else if (drawItem->CtlID == IDC_STATIC_SELECT_FONT_PREVIEW)
-            {
                 PaintText(drawItem, pConInfo, Screen);
-            }
+
             return TRUE;
         }
 
+        case WM_NOTIFY:
+        {
+            switch (((LPNMHDR)lParam)->code)
+            {
+                case PSN_APPLY:
+                {
+                    if (!pConInfo->AppliedConfig)
+                    {
+                        return ApplyConsoleInfo(hwndDlg, pConInfo);
+                    }
+                    else
+                    {
+                        /* Options have already been applied */
+                        SetWindowLongPtr(hwndDlg, DWLP_MSGRESULT, PSNRET_NOERROR);
+                        return TRUE;
+                    }
+                    break;
+                }
+            }
+
+            break;
+        }
+
+        case WM_COMMAND:
+        {
+            switch (HIWORD(wParam))
+            {
+                case LBN_SELCHANGE:
+                {
+                    switch (LOWORD(wParam))
+                    {
+                        case IDC_LBOX_FONTTYPE:
+                        {
+                            FontTypeChange(hwndDlg, GuiInfo);
+                            PropSheet_Changed(GetParent(hwndDlg), hwndDlg);
+                            break;
+                        }
+
+                        case IDC_LBOX_FONTSIZE:
+                        {
+                            FontSizeChange(hwndDlg, GuiInfo);
+                            PropSheet_Changed(GetParent(hwndDlg), hwndDlg);
+                            break;
+                        }
+                    }
+
+                    break;
+                }
+            }
+
+            break;
+        }
+
         default:
             break;
     }
diff --git a/dll/cpl/console/lang/bg-BG.rc b/dll/cpl/console/lang/bg-BG.rc
index b7f0b9da413..e6f62b7530b 100644
--- a/dll/cpl/console/lang/bg-BG.rc
+++ b/dll/cpl/console/lang/bg-BG.rc
@@ -35,7 +35,7 @@ BEGIN
     LTEXT "Прозоречен преглед:", -1, 10, 10, 94, 10
     LTEXT "Размер:", -1, 180, 10, 36, 10
     CONTROL "", IDC_STATIC_FONT_WINDOW_PREVIEW, "Static", SS_OWNERDRAW | SS_SUNKEN, 10, 20, 163, 74
-    LISTBOX IDC_LBOX_FONTSIZE, 181, 20, 55, 80, LBS_SORT | LBS_DISABLENOSCROLL | WS_VSCROLL
+    LISTBOX IDC_LBOX_FONTSIZE, 181, 20, 55, 80, LBS_SORT | LBS_HASSTRINGS | LBS_DISABLENOSCROLL | WS_VSCROLL
     LTEXT "&Шрифт:", -1, 10, 105, 33, 10
     CHECKBOX "&Получери шрифтове", IDC_CHECK_BOLD_FONTS, 38, 105, 85, 10
     LISTBOX IDC_LBOX_FONTTYPE, 10, 120, 110, 40, LBS_SORT | LBS_HASSTRINGS | LBS_DISABLENOSCROLL | WS_VSCROLL
diff --git a/dll/cpl/console/lang/cs-CZ.rc b/dll/cpl/console/lang/cs-CZ.rc
index 0cfef2c42f4..afda11d7d58 100644
--- a/dll/cpl/console/lang/cs-CZ.rc
+++ b/dll/cpl/console/lang/cs-CZ.rc
@@ -41,7 +41,7 @@ BEGIN
     LTEXT "Náhled okna:", -1, 10, 10, 94, 10
     LTEXT "Velikost:", -1, 180, 10, 36, 10
     CONTROL "", IDC_STATIC_FONT_WINDOW_PREVIEW, "Static", SS_OWNERDRAW | SS_SUNKEN, 10, 20, 163, 74
-    LISTBOX IDC_LBOX_FONTSIZE, 181, 20, 55, 80, LBS_SORT | LBS_DISABLENOSCROLL | WS_VSCROLL
+    LISTBOX IDC_LBOX_FONTSIZE, 181, 20, 55, 80, LBS_SORT | LBS_HASSTRINGS | LBS_DISABLENOSCROLL | WS_VSCROLL
     LTEXT "&Písmo:", -1, 10, 105, 33, 10
     CHECKBOX "&Tučná písma", IDC_CHECK_BOLD_FONTS, 56, 105, 60, 10
     LISTBOX IDC_LBOX_FONTTYPE, 10, 120, 110, 40, LBS_SORT | LBS_HASSTRINGS | LBS_DISABLENOSCROLL | WS_VSCROLL
diff --git a/dll/cpl/console/lang/de-DE.rc b/dll/cpl/console/lang/de-DE.rc
index 8a241377d0b..5ea5d53f846 100644
--- a/dll/cpl/console/lang/de-DE.rc
+++ b/dll/cpl/console/lang/de-DE.rc
@@ -37,7 +37,7 @@ BEGIN
     LTEXT "Fenstervorschau", -1, 10, 7, 65, 10
     LTEXT "Größe", -1, 130, 10, 30, 10
     CONTROL "", IDC_STATIC_FONT_WINDOW_PREVIEW, "Static", SS_OWNERDRAW | SS_SUNKEN, 10, 20, 115, 70
-    LISTBOX IDC_LBOX_FONTSIZE, 130, 20, 55, 80, LBS_SORT | LBS_DISABLENOSCROLL | WS_VSCROLL
+    LISTBOX IDC_LBOX_FONTSIZE, 130, 20, 55, 80, LBS_SORT | LBS_HASSTRINGS | LBS_DISABLENOSCROLL | WS_VSCROLL
     LTEXT "&Schrift", -1, 10, 105, 35, 10
     CHECKBOX "&Fette Schriften", IDC_CHECK_BOLD_FONTS, 45, 105, 60, 10
     LISTBOX IDC_LBOX_FONTTYPE, 10, 120, 110, 50, LBS_SORT | LBS_HASSTRINGS | LBS_DISABLENOSCROLL | WS_VSCROLL
diff --git a/dll/cpl/console/lang/en-US.rc b/dll/cpl/console/lang/en-US.rc
index a389a6af357..d4d9e576f2b 100644
--- a/dll/cpl/console/lang/en-US.rc
+++ b/dll/cpl/console/lang/en-US.rc
@@ -35,7 +35,7 @@ BEGIN
     LTEXT "Window Preview:", -1, 10, 10, 94, 10
     LTEXT "Size:", -1, 180, 10, 36, 10
     CONTROL "", IDC_STATIC_FONT_WINDOW_PREVIEW, "Static", SS_OWNERDRAW | SS_SUNKEN, 10, 20, 163, 74
-    LISTBOX IDC_LBOX_FONTSIZE, 181, 20, 55, 80, LBS_SORT | LBS_DISABLENOSCROLL | WS_VSCROLL
+    LISTBOX IDC_LBOX_FONTSIZE, 181, 20, 55, 80, LBS_SORT | LBS_HASSTRINGS | LBS_DISABLENOSCROLL | WS_VSCROLL
     LTEXT "&Font:", -1, 10, 105, 33, 10
     CHECKBOX "&Bold fonts", IDC_CHECK_BOLD_FONTS, 56, 105, 60, 10
     LISTBOX IDC_LBOX_FONTTYPE, 10, 120, 110, 40, LBS_SORT | LBS_HASSTRINGS | LBS_DISABLENOSCROLL | WS_VSCROLL
diff --git a/dll/cpl/console/lang/es-ES.rc b/dll/cpl/console/lang/es-ES.rc
index 86611a92863..4cb83e117ee 100644
--- a/dll/cpl/console/lang/es-ES.rc
+++ b/dll/cpl/console/lang/es-ES.rc
@@ -37,7 +37,7 @@ BEGIN
     LTEXT "Ventana de Previsualización", -1, 10, 7, 65, 10
     LTEXT "Tamaño", -1, 130, 10, 30, 10
     CONTROL "", IDC_STATIC_FONT_WINDOW_PREVIEW, "Static", SS_OWNERDRAW | SS_SUNKEN, 10, 20, 115, 70
-    LISTBOX IDC_LBOX_FONTSIZE, 130, 20, 55, 80, LBS_SORT | LBS_DISABLENOSCROLL | WS_VSCROLL
+    LISTBOX IDC_LBOX_FONTSIZE, 130, 20, 55, 80, LBS_SORT | LBS_HASSTRINGS | LBS_DISABLENOSCROLL | WS_VSCROLL
     LTEXT "&Fuente", -1, 10, 105, 35, 10
     CHECKBOX "&Negrita", IDC_CHECK_BOLD_FONTS, 45, 105, 60, 10
     LISTBOX IDC_LBOX_FONTTYPE, 10, 120, 110, 50, LBS_SORT | LBS_HASSTRINGS | LBS_DISABLENOSCROLL | WS_VSCROLL
diff --git a/dll/cpl/console/lang/fr-FR.rc b/dll/cpl/console/lang/fr-FR.rc
index fcfc76e36ee..4e57984b2fb 100644
--- a/dll/cpl/console/lang/fr-FR.rc
+++ b/dll/cpl/console/lang/fr-FR.rc
@@ -37,14 +37,14 @@ BEGIN
     LTEXT "Fenêtre de Prévisualisation :", -1, 10, 10, 94, 10
     LTEXT "Taille :", -1, 180, 10, 36, 10
     CONTROL "", IDC_STATIC_FONT_WINDOW_PREVIEW, "Static", SS_OWNERDRAW | SS_SUNKEN, 10, 20, 163, 74
-    LISTBOX IDC_LBOX_FONTSIZE, 181, 20, 55, 80, LBS_SORT | LBS_DISABLENOSCROLL | WS_VSCROLL
+    LISTBOX IDC_LBOX_FONTSIZE, 181, 20, 55, 80, LBS_SORT | LBS_HASSTRINGS | LBS_DISABLENOSCROLL | WS_VSCROLL
     LTEXT "&Police :", -1, 10, 105, 33, 10
     CHECKBOX "&Gras", IDC_CHECK_BOLD_FONTS, 56, 105, 60, 10
     LISTBOX IDC_LBOX_FONTTYPE, 10, 120, 110, 40, LBS_SORT | LBS_HASSTRINGS | LBS_DISABLENOSCROLL | WS_VSCROLL
     GROUPBOX "", IDC_GROUPBOX_FONT_NAME, 6, 156, 241, 50
     CONTROL "", IDC_STATIC_SELECT_FONT_PREVIEW, "Static", SS_OWNERDRAW | SS_SUNKEN, 16, 165, 95, 35
-    LTEXT "Chaque caractère est :", -1, 124, 166, 75, 10
-    LTEXT "largeur du pixel\nhauteur du pixel", -1, 136, 180, 101, 20
+    LTEXT "Chaque caractère utilise :", -1, 124, 166, 85, 10
+    LTEXT "pixels en largeur\npixels en hauteur", -1, 136, 180, 101, 20
     LTEXT "", IDC_FONT_SIZE_X, 120, 180, 10, 10
     LTEXT "", IDC_FONT_SIZE_Y, 120, 188, 10, 10
 END
diff --git a/dll/cpl/console/lang/he-IL.rc b/dll/cpl/console/lang/he-IL.rc
index 2ee72d74b64..a68475013f4 100644
--- a/dll/cpl/console/lang/he-IL.rc
+++ b/dll/cpl/console/lang/he-IL.rc
@@ -37,7 +37,7 @@ BEGIN
     LTEXT "תצוגה מקדימה:", -1, 10, 10, 94, 10
     LTEXT "גודל:", -1, 180, 10, 36, 10
     CONTROL "", IDC_STATIC_FONT_WINDOW_PREVIEW, "Static", SS_OWNERDRAW | SS_SUNKEN, 10, 20, 163, 74
-    LISTBOX IDC_LBOX_FONTSIZE, 181, 20, 55, 80, LBS_SORT | LBS_DISABLENOSCROLL | WS_VSCROLL
+    LISTBOX IDC_LBOX_FONTSIZE, 181, 20, 55, 80, LBS_SORT | LBS_HASSTRINGS | LBS_DISABLENOSCROLL | WS_VSCROLL
     LTEXT "גופן:", -1, 10, 105, 33, 10
     CHECKBOX "גופנים מודגשים", IDC_CHECK_BOLD_FONTS, 41, 105, 33, 10
     LISTBOX IDC_LBOX_FONTTYPE, 10, 120, 110, 40, LBS_SORT | LBS_HASSTRINGS | LBS_DISABLENOSCROLL | WS_VSCROLL
diff --git a/dll/cpl/console/lang/id-ID.rc b/dll/cpl/console/lang/id-ID.rc
index 4232a3b112d..e84bcbfe107 100644
--- a/dll/cpl/console/lang/id-ID.rc
+++ b/dll/cpl/console/lang/id-ID.rc
@@ -37,7 +37,7 @@ BEGIN
     LTEXT "Tinjauan Jendela", -1, 10, 7, 65, 10
     LTEXT "Ukuran", -1, 130, 10, 30, 10
     CONTROL "", IDC_STATIC_FONT_WINDOW_PREVIEW, "Static", SS_OWNERDRAW | SS_SUNKEN, 10, 20, 115, 70
-    LISTBOX IDC_LBOX_FONTSIZE, 130, 20, 55, 80, LBS_SORT | LBS_DISABLENOSCROLL | WS_VSCROLL
+    LISTBOX IDC_LBOX_FONTSIZE, 130, 20, 55, 80, LBS_SORT | LBS_HASSTRINGS | LBS_DISABLENOSCROLL | WS_VSCROLL
     LTEXT "&Font", -1, 10, 105, 35, 10
     CHECKBOX "Font &tebal", IDC_CHECK_BOLD_FONTS, 45, 105, 60, 10
     LISTBOX IDC_LBOX_FONTTYPE, 10, 120, 110, 50, LBS_SORT | LBS_HASSTRINGS | LBS_DISABLENOSCROLL | WS_VSCROLL
diff --git a/dll/cpl/console/lang/it-IT.rc b/dll/cpl/console/lang/it-IT.rc
index 395c6c45ed2..cfc0bd31e9b 100644
--- a/dll/cpl/console/lang/it-IT.rc
+++ b/dll/cpl/console/lang/it-IT.rc
@@ -37,7 +37,7 @@ BEGIN
     LTEXT "Anteprima", -1, 10, 7, 65, 10
     LTEXT "Dimansione", -1, 130, 10, 30, 10
     CONTROL "", IDC_STATIC_FONT_WINDOW_PREVIEW, "Static", SS_OWNERDRAW | SS_SUNKEN, 10, 20, 115, 70
-    LISTBOX IDC_LBOX_FONTSIZE, 130, 20, 55, 80, LBS_SORT | LBS_DISABLENOSCROLL | WS_VSCROLL
+    LISTBOX IDC_LBOX_FONTSIZE, 130, 20, 55, 80, LBS_SORT | LBS_HASSTRINGS | LBS_DISABLENOSCROLL | WS_VSCROLL
     LTEXT "&Font", -1, 10, 105, 35, 10
     CHECKBOX "&Grassetto fonts", IDC_CHECK_BOLD_FONTS, 45, 105, 60, 10
     LISTBOX IDC_LBOX_FONTTYPE, 10, 120, 110, 50, LBS_SORT | LBS_HASSTRINGS | LBS_DISABLENOSCROLL | WS_VSCROLL
diff --git a/dll/cpl/console/lang/no-NO.rc b/dll/cpl/console/lang/no-NO.rc
index 8a3eb71fe11..634812113d8 100644
--- a/dll/cpl/console/lang/no-NO.rc
+++ b/dll/cpl/console/lang/no-NO.rc
@@ -35,7 +35,7 @@ BEGIN
     LTEXT "Vindu forhåndsvisning:", -1, 10, 10, 94, 10
     LTEXT "Størrelse:", -1, 180, 10, 36, 10
     CONTROL "", IDC_STATIC_FONT_WINDOW_PREVIEW, "Static", SS_OWNERDRAW | SS_SUNKEN, 10, 20, 163, 74
-    LISTBOX IDC_LBOX_FONTSIZE, 181, 20, 55, 80, LBS_SORT | LBS_DISABLENOSCROLL | WS_VSCROLL
+    LISTBOX IDC_LBOX_FONTSIZE, 181, 20, 55, 80, LBS_SORT | LBS_HASSTRINGS | LBS_DISABLENOSCROLL | WS_VSCROLL
     LTEXT "&Skrift:", -1, 10, 105, 33, 10
     CHECKBOX "&Fet skrift", IDC_CHECK_BOLD_FONTS, 56, 105, 60, 10
     LISTBOX IDC_LBOX_FONTTYPE, 10, 120, 110, 40, LBS_SORT | LBS_HASSTRINGS | LBS_DISABLENOSCROLL | WS_VSCROLL
diff --git a/dll/cpl/console/lang/pl-PL.rc b/dll/cpl/console/lang/pl-PL.rc
index f7e8d7c3588..bcee44f7b5c 100644
--- a/dll/cpl/console/lang/pl-PL.rc
+++ b/dll/cpl/console/lang/pl-PL.rc
@@ -42,7 +42,7 @@ BEGIN
     LTEXT "Okno podglądu", -1, 10, 7, 65, 10
     LTEXT "Rozmiar", -1, 130, 10, 30, 10
     CONTROL "", IDC_STATIC_FONT_WINDOW_PREVIEW, "Static", SS_OWNERDRAW | SS_SUNKEN, 10, 20, 115, 70
-    LISTBOX IDC_LBOX_FONTSIZE, 130, 20, 55, 80, LBS_SORT | LBS_DISABLENOSCROLL | WS_VSCROLL
+    LISTBOX IDC_LBOX_FONTSIZE, 130, 20, 55, 80, LBS_SORT | LBS_HASSTRINGS | LBS_DISABLENOSCROLL | WS_VSCROLL
     LTEXT "&Czcionka", -1, 10, 105, 35, 10
     CHECKBOX "&Pogrubiona czcionka", IDC_CHECK_BOLD_FONTS, 45, 105, 60, 10
     LISTBOX IDC_LBOX_FONTTYPE, 10, 120, 110, 50, LBS_SORT | LBS_HASSTRINGS | LBS_DISABLENOSCROLL | WS_VSCROLL
diff --git a/dll/cpl/console/lang/ro-RO.rc b/dll/cpl/console/lang/ro-RO.rc
index 6f17ed30790..7c33e3a6fbe 100644
--- a/dll/cpl/console/lang/ro-RO.rc
+++ b/dll/cpl/console/lang/ro-RO.rc
@@ -44,7 +44,7 @@ BEGIN
     LTEXT "Previzionare:", -1, 10, 10, 94, 10
     LTEXT "&Mărime:", -1, 180, 10, 36, 10
     CONTROL "", IDC_STATIC_FONT_WINDOW_PREVIEW, "Static", SS_OWNERDRAW | SS_SUNKEN, 10, 20, 163, 74
-    LISTBOX IDC_LBOX_FONTSIZE, 181, 20, 55, 80, LBS_SORT | LBS_DISABLENOSCROLL | WS_VSCROLL
+    LISTBOX IDC_LBOX_FONTSIZE, 181, 20, 55, 80, LBS_SORT | LBS_HASSTRINGS | LBS_DISABLENOSCROLL | WS_VSCROLL
     LTEXT "F&ont:", -1, 10, 105, 33, 10
     CHECKBOX "&Aldin", IDC_CHECK_BOLD_FONTS, 56, 105, 60, 10
     LISTBOX IDC_LBOX_FONTTYPE, 10, 120, 110, 40, LBS_SORT | LBS_HASSTRINGS | LBS_DISABLENOSCROLL | WS_VSCROLL
diff --git a/dll/cpl/console/lang/ru-RU.rc b/dll/cpl/console/lang/ru-RU.rc
index 13e60dd0861..7a71960c3c0 100644
--- a/dll/cpl/console/lang/ru-RU.rc
+++ b/dll/cpl/console/lang/ru-RU.rc
@@ -37,7 +37,7 @@ BEGIN
     LTEXT "Окно предпросмотра:", -1, 10, 10, 94, 10
     LTEXT "Размер:", -1, 180, 10, 36, 10
     CONTROL "", IDC_STATIC_FONT_WINDOW_PREVIEW, "Static", SS_OWNERDRAW | SS_SUNKEN, 10, 20, 163, 74
-    LISTBOX IDC_LBOX_FONTSIZE, 181, 20, 55, 80, LBS_SORT | LBS_DISABLENOSCROLL | WS_VSCROLL
+    LISTBOX IDC_LBOX_FONTSIZE, 181, 20, 55, 80, LBS_SORT | LBS_HASSTRINGS | LBS_DISABLENOSCROLL | WS_VSCROLL
     LTEXT "&Шрифт:", -1, 10, 105, 33, 10
     CHECKBOX "&Жирный", IDC_CHECK_BOLD_FONTS, 56, 105, 60, 10
     LISTBOX IDC_LBOX_FONTTYPE, 10, 120, 110, 40, LBS_SORT | LBS_HASSTRINGS | LBS_DISABLENOSCROLL | WS_VSCROLL
diff --git a/dll/cpl/console/lang/sk-SK.rc b/dll/cpl/console/lang/sk-SK.rc
index 09df76713af..6392d83271b 100644
--- a/dll/cpl/console/lang/sk-SK.rc
+++ b/dll/cpl/console/lang/sk-SK.rc
@@ -39,7 +39,7 @@ BEGIN
     LTEXT "Ukážka okna:", -1, 10, 10, 94, 10
     LTEXT "Veľkosť:", -1, 180, 10, 36, 10
     CONTROL "", IDC_STATIC_FONT_WINDOW_PREVIEW, "Static", SS_OWNERDRAW | SS_SUNKEN, 10, 20, 163, 74
-    LISTBOX IDC_LBOX_FONTSIZE, 181, 20, 55, 80, LBS_SORT | LBS_DISABLENOSCROLL | WS_VSCROLL
+    LISTBOX IDC_LBOX_FONTSIZE, 181, 20, 55, 80, LBS_SORT | LBS_HASSTRINGS | LBS_DISABLENOSCROLL | WS_VSCROLL
     LTEXT "&Písmo:", -1, 10, 105, 33, 10
     CHECKBOX "&Tučné písma", IDC_CHECK_BOLD_FONTS, 56, 105, 60, 10
     LISTBOX IDC_LBOX_FONTTYPE, 10, 120, 110, 40, LBS_SORT | LBS_HASSTRINGS | LBS_DISABLENOSCROLL | WS_VSCROLL
diff --git a/dll/cpl/console/lang/sq-AL.rc b/dll/cpl/console/lang/sq-AL.rc
index b61d4488c8c..8a2364e66d7 100644
--- a/dll/cpl/console/lang/sq-AL.rc
+++ b/dll/cpl/console/lang/sq-AL.rc
@@ -38,13 +38,13 @@ FONT 8, "MS Shell Dlg"
 BEGIN
     LTEXT "Dritare Preview:", -1, 10, 10, 94, 10
     LTEXT "Masë:", -1, 180, 10, 36, 10
-    CONTROL "", IDC_STATIC_FONT_WINDOW_PREVIEW, "Statik", SS_OWNERDRAW | SS_SUNKEN, 10, 20, 163, 74
-    LISTBOX IDC_LBOX_FONTSIZE, 181, 20, 55, 80, LBS_SORT | LBS_DISABLENOSCROLL | WS_VSCROLL
+    CONTROL "", IDC_STATIC_FONT_WINDOW_PREVIEW, "Static", SS_OWNERDRAW | SS_SUNKEN, 10, 20, 163, 74
+    LISTBOX IDC_LBOX_FONTSIZE, 181, 20, 55, 80, LBS_SORT | LBS_HASSTRINGS | LBS_DISABLENOSCROLL | WS_VSCROLL
     LTEXT "&Font:", -1, 10, 105, 33, 10
     CHECKBOX "&Bold fonts", IDC_CHECK_BOLD_FONTS, 56, 105, 60, 10
     LISTBOX IDC_LBOX_FONTTYPE, 10, 120, 110, 40, LBS_SORT | LBS_HASSTRINGS | LBS_DISABLENOSCROLL | WS_VSCROLL
     GROUPBOX "", IDC_GROUPBOX_FONT_NAME, 6, 156, 241, 50
-    CONTROL "", IDC_STATIC_SELECT_FONT_PREVIEW, "Statik", SS_OWNERDRAW | SS_SUNKEN, 16, 165, 95, 35
+    CONTROL "", IDC_STATIC_SELECT_FONT_PREVIEW, "Static", SS_OWNERDRAW | SS_SUNKEN, 16, 165, 95, 35
     LTEXT "Çdo krarakter është:", -1, 124, 166, 75, 10
     LTEXT "pixeli ekranit i gjerë\npixel ekranit i gjatë", -1, 136, 180, 101, 20
     LTEXT "", IDC_FONT_SIZE_X, 120, 180, 10, 10
@@ -57,7 +57,7 @@ CAPTION "Pamja"
 FONT 8, "MS Shell Dlg"
 BEGIN
     LTEXT "Dritare Preview:", -1, 8, 6, 95, 10
-    CONTROL "", IDC_STATIC_LAYOUT_WINDOW_PREVIEW, "Statik", SS_SUNKEN | SS_OWNERDRAW, 8, 16, 115, 70
+    CONTROL "", IDC_STATIC_LAYOUT_WINDOW_PREVIEW, "Static", SS_SUNKEN | SS_OWNERDRAW, 8, 16, 115, 70
     GROUPBOX "Masa e Ekranit Buffer", -1, 130, 12, 115, 50
     LTEXT "Gjerë:", -1, 140, 28, 40, 10
     LTEXT "Gjatë:", -1, 140, 46, 39, 10
@@ -114,26 +114,26 @@ BEGIN
     EDITTEXT IDC_EDIT_COLOR_BLUE, 175, 48, 35, 14, ES_RIGHT | ES_NUMBER | WS_GROUP
     CONTROL "", IDC_UPDOWN_COLOR_BLUE, UPDOWN_CLASS, UDS_SETBUDDYINT | UDS_ALIGNRIGHT |
             UDS_AUTOBUDDY | UDS_ARROWKEYS | WS_GROUP, 210, 48, 10, 14
-    CONTROL "", IDC_STATIC_COLOR1, "Statik", SS_NOTIFY | SS_SUNKEN | SS_OWNERDRAW, 23, 80, 12, 12
-    CONTROL "", IDC_STATIC_COLOR2, "Statik", SS_NOTIFY | SS_SUNKEN | SS_OWNERDRAW, 36, 80, 12, 12
-    CONTROL "", IDC_STATIC_COLOR3, "Statik", SS_NOTIFY | SS_SUNKEN | SS_OWNERDRAW, 49, 80, 12, 12
-    CONTROL "", IDC_STATIC_COLOR4, "Statik", SS_NOTIFY | SS_SUNKEN | SS_OWNERDRAW, 62, 80, 12, 12
-    CONTROL "", IDC_STATIC_COLOR5, "Statik", SS_NOTIFY | SS_SUNKEN | SS_OWNERDRAW, 75, 80, 12, 12
-    CONTROL "", IDC_STATIC_COLOR6, "Statik", SS_NOTIFY | SS_SUNKEN | SS_OWNERDRAW, 88, 80, 12, 12
-    CONTROL "", IDC_STATIC_COLOR7, "Statik", SS_NOTIFY | SS_SUNKEN | SS_OWNERDRAW, 101, 80, 12, 12
-    CONTROL "", IDC_STATIC_COLOR8, "Statik", SS_NOTIFY | SS_SUNKEN | SS_OWNERDRAW, 114, 80, 12, 12
-    CONTROL "", IDC_STATIC_COLOR9, "Statik", SS_NOTIFY | SS_SUNKEN | SS_OWNERDRAW, 127, 80, 12, 12
-    CONTROL "", IDC_STATIC_COLOR10, "Statik", SS_NOTIFY | SS_SUNKEN | SS_OWNERDRAW, 140, 80, 12, 12
-    CONTROL "", IDC_STATIC_COLOR11, "Statik", SS_NOTIFY | SS_SUNKEN | SS_OWNERDRAW, 153, 80, 12, 12
-    CONTROL "", IDC_STATIC_COLOR12, "Statik", SS_NOTIFY | SS_SUNKEN | SS_OWNERDRAW, 166, 80, 12, 12
-    CONTROL "", IDC_STATIC_COLOR13, "Statik", SS_NOTIFY | SS_SUNKEN | SS_OWNERDRAW, 179, 80, 12, 12
-    CONTROL "", IDC_STATIC_COLOR14, "Statik", SS_NOTIFY | SS_SUNKEN | SS_OWNERDRAW, 192, 80, 12, 12
-    CONTROL "", IDC_STATIC_COLOR15, "Statik", SS_NOTIFY | SS_SUNKEN | SS_OWNERDRAW, 205, 80, 12, 12
-    CONTROL "", IDC_STATIC_COLOR16, "Statik", SS_NOTIFY | SS_SUNKEN | SS_OWNERDRAW, 218, 80, 12, 12
+    CONTROL "", IDC_STATIC_COLOR1, "Static", SS_NOTIFY | SS_SUNKEN | SS_OWNERDRAW, 23, 80, 12, 12
+    CONTROL "", IDC_STATIC_COLOR2, "Static", SS_NOTIFY | SS_SUNKEN | SS_OWNERDRAW, 36, 80, 12, 12
+    CONTROL "", IDC_STATIC_COLOR3, "Static", SS_NOTIFY | SS_SUNKEN | SS_OWNERDRAW, 49, 80, 12, 12
+    CONTROL "", IDC_STATIC_COLOR4, "Static", SS_NOTIFY | SS_SUNKEN | SS_OWNERDRAW, 62, 80, 12, 12
+    CONTROL "", IDC_STATIC_COLOR5, "Static", SS_NOTIFY | SS_SUNKEN | SS_OWNERDRAW, 75, 80, 12, 12
+    CONTROL "", IDC_STATIC_COLOR6, "Static", SS_NOTIFY | SS_SUNKEN | SS_OWNERDRAW, 88, 80, 12, 12
+    CONTROL "", IDC_STATIC_COLOR7, "Static", SS_NOTIFY | SS_SUNKEN | SS_OWNERDRAW, 101, 80, 12, 12
+    CONTROL "", IDC_STATIC_COLOR8, "Static", SS_NOTIFY | SS_SUNKEN | SS_OWNERDRAW, 114, 80, 12, 12
+    CONTROL "", IDC_STATIC_COLOR9, "Static", SS_NOTIFY | SS_SUNKEN | SS_OWNERDRAW, 127, 80, 12, 12
+    CONTROL "", IDC_STATIC_COLOR10, "Static", SS_NOTIFY | SS_SUNKEN | SS_OWNERDRAW, 140, 80, 12, 12
+    CONTROL "", IDC_STATIC_COLOR11, "Static", SS_NOTIFY | SS_SUNKEN | SS_OWNERDRAW, 153, 80, 12, 12
+    CONTROL "", IDC_STATIC_COLOR12, "Static", SS_NOTIFY | SS_SUNKEN | SS_OWNERDRAW, 166, 80, 12, 12
+    CONTROL "", IDC_STATIC_COLOR13, "Static", SS_NOTIFY | SS_SUNKEN | SS_OWNERDRAW, 179, 80, 12, 12
+    CONTROL "", IDC_STATIC_COLOR14, "Static", SS_NOTIFY | SS_SUNKEN | SS_OWNERDRAW, 192, 80, 12, 12
+    CONTROL "", IDC_STATIC_COLOR15, "Static", SS_NOTIFY | SS_SUNKEN | SS_OWNERDRAW, 205, 80, 12, 12
+    CONTROL "", IDC_STATIC_COLOR16, "Static", SS_NOTIFY | SS_SUNKEN | SS_OWNERDRAW, 218, 80, 12, 12
     GROUPBOX "Preview (monitor)", -1, 8, 100, 237, 55
-    CONTROL "", IDC_STATIC_SCREEN_COLOR, "Statik", SS_OWNERDRAW | SS_SUNKEN, 13, 110, 227, 40
+    CONTROL "", IDC_STATIC_SCREEN_COLOR, "Static", SS_OWNERDRAW | SS_SUNKEN, 13, 110, 227, 40
     GROUPBOX "Preview (Popup)", -1, 8, 160, 237, 55
-    CONTROL "", IDC_STATIC_POPUP_COLOR, "Statik", SS_OWNERDRAW | SS_SUNKEN, 13, 170, 227, 40
+    CONTROL "", IDC_STATIC_POPUP_COLOR, "Static", SS_OWNERDRAW | SS_SUNKEN, 13, 170, 227, 40
 END
 
 IDD_APPLYOPTIONS DIALOGEX 0, 0, 220, 79
diff --git a/dll/cpl/console/lang/tr-TR.rc b/dll/cpl/console/lang/tr-TR.rc
index 23445d94baf..7521b5bcce9 100644
--- a/dll/cpl/console/lang/tr-TR.rc
+++ b/dll/cpl/console/lang/tr-TR.rc
@@ -37,7 +37,7 @@ BEGIN
     LTEXT "Pencere Ön İzlemesi:", -1, 10, 10, 94, 10
     LTEXT "&Boyutlar:", -1, 180, 10, 36, 10
     CONTROL "", IDC_STATIC_FONT_WINDOW_PREVIEW, "Static", SS_OWNERDRAW | SS_SUNKEN, 10, 20, 163, 74
-    LISTBOX IDC_LBOX_FONTSIZE, 181, 20, 55, 80, LBS_SORT | LBS_DISABLENOSCROLL | WS_VSCROLL
+    LISTBOX IDC_LBOX_FONTSIZE, 181, 20, 55, 80, LBS_SORT | LBS_HASSTRINGS | LBS_DISABLENOSCROLL | WS_VSCROLL
     LTEXT "&Yazı Tipi:", -1, 10, 105, 33, 10
     CHECKBOX "&Kalın Yazı Tipleri", IDC_CHECK_BOLD_FONTS, 56, 105, 60, 10
     LISTBOX IDC_LBOX_FONTTYPE, 10, 120, 110, 40, LBS_SORT | LBS_HASSTRINGS | LBS_DISABLENOSCROLL | WS_VSCROLL
diff --git a/dll/cpl/console/lang/uk-UA.rc b/dll/cpl/console/lang/uk-UA.rc
index c98f33c127d..dbe92ecf144 100644
--- a/dll/cpl/console/lang/uk-UA.rc
+++ b/dll/cpl/console/lang/uk-UA.rc
@@ -37,7 +37,7 @@ BEGIN
     LTEXT "Зразок вікна", -1, 10, 10, 94, 10
     LTEXT "Size:", -1, 180, 10, 36, 10
     CONTROL "", IDC_STATIC_FONT_WINDOW_PREVIEW, "Static", SS_OWNERDRAW | SS_SUNKEN, 10, 20, 163, 74
-    LISTBOX IDC_LBOX_FONTSIZE, 181, 20, 55, 80, LBS_SORT | LBS_DISABLENOSCROLL | WS_VSCROLL
+    LISTBOX IDC_LBOX_FONTSIZE, 181, 20, 55, 80, LBS_SORT | LBS_HASSTRINGS | LBS_DISABLENOSCROLL | WS_VSCROLL
     LTEXT "&Шрифт:", -1, 10, 105, 33, 10
     CHECKBOX "&Жирні", IDC_CHECK_BOLD_FONTS, 56, 105, 60, 10
     LISTBOX IDC_LBOX_FONTTYPE, 10, 120, 110, 40, LBS_SORT | LBS_HASSTRINGS | LBS_DISABLENOSCROLL | WS_VSCROLL
diff --git a/dll/cpl/console/lang/zh-CN.rc b/dll/cpl/console/lang/zh-CN.rc
index 409f531e67f..fa8d9bd0390 100644
--- a/dll/cpl/console/lang/zh-CN.rc
+++ b/dll/cpl/console/lang/zh-CN.rc
@@ -37,7 +37,7 @@ BEGIN
     LTEXT "窗口预览：", -1, 10, 10, 94, 10
     LTEXT "大小：", -1, 180, 10, 36, 10
     CONTROL "", IDC_STATIC_FONT_WINDOW_PREVIEW, "Static", SS_OWNERDRAW | SS_SUNKEN, 10, 20, 163, 74
-    LISTBOX IDC_LBOX_FONTSIZE, 181, 20, 55, 80, LBS_SORT | LBS_DISABLENOSCROLL | WS_VSCROLL
+    LISTBOX IDC_LBOX_FONTSIZE, 181, 20, 55, 80, LBS_SORT | LBS_HASSTRINGS | LBS_DISABLENOSCROLL | WS_VSCROLL
     LTEXT "&字体(&F)：", -1, 10, 105, 33, 10
     CHECKBOX "粗体(&B)", IDC_CHECK_BOLD_FONTS, 56, 105, 60, 10
     LISTBOX IDC_LBOX_FONTTYPE, 10, 120, 110, 40, LBS_SORT | LBS_HASSTRINGS | LBS_DISABLENOSCROLL | WS_VSCROLL
diff --git a/dll/cpl/console/layout.c b/dll/cpl/console/layout.c
index 41ebc3146e5..fac40bba815 100644
--- a/dll/cpl/console/layout.c
+++ b/dll/cpl/console/layout.c
@@ -120,8 +120,8 @@ PaintText(LPDRAWITEMSTRUCT drawItem,
     hBrush = CreateSolidBrush(nbkColor);
     if (!hBrush) return FALSE;
 
-    Font = CreateFontW(GuiInfo->FontSize.X,
-                       0, // GuiInfo->FontSize.Y,
+    Font = CreateFontW(GuiInfo->FontSize.Y,
+                       0, // GuiInfo->FontSize.X,
                        0,
                        TA_BASELINE,
                        GuiInfo->FontWeight,
diff --git a/dll/cpl/desk/lang/sq-AL.rc b/dll/cpl/desk/lang/sq-AL.rc
index 562241f82a8..d4f34ddc9c2 100644
--- a/dll/cpl/desk/lang/sq-AL.rc
+++ b/dll/cpl/desk/lang/sq-AL.rc
@@ -9,7 +9,7 @@ STYLE DS_SHELLFONT | WS_CHILD | WS_DISABLED | WS_CAPTION
 CAPTION "Sfond"
 FONT 8, "MS Shell Dlg"
 BEGIN
-    CONTROL "", IDC_BACKGROUND_PREVIEW, "Statik", SS_OWNERDRAW, 70, 10, 105, 80, 0
+    CONTROL "", IDC_BACKGROUND_PREVIEW, "Static", SS_OWNERDRAW, 70, 10, 105, 80, 0
     CONTROL "", IDC_BACKGROUND_LIST, "SysListView32", LVS_REPORT | LVS_SINGLESEL |
             LVS_NOCOLUMNHEADER | LVS_SHAREIMAGELISTS | LVS_SHOWSELALWAYS | WS_BORDER | WS_TABSTOP, 8, 114, 174, 78
     LTEXT "Zgjidhni një imazh për t'u përdorur si sfond tuaj desktop", IDC_STATIC, 8, 103, 230, 9
@@ -24,7 +24,7 @@ STYLE DS_SHELLFONT | WS_CHILD | WS_DISABLED | WS_CAPTION
 CAPTION "Screensaver"
 FONT 8, "MS Shell Dlg", 0, 0
 BEGIN
-    CONTROL "", IDC_SCREENS_PREVIEW, "Statik", SS_OWNERDRAW, 70, 10, 105, 70, WS_EX_STATICEDGE
+    CONTROL "", IDC_SCREENS_PREVIEW, "Static", SS_OWNERDRAW, 70, 10, 105, 70, WS_EX_STATICEDGE
     GROUPBOX "&Screensaver", IDC_SCREENS_DUMMY, 8, 92, 230, 52
     COMBOBOX IDC_SCREENS_LIST, 14, 103, 100, 100, CBS_DROPDOWNLIST | CBS_SORT | WS_VSCROLL | WS_TABSTOP
     PUSHBUTTON "Cilësime%t", IDC_SCREENS_SETTINGS, 120, 103, 50, 13, WS_GROUP
@@ -134,7 +134,7 @@ BEGIN
     LTEXT "", IDC_SETTINGS_RESOLUTION_TEXT, 10, 157, 100, 10, NOT WS_GROUP | SS_CENTER
     GROUPBOX "&Ngjyra", 1817, 125, 127, 115, 43
     COMBOBOX IDC_SETTINGS_BPP, 131, 137, 103, 80, CBS_DROPDOWNLIST | CBS_AUTOHSCROLL | WS_VSCROLL | WS_TABSTOP
-    CONTROL "", IDC_SETTINGS_SPECTRUM, "Statik", SS_OWNERDRAW | SS_SUNKEN, 131, 155, 103, 9
+    CONTROL "", IDC_SETTINGS_SPECTRUM, "Static", SS_OWNERDRAW | SS_SUNKEN, 131, 155, 103, 9
     PUSHBUTTON "Përparuar...", IDC_SETTINGS_ADVANCED, 170, 174, 70, 14
 END
 
diff --git a/dll/win32/browseui/internettoolbar.cpp b/dll/win32/browseui/internettoolbar.cpp
index 3e056d9e652..7ccab1ec277 100644
--- a/dll/win32/browseui/internettoolbar.cpp
+++ b/dll/win32/browseui/internettoolbar.cpp
@@ -677,7 +677,6 @@ CInternetToolbar::CInternetToolbar()
 
 CInternetToolbar::~CInternetToolbar()
 {
-    fMenuCallback.Release();
 }
 
 void CInternetToolbar::AddDockItem(IUnknown *newItem, int bandID, int flags)
diff --git a/dll/win32/kernel32/client/console/readwrite.c b/dll/win32/kernel32/client/console/readwrite.c
index 9db3ab5cab1..f1818a0c8c8 100644
--- a/dll/win32/kernel32/client/console/readwrite.c
+++ b/dll/win32/kernel32/client/console/readwrite.c
@@ -881,6 +881,7 @@ IntWriteConsoleOutput(IN HANDLE hConsoleOutput,
     {
         WriteOutputRequest->CharInfo = &WriteOutputRequest->StaticBuffer;
         // CaptureBuffer = NULL;
+        WriteOutputRequest->UseVirtualMemory = FALSE;
     }
     else
     {
@@ -888,17 +889,36 @@ IntWriteConsoleOutput(IN HANDLE hConsoleOutput,
 
         /* Allocate a Capture Buffer */
         CaptureBuffer = CsrAllocateCaptureBuffer(1, Size);
-        if (CaptureBuffer == NULL)
+        if (CaptureBuffer)
         {
-            DPRINT1("CsrAllocateCaptureBuffer failed with size %ld!\n", Size);
-            SetLastError(ERROR_NOT_ENOUGH_MEMORY);
-            return FALSE;
+            /* Allocate space in the Buffer */
+            CsrAllocateMessagePointer(CaptureBuffer,
+                                      Size,
+                                      (PVOID*)&WriteOutputRequest->CharInfo);
+            WriteOutputRequest->UseVirtualMemory = FALSE;
         }
+        else
+        {
+            /*
+             * CsrAllocateCaptureBuffer failed because we tried to allocate
+             * a too large (>= 64 kB, size of the CSR heap) data buffer.
+             * To circumvent this, Windows uses a trick (that we reproduce for
+             * compatibility reasons): we allocate a heap buffer in the process'
+             * memory, and CSR will read it via NtReadVirtualMemory.
+             */
+            DPRINT1("CsrAllocateCaptureBuffer failed with size %ld, let's use local heap buffer...\n", Size);
 
-        /* Allocate space in the Buffer */
-        CsrAllocateMessagePointer(CaptureBuffer,
-                                  Size,
-                                  (PVOID*)&WriteOutputRequest->CharInfo);
+            WriteOutputRequest->CharInfo = RtlAllocateHeap(RtlGetProcessHeap(), 0, Size);
+            WriteOutputRequest->UseVirtualMemory = TRUE;
+
+            /* Bail out if we still cannot allocate memory */
+            if (WriteOutputRequest->CharInfo == NULL)
+            {
+                DPRINT1("Failed to allocate heap buffer with size %ld!\n", Size);
+                SetLastError(ERROR_NOT_ENOUGH_MEMORY);
+                return FALSE;
+            }
+        }
     }
 
     /* Capture the user buffer contents */
@@ -945,7 +965,16 @@ IntWriteConsoleOutput(IN HANDLE hConsoleOutput,
     Success = NT_SUCCESS(ApiMessage.Status);
 
     /* Release the capture buffer if needed */
-    if (CaptureBuffer) CsrFreeCaptureBuffer(CaptureBuffer);
+    if (CaptureBuffer)
+    {
+        CsrFreeCaptureBuffer(CaptureBuffer);
+    }
+    else
+    {
+        /* If we used a heap buffer, free it */
+        if (WriteOutputRequest->UseVirtualMemory)
+            RtlFreeHeap(RtlGetProcessHeap(), 0, WriteOutputRequest->CharInfo);
+    }
 
     /* Retrieve the results */
     _SEH2_TRY
diff --git a/dll/win32/kernel32/client/dosdev.c b/dll/win32/kernel32/client/dosdev.c
index ddd20106f57..38e0e3e0fa6 100644
--- a/dll/win32/kernel32/client/dosdev.c
+++ b/dll/win32/kernel32/client/dosdev.c
@@ -35,22 +35,18 @@ DefineDosDeviceA(
     BOOL Result;
 
     if (lpDeviceName &&
-        ! RtlCreateUnicodeStringFromAsciiz(&DeviceNameU,
-        (LPSTR)lpDeviceName))
+        !RtlCreateUnicodeStringFromAsciiz(&DeviceNameU, lpDeviceName))
     {
         SetLastError(ERROR_NOT_ENOUGH_MEMORY);
         return 0;
     }
 
     if (lpTargetPath &&
-        ! RtlCreateUnicodeStringFromAsciiz(&TargetPathU,
-        (LPSTR)lpTargetPath))
+        !RtlCreateUnicodeStringFromAsciiz(&TargetPathU, lpTargetPath))
     {
         if (DeviceNameU.Buffer)
         {
-            RtlFreeHeap(RtlGetProcessHeap (),
-                        0,
-                        DeviceNameU.Buffer);
+            RtlFreeUnicodeString(&DeviceNameU);
         }
         SetLastError(ERROR_NOT_ENOUGH_MEMORY);
         return 0;
@@ -62,16 +58,12 @@ DefineDosDeviceA(
 
     if (TargetPathU.Buffer)
     {
-        RtlFreeHeap(RtlGetProcessHeap (),
-                    0,
-                    TargetPathU.Buffer);
+        RtlFreeUnicodeString(&TargetPathU);
     }
 
     if (DeviceNameU.Buffer)
     {
-        RtlFreeHeap(RtlGetProcessHeap (),
-                    0,
-                    DeviceNameU.Buffer);
+        RtlFreeUnicodeString(&DeviceNameU);
     }
     return Result;
 }
@@ -114,7 +106,7 @@ DefineDosDeviceW(
 
     ArgumentCount = 1;
     BufferSize = 0;
-    if (! lpTargetPath)
+    if (!lpTargetPath)
     {
         RtlInitUnicodeString(&NtTargetPathU,
                              NULL);
@@ -128,10 +120,10 @@ DefineDosDeviceW(
         }
         else
         {
-            if (! RtlDosPathNameToNtPathName_U(lpTargetPath,
-                                               &NtTargetPathU,
-                                               0,
-                                               0))
+            if (!RtlDosPathNameToNtPathName_U(lpTargetPath,
+                                              &NtTargetPathU,
+                                              NULL,
+                                              NULL))
             {
                 WARN("RtlDosPathNameToNtPathName_U() failed\n");
                 BaseSetLastNTError(STATUS_OBJECT_NAME_INVALID);
@@ -151,7 +143,7 @@ DefineDosDeviceW(
 
     CaptureBuffer = CsrAllocateCaptureBuffer(ArgumentCount,
                                              BufferSize);
-    if (! CaptureBuffer)
+    if (!CaptureBuffer)
     {
         SetLastError(ERROR_NOT_ENOUGH_MEMORY);
         Result = FALSE;
@@ -161,7 +153,7 @@ DefineDosDeviceW(
         DefineDosDeviceRequest->Flags = dwFlags;
 
         CsrCaptureMessageBuffer(CaptureBuffer,
-                                (PVOID)DeviceUpcaseNameU.Buffer,
+                                DeviceUpcaseNameU.Buffer,
                                 DeviceUpcaseNameU.Length,
                                 (PVOID*)&DefineDosDeviceRequest->DeviceName.Buffer);
 
@@ -173,7 +165,7 @@ DefineDosDeviceW(
         if (NtTargetPathU.Buffer)
         {
             CsrCaptureMessageBuffer(CaptureBuffer,
-                                    (PVOID)NtTargetPathU.Buffer,
+                                    NtTargetPathU.Buffer,
                                     NtTargetPathU.Length,
                                     (PVOID*)&DefineDosDeviceRequest->TargetPath.Buffer);
         }
@@ -212,7 +204,7 @@ DefineDosDeviceW(
                         dbcv.dbcv_size = sizeof(DEV_BROADCAST_VOLUME);
                         dbcv.dbcv_devicetype = DBT_DEVTYP_VOLUME;
                         dbcv.dbcv_reserved = 0;
-                        dbcv.dbcv_unitmask |= 
+                        dbcv.dbcv_unitmask |=
                             (1 << (DeviceUpcaseNameU.Buffer[0] - L'A'));
                         dbcv.dbcv_flags = DBTF_NET;
                         (void) BSM_ptr(BSF_SENDNOTIFYMESSAGE | BSF_FLUSHDISK,
@@ -227,7 +219,8 @@ DefineDosDeviceW(
         }
     }
 
-    if (NtTargetPathU.Buffer)
+    if (NtTargetPathU.Buffer &&
+        NtTargetPathU.Buffer != lpTargetPath)
     {
         RtlFreeHeap(RtlGetProcessHeap(),
                     0,
@@ -293,7 +286,7 @@ QueryDosDeviceA(
     {
       CurrentLength = min (ucchMax, MAXUSHORT / 2);
       TargetPathU.MaximumLength = TargetPathU.Length = (USHORT)CurrentLength * sizeof(WCHAR);
-     
+
       TargetPathA.Length = 0;
       TargetPathA.MaximumLength = (USHORT)CurrentLength;
 
diff --git a/dll/win32/kernel32/client/vdm.c b/dll/win32/kernel32/client/vdm.c
index 8b50319491f..3456dab587c 100644
--- a/dll/win32/kernel32/client/vdm.c
+++ b/dll/win32/kernel32/client/vdm.c
@@ -1640,26 +1640,101 @@ GetVDMCurrentDirectories(DWORD cchCurDirs, PCHAR lpszzCurDirs)
 
 
 /*
- * @unimplemented
+ * @implemented (undocumented)
  */
 BOOL
 WINAPI
-RegisterConsoleVDM (
-    DWORD   Unknown0,
-    DWORD   Unknown1,
-    DWORD   Unknown2,
-    DWORD   Unknown3,
-    DWORD   Unknown4,
-    DWORD   Unknown5,
-    DWORD   Unknown6,
-    DWORD   Unknown7,
-    DWORD   Unknown8,
-    DWORD   Unknown9,
-    DWORD   Unknown10
-    )
+RegisterConsoleVDM(IN DWORD dwRegisterFlags,
+                   IN HANDLE hStartHardwareEvent,
+                   IN HANDLE hEndHardwareEvent,
+                   IN HANDLE hErrorHardwareEvent,
+                   IN DWORD dwUnusedVar,
+                   OUT LPDWORD lpVideoStateLength,
+                   OUT PVOID* lpVideoState, // PVIDEO_HARDWARE_STATE_HEADER*
+                   IN PVOID lpUnusedBuffer,
+                   IN DWORD dwUnusedBufferLength,
+                   IN COORD dwVDMBufferSize,
+                   OUT PVOID* lpVDMBuffer)
 {
-    STUB;
-    return FALSE;
+    BOOL Success;
+    CONSOLE_API_MESSAGE ApiMessage;
+    PCONSOLE_REGISTERVDM RegisterVDMRequest = &ApiMessage.Data.RegisterVDMRequest;
+    PCSR_CAPTURE_BUFFER CaptureBuffer = NULL;
+
+    /* Set up the data to send to the Console Server */
+    RegisterVDMRequest->ConsoleHandle = NtCurrentPeb()->ProcessParameters->ConsoleHandle;
+    RegisterVDMRequest->RegisterFlags = dwRegisterFlags;
+
+    if (dwRegisterFlags != 0)
+    {
+        RegisterVDMRequest->StartHardwareEvent = hStartHardwareEvent;
+        RegisterVDMRequest->EndHardwareEvent   = hEndHardwareEvent;
+        RegisterVDMRequest->ErrorHardwareEvent = hErrorHardwareEvent;
+
+        RegisterVDMRequest->VDMBufferSize = dwVDMBufferSize;
+
+#if 0
+        RegisterVDMRequest->UnusedBufferLength = dwUnusedBufferLength;
+
+        /* Allocate a Capture Buffer */
+        CaptureBuffer = CsrAllocateCaptureBuffer(1, dwUnusedBufferLength);
+        if (CaptureBuffer == NULL)
+        {
+            DPRINT1("CsrAllocateCaptureBuffer failed!\n");
+            SetLastError(ERROR_NOT_ENOUGH_MEMORY);
+            return FALSE;
+        }
+
+        /* Capture the buffer to write */
+        CsrCaptureMessageBuffer(CaptureBuffer,
+                                (PVOID)lpUnusedBuffer,
+                                dwUnusedBufferLength,
+                                (PVOID*)&RegisterVDMRequest->UnusedBuffer);
+#endif
+    }
+    else
+    {
+        // CaptureBuffer = NULL;
+    }
+
+    /* Call the server */
+    CsrClientCallServer((PCSR_API_MESSAGE)&ApiMessage,
+                        CaptureBuffer,
+                        CSR_CREATE_API_NUMBER(CONSRV_SERVERDLL_INDEX, ConsolepRegisterVDM),
+                        sizeof(*RegisterVDMRequest));
+
+    /* Check for success */
+    Success = NT_SUCCESS(ApiMessage.Status);
+
+    /* Release the capture buffer if needed */
+    if (CaptureBuffer) CsrFreeCaptureBuffer(CaptureBuffer);
+
+    /* Retrieve the results */
+    if (Success)
+    {
+        if (dwRegisterFlags != 0)
+        {
+            _SEH2_TRY
+            {
+                *lpVideoStateLength = RegisterVDMRequest->VideoStateLength;
+                *lpVideoState       = RegisterVDMRequest->VideoState;
+                *lpVDMBuffer        = RegisterVDMRequest->VDMBuffer;
+            }
+            _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
+            {
+                SetLastError(ERROR_INVALID_ACCESS);
+                Success = FALSE;
+            }
+            _SEH2_END;
+        }
+    }
+    else
+    {
+        BaseSetLastNTError(ApiMessage.Status);
+    }
+
+    /* Return success status */
+    return Success;
 }
 
 
@@ -1756,9 +1831,8 @@ VDMOperationStarted(IN ULONG Unknown0)
 {
     DPRINT1("VDMOperationStarted(%d)\n", Unknown0);
 
-    return
-    BaseUpdateVDMEntry(VdmEntryUpdateControlCHandler,
-                       NULL,
-                       0,
-                       Unknown0);
+    return BaseUpdateVDMEntry(VdmEntryUpdateControlCHandler,
+                              NULL,
+                              0,
+                              Unknown0);
 }
diff --git a/dll/win32/rpcrt4/ndr_marshall.c b/dll/win32/rpcrt4/ndr_marshall.c
index 6f19cb35761..51795467e49 100644
--- a/dll/win32/rpcrt4/ndr_marshall.c
+++ b/dll/win32/rpcrt4/ndr_marshall.c
@@ -1120,7 +1120,7 @@ static void PointerFree(PMIDL_STUB_MESSAGE pStubMsg,
    * BufferStart and BufferEnd won't be reset when allocating memory for
    * sending the response. we don't have to check for the new buffer here as
    * it won't be used a type memory, only for buffer memory */
-  if (Pointer >= pStubMsg->BufferStart && Pointer < pStubMsg->BufferEnd)
+  if (Pointer >= pStubMsg->BufferStart && Pointer <= pStubMsg->BufferEnd)
       goto notfree;
 
   if (attr & RPC_FC_P_ONSTACK) {
diff --git a/dll/win32/serialui/lang/sq-AL.rc b/dll/win32/serialui/lang/sq-AL.rc
index 193b1863d59..5626c815ae4 100644
--- a/dll/win32/serialui/lang/sq-AL.rc
+++ b/dll/win32/serialui/lang/sq-AL.rc
@@ -25,14 +25,14 @@ FONT 8, "MS Shell Dlg"
 STYLE 0x10C80080
 EXSTYLE 0x00000001
 BEGIN
-    CONTROL "", IDC_GRP1, "Buton", 0x50000007, 6, 5, 210, 146, 0x00000000
-    CONTROL "OK", IDC_OKBTN, "Buton", 0x50010000, 98, 156, 56, 13, 0x00000000
-    CONTROL "Anulo", IDC_CANCELBTN, "Buton", 0x50010000, 158, 156, 56, 13, 0x00000000
-    CONTROL "Baud normë:", IDC_STC1, "Statik", 0x50000000, 24, 31, 42, 9, 0x00000000
-    CONTROL "Byte masë:", IDC_STC2, "Statik", 0x50000000, 24, 53, 42, 9, 0x00000000
-    CONTROL "Barazi:", IDC_STC3, "Statik", 0x50000000, 24, 73, 42, 9, 0x00000000
-    CONTROL "Ndalo bits:", IDC_STC4, "Statik", 0x50000000, 24, 96, 42, 9, 0x00000000
-    CONTROL "Kontroll Rrjedhe:", IDC_STC5, "Statik", 0x50000000, 24, 120, 42, 9, 0x00000000
+    CONTROL "", IDC_GRP1, "Button", 0x50000007, 6, 5, 210, 146, 0x00000000
+    CONTROL "OK", IDC_OKBTN, "Button", 0x50010000, 98, 156, 56, 13, 0x00000000
+    CONTROL "Anulo", IDC_CANCELBTN, "Button", 0x50010000, 158, 156, 56, 13, 0x00000000
+    CONTROL "Baud normë:", IDC_STC1, "Static", 0x50000000, 24, 31, 42, 9, 0x00000000
+    CONTROL "Byte masë:", IDC_STC2, "Static", 0x50000000, 24, 53, 42, 9, 0x00000000
+    CONTROL "Barazi:", IDC_STC3, "Static", 0x50000000, 24, 73, 42, 9, 0x00000000
+    CONTROL "Ndalo bits:", IDC_STC4, "Static", 0x50000000, 24, 96, 42, 9, 0x00000000
+    CONTROL "Kontroll Rrjedhe:", IDC_STC5, "Static", 0x50000000, 24, 120, 42, 9, 0x00000000
     CONTROL "", IDC_BAUDRATE, "ComboBox", 0x50210003, 98, 29, 100, 50, 0x00000000
     CONTROL "", IDC_BYTESIZE, "ComboBox", 0x50210003, 98, 49, 100, 50, 0x00000000
     CONTROL "", IDC_PARITY, "ComboBox", 0x50210003, 98, 72, 100, 50, 0x00000000
diff --git a/dll/win32/shell32/folders/fs.cpp b/dll/win32/shell32/folders/fs.cpp
index 47b5a619de8..d5d409e85f3 100644
--- a/dll/win32/shell32/folders/fs.cpp
+++ b/dll/win32/shell32/folders/fs.cpp
@@ -1439,20 +1439,17 @@ HRESULT WINAPI CFSFolder::Drop(IDataObject *pDataObject,
             _DoDropData *data = static_cast<_DoDropData*>(HeapAlloc(GetProcessHeap(), 0, sizeof(_DoDropData)));
             data->This = this;
             // Need to maintain this class in case the window is closed or the class exists temporarily (when dropping onto a folder).
+            pDataObject->AddRef();
+            pAsyncOperation->StartOperation(NULL);
+            CoMarshalInterThreadInterfaceInStream(IID_IDataObject, pDataObject, &data->pStream);
             this->AddRef();
-            data->pDataObject = pDataObject;
-            data->pAsyncOperation = pAsyncOperation;
             data->dwKeyState = dwKeyState;
             data->pt = pt;
             // Need to dereference as pdweffect gets freed.
             data->pdwEffect = *pdwEffect;
-            data->pDataObject->AddRef();
-            data->pAsyncOperation->StartOperation(NULL);
             SHCreateThread(CFSFolder::_DoDropThreadProc, data, NULL, NULL);
             return S_OK;
         }
-        else
-            pAsyncOperation->Release();
     }
     return this->_DoDrop(pDataObject, dwKeyState, pt, pdwEffect);
 }
@@ -1753,12 +1750,22 @@ HRESULT WINAPI CFSFolder::_DoDrop(IDataObject *pDataObject,
 }
 
 DWORD WINAPI CFSFolder::_DoDropThreadProc(LPVOID lpParameter) {
+    CoInitialize(NULL);
     _DoDropData *data = static_cast<_DoDropData*>(lpParameter);
-    HRESULT hr = data->This->_DoDrop(data->pDataObject, data->dwKeyState, data->pt, &data->pdwEffect);
+    IDataObject *pDataObject;
+    HRESULT hr = CoGetInterfaceAndReleaseStream (data->pStream, IID_IDataObject, (void**) &pDataObject);
+
+    if (SUCCEEDED(hr))
+    {
+        CComPtr<IAsyncOperation> pAsyncOperation;
+        hr = data->This->_DoDrop(pDataObject, data->dwKeyState, data->pt, &data->pdwEffect);
+        if (SUCCEEDED(pDataObject->QueryInterface(IID_PPV_ARG(IAsyncOperation, &pAsyncOperation))))
+        {
+            pAsyncOperation->EndOperation(hr, NULL, data->pdwEffect);
+        }
+        pDataObject->Release();
+    }
     //Release the CFSFolder and data object holds in the copying thread.
-    data->pAsyncOperation->EndOperation(hr, NULL, data->pdwEffect);
-    data->pAsyncOperation->Release();
-    data->pDataObject->Release();
     data->This->Release();
     //Release the parameter from the heap.
     HeapFree(GetProcessHeap(), 0, data);
diff --git a/dll/win32/shell32/folders/fs.h b/dll/win32/shell32/folders/fs.h
index 95ca362ccfe..ac7b2cda92c 100644
--- a/dll/win32/shell32/folders/fs.h
+++ b/dll/win32/shell32/folders/fs.h
@@ -123,8 +123,7 @@ class CFSFolder :
 
 struct _DoDropData {
     CFSFolder *This;
-    IDataObject *pDataObject;
-    IAsyncOperation *pAsyncOperation;
+    IStream *pStream;
     DWORD dwKeyState;
     POINTL pt; 
     DWORD pdwEffect;
diff --git a/dll/win32/shell32/lang/sq-AL.rc b/dll/win32/shell32/lang/sq-AL.rc
index 4568c57b000..34aa9202526 100644
--- a/dll/win32/shell32/lang/sq-AL.rc
+++ b/dll/win32/shell32/lang/sq-AL.rc
@@ -289,11 +289,11 @@ BEGIN
     LTEXT "Dokumentimi Sistemit:", -1, 8, 51, 95, 10
     EDITTEXT 14002, 110, 51, 120, 10, ES_LEFT | ES_READONLY | NOT WS_BORDER | NOT WS_TABSTOP
     LTEXT "", -1, 8, 64, 223, 1, SS_ETCHEDHORZ | WS_CHILD | WS_VISIBLE
-    CONTROL "", 14013, "Statik", SS_SUNKEN | SS_OWNERDRAW, 8, 69, 10, 10
+    CONTROL "", 14013, "Static", SS_SUNKEN | SS_OWNERDRAW, 8, 69, 10, 10
     LTEXT "Hapësira përdorur:", -1, 25, 69, 80, 10
     EDITTEXT 14003, 110, 69, 86, 10, ES_LEFT | ES_READONLY | NOT WS_BORDER | NOT WS_TABSTOP | ES_AUTOHSCROLL
     EDITTEXT 14004, 197, 69, 33, 10, ES_LEFT | ES_READONLY | NOT WS_BORDER | NOT WS_TABSTOP | ES_AUTOHSCROLL
-    CONTROL "", 14014, "Statik", SS_SUNKEN | SS_OWNERDRAW, 8, 82, 10, 10
+    CONTROL "", 14014, "Static", SS_SUNKEN | SS_OWNERDRAW, 8, 82, 10, 10
     LTEXT "Hapësirë Falas:", -1, 25, 82, 80, 10
     EDITTEXT 14005, 110, 82, 86, 10, ES_LEFT | ES_READONLY | NOT WS_BORDER | NOT WS_TABSTOP | ES_AUTOHSCROLL
     EDITTEXT 14006, 197, 82, 33, 10, ES_LEFT | ES_READONLY | NOT WS_BORDER | NOT WS_TABSTOP | ES_AUTOHSCROLL
@@ -301,7 +301,7 @@ BEGIN
     LTEXT "Kapaciteti:", -1, 25, 103, 80, 10
     EDITTEXT 14007, 110, 103, 86, 10, ES_LEFT | ES_READONLY | NOT WS_BORDER | NOT WS_TABSTOP | ES_AUTOHSCROLL
     EDITTEXT 14008, 197, 103, 33, 10, ES_LEFT | ES_READONLY | NOT WS_BORDER | NOT WS_TABSTOP | ES_AUTOHSCROLL
-    CONTROL "", 14015, "Statik", SS_OWNERDRAW, 70, 116, 100, 30
+    CONTROL "", 14015, "Static", SS_OWNERDRAW, 70, 116, 100, 30
     LTEXT "Drive %c", 14009, 100, 150, 70, 10
     PUSHBUTTON "Pastrim &Disku", 14010, 160, 154, 70, 15, WS_TABSTOP
     LTEXT "", -1, 8, 171, 223, 1, SS_ETCHEDHORZ | WS_CHILD | WS_VISIBLE
diff --git a/dll/win32/syssetup/security.c b/dll/win32/syssetup/security.c
index c181f2c09ae..09c42f5e04b 100644
--- a/dll/win32/syssetup/security.c
+++ b/dll/win32/syssetup/security.c
@@ -170,7 +170,11 @@ InstallBuiltinAccounts(VOID)
 
     for (i = 0; i < 10; i++)
     {
-        ConvertStringSidToSid(BuiltinAccounts[i], &AccountSid);
+        if (!ConvertStringSidToSid(BuiltinAccounts[i], &AccountSid))
+        {
+            DPRINT1("ConvertStringSidToSid(%S) failed: %lu\n", BuiltinAccounts[i], GetLastError());
+            continue;
+        }
 
         Status = LsaCreateAccount(PolicyHandle,
                                   AccountSid,
@@ -277,7 +281,11 @@ InstallPrivileges(VOID)
             }
             DPRINT("SID: %S\n", szSidString);
 
-            ConvertStringSidToSid(szSidString, &AccountSid);
+            if (!ConvertStringSidToSid(szSidString, &AccountSid))
+            {
+                DPRINT1("ConvertStringSidToSid(%S) failed: %lu\n", szSidString, GetLastError());
+                continue;
+            }
 
             Status = LsaOpenAccount(PolicyHandle,
                                     AccountSid,
@@ -330,7 +338,7 @@ SetAdministratorPassword(LPCWSTR Password)
     SAM_HANDLE UserHandle = NULL;
     NTSTATUS Status;
 
-    DPRINT1("SYSSETUP: SetAdministratorPassword(%S)\n", Password);
+    DPRINT("SYSSETUP: SetAdministratorPassword(%p)\n", Password);
 
     memset(&ObjectAttributes, 0, sizeof(LSA_OBJECT_ATTRIBUTES));
     ObjectAttributes.Length = sizeof(LSA_OBJECT_ATTRIBUTES);
diff --git a/include/psdk/wincon.h b/include/psdk/wincon.h
index c44e478dab0..2df5ef345a0 100644
--- a/include/psdk/wincon.h
+++ b/include/psdk/wincon.h
@@ -618,6 +618,12 @@ BOOL WINAPI CloseConsoleHandle(_In_ HANDLE);
 // BOOL WINAPI SetStdHandle(_In_ DWORD, _In_ HANDLE);
 /* Undocumented */
 BOOL WINAPI VerifyConsoleIoHandle(_In_ HANDLE);
+/* Undocumented */
+BOOL
+WINAPI
+RegisterConsoleVDM(_In_ DWORD, _In_ HANDLE, _In_ HANDLE, _In_ HANDLE, _In_ DWORD,
+                   _Out_ LPDWORD, _Out_ PVOID*, _In_ PVOID, _In_ DWORD, _In_ COORD,
+                   _Out_ PVOID*);
 
 BOOL
 WINAPI
diff --git a/include/reactos/subsys/win/conmsg.h b/include/reactos/subsys/win/conmsg.h
index a11d0bf64b8..1f047226d3d 100644
--- a/include/reactos/subsys/win/conmsg.h
+++ b/include/reactos/subsys/win/conmsg.h
@@ -544,7 +544,12 @@ typedef struct
     SMALL_RECT WriteRegion;
     BOOLEAN Unicode;
 
-    ULONG Unknown;
+    /*
+     * If we are going to write too large (>= 64 kB, size of the CSR heap)
+     * data buffers, we allocate a heap buffer in the process' memory, and
+     * CSR will read it via NtReadVirtualMemory.
+     */
+    BOOLEAN UseVirtualMemory;
 } CONSOLE_WRITEOUTPUT, *PCONSOLE_WRITEOUTPUT;
 
 typedef struct
@@ -801,6 +806,28 @@ typedef struct
     BOOL   Ansi;
 } CONSOLE_GETKBDLAYOUTNAME, *PCONSOLE_GETKBDLAYOUTNAME;
 
+typedef struct
+{
+    HANDLE ConsoleHandle;
+    ULONG  RegisterFlags;
+    HANDLE StartHardwareEvent;
+    HANDLE EndHardwareEvent;
+    HANDLE ErrorHardwareEvent;
+
+    /* Unused member */
+    ULONG  UnusedVar;
+
+    ULONG  VideoStateLength;
+    PVOID  VideoState;  // PVIDEO_HARDWARE_STATE_HEADER
+
+    /* Unused members */
+    PVOID  UnusedBuffer;
+    ULONG  UnusedBufferLength;
+
+    COORD  VDMBufferSize;
+    PVOID  VDMBuffer;
+} CONSOLE_REGISTERVDM, *PCONSOLE_REGISTERVDM;
+
 typedef struct _CONSOLE_API_MESSAGE
 {
     PORT_MESSAGE Header;
@@ -898,6 +925,9 @@ typedef struct _CONSOLE_API_MESSAGE
         CONSOLE_GETINPUTOUTPUTCP GetConsoleCPRequest;
         CONSOLE_SETINPUTOUTPUTCP SetConsoleCPRequest;
         CONSOLE_GETKBDLAYOUTNAME GetKbdLayoutNameRequest;
+
+        /* Virtual DOS Machine */
+        CONSOLE_REGISTERVDM RegisterVDMRequest;
     } Data;
 } CONSOLE_API_MESSAGE, *PCONSOLE_API_MESSAGE;
 
diff --git a/subsystems/ntvdm/hardware/vga.c b/subsystems/ntvdm/hardware/vga.c
index a175c37faae..caa6332009c 100644
--- a/subsystems/ntvdm/hardware/vga.c
+++ b/subsystems/ntvdm/hardware/vga.c
@@ -23,7 +23,7 @@ static CONST DWORD MemoryLimit[] = { 0xAFFFF, 0xAFFFF, 0xB7FFF, 0xBFFFF };
 
 /*
  * Activate this line if you want to use the real
- * RegisterConsoleVDM API of Windows/ReactOS.
+ * RegisterConsoleVDM API of ReactOS/Windows.
  */
 // #define USE_REAL_REGISTERCONSOLEVDM
 
@@ -314,33 +314,33 @@ static PCHAR_INFO CharBuff  = NULL; // This is a hack, which is unneeded
 
 BOOL
 WINAPI
-__RegisterConsoleVDM(IN DWORD dwDosVDMFlag,
-                     IN HANDLE hEventHandle1,
-                     IN HANDLE hEventHandle2,
-                     IN HANDLE hEventHandle3,
-                     IN DWORD Unused1,
-                     OUT PULONG returned_val_1,
-                     OUT PVOID* returned_val_2,
-                     IN PVOID lpUnknownBuffer,
-                     IN DWORD dwUnknownBufferLength,
+__RegisterConsoleVDM(IN DWORD dwRegisterFlags,
+                     IN HANDLE hStartHardwareEvent,
+                     IN HANDLE hEndHardwareEvent,
+                     IN HANDLE hErrorHardwareEvent,
+                     IN DWORD dwUnusedVar,
+                     OUT LPDWORD lpVideoStateLength,
+                     OUT PVOID* lpVideoState, // PVIDEO_HARDWARE_STATE_HEADER*
+                     IN PVOID lpUnusedBuffer,
+                     IN DWORD dwUnusedBufferLength,
                      IN COORD dwVDMBufferSize,
                      OUT PVOID* lpVDMBuffer)
 {
-    UNREFERENCED_PARAMETER(hEventHandle3);
-    UNREFERENCED_PARAMETER(Unused1);
-    UNREFERENCED_PARAMETER(returned_val_1);
-    UNREFERENCED_PARAMETER(returned_val_2);
-    UNREFERENCED_PARAMETER(lpUnknownBuffer);
-    UNREFERENCED_PARAMETER(dwUnknownBufferLength);
+    UNREFERENCED_PARAMETER(hErrorHardwareEvent);
+    UNREFERENCED_PARAMETER(dwUnusedVar);
+    UNREFERENCED_PARAMETER(lpVideoStateLength);
+    UNREFERENCED_PARAMETER(lpVideoState);
+    UNREFERENCED_PARAMETER(lpUnusedBuffer);
+    UNREFERENCED_PARAMETER(dwUnusedBufferLength);
 
     SetLastError(0);
-    DPRINT1("__RegisterConsoleVDM(%d)\n", dwDosVDMFlag);
+    DPRINT1("__RegisterConsoleVDM(%d)\n", dwRegisterFlags);
 
     if (lpVDMBuffer == NULL) return FALSE;
 
-    if (dwDosVDMFlag != 0)
+    if (dwRegisterFlags != 0)
     {
-        // if (EventHandle_1 == NULL || EventHandle_2 == NULL) return FALSE;
+        // if (hStartHardwareEvent == NULL || hEndHardwareEvent == NULL) return FALSE;
         if (VDMBuffer != NULL) return FALSE;
 
         VDMBufferSize = dwVDMBufferSize;
@@ -451,7 +451,7 @@ static BOOL VgaAttachToConsoleInternal(PCOORD Resolution)
     /*
      * Windows 2k3 winsrv.dll calls NtVdmControl(VdmQueryVdmProcess == 14, &ConsoleHandle);
      * in the two following APIs:
-     * SrvRegisterConsoleVDM  (corresponding win32 API: RegisterConsoleVDM)
+     * SrvRegisterConsoleVDM  (corresponding Win32 API: RegisterConsoleVDM)
      * SrvVDMConsoleOperation (corresponding Win32 API: )
      * to check whether the current process is a VDM process, and fails otherwise with the
      * error 0xC0000022 ().
diff --git a/win32ss/user/ntuser/focus.c b/win32ss/user/ntuser/focus.c
index 31a9f239b60..98f107f2594 100644
--- a/win32ss/user/ntuser/focus.c
+++ b/win32ss/user/ntuser/focus.c
@@ -372,28 +372,22 @@ FindRemoveAsyncMsg(PWND Wnd, WPARAM wParam)
 
    pti = Wnd->head.pti;
 
-   if (!IsListEmpty(&pti->SentMessagesListHead))
+   Entry = pti->SentMessagesListHead.Flink;
+   while (Entry != &pti->SentMessagesListHead)
    {
       // Scan sent queue messages to see if we received async messages.
-      Entry = pti->SentMessagesListHead.Flink;
       Message = CONTAINING_RECORD(Entry, USER_SENT_MESSAGE, ListEntry);
-      do
-      {
-         if (IsListEmpty(Entry)) return;
-         if (!Message) return;
-         Entry = Message->ListEntry.Flink;
+      Entry = Entry->Flink;
 
-         if (Message->Msg.message == WM_ASYNC_SETACTIVEWINDOW &&
-             Message->Msg.hwnd == UserHMGetHandle(Wnd) &&
-             Message->Msg.wParam == wParam )
-         {
-             ERR("ASYNC SAW: Found one in the Sent Msg Queue! %p Activate/Deactivate %d\n", Message->Msg.hwnd,!!wParam);
-             RemoveEntryList(&Message->ListEntry); // Purge the entry.
-             ExFreePoolWithTag(Message, TAG_USRMSG);
-         }
-         Message = CONTAINING_RECORD(Entry, USER_SENT_MESSAGE, ListEntry);
+      if (Message->Msg.message == WM_ASYNC_SETACTIVEWINDOW &&
+          Message->Msg.hwnd == UserHMGetHandle(Wnd) &&
+          Message->Msg.wParam == wParam)
+      {
+         ERR("ASYNC SAW: Found one in the Sent Msg Queue! %p Activate/Deactivate %d\n", Message->Msg.hwnd, !!wParam);
+         RemoveEntryList(&Message->ListEntry); // Purge the entry.
+         ClearMsgBitsMask(pti, Message->QS_Flags);
+         ExFreePoolWithTag(Message, TAG_USRMSG);
       }
-      while (Entry != &pti->SentMessagesListHead);
    }
 }
 
diff --git a/win32ss/user/winsrv/consrv/condrv/conoutput.c b/win32ss/user/winsrv/consrv/condrv/conoutput.c
index 42d5cbfdb36..4fe657454f4 100644
--- a/win32ss/user/winsrv/consrv/condrv/conoutput.c
+++ b/win32ss/user/winsrv/consrv/condrv/conoutput.c
@@ -188,7 +188,7 @@ ConDrvSetConsoleActiveScreenBuffer(IN PCONSOLE Console,
     if (Buffer == Console->ActiveBuffer) return STATUS_SUCCESS;
 
     /* If old buffer has no handles, it's now unreferenced */
-    if (Console->ActiveBuffer->Header.HandleCount == 0)
+    if (Console->ActiveBuffer->Header.ReferenceCount == 0)
     {
         ConioDeleteScreenBuffer(Console->ActiveBuffer);
     }
@@ -207,6 +207,13 @@ ConDrvGetActiveScreenBuffer(IN PCONSOLE Console)
 
 /* PUBLIC DRIVER APIS *********************************************************/
 
+NTSTATUS NTAPI
+ConDrvWriteConsoleOutputVDM(IN PCONSOLE Console,
+                            IN PTEXTMODE_SCREEN_BUFFER Buffer,
+                            IN PCHAR_CELL CharInfo/*Buffer*/,
+                            IN COORD CharInfoSize,
+                            IN OUT PSMALL_RECT WriteRegion,
+                            IN BOOLEAN DrawRegion);
 NTSTATUS NTAPI
 ConDrvInvalidateBitMapRect(IN PCONSOLE Console,
                            IN PCONSOLE_SCREEN_BUFFER Buffer,
@@ -218,6 +225,19 @@ ConDrvInvalidateBitMapRect(IN PCONSOLE Console,
     /* Validity check */
     ASSERT(Console == Buffer->Header.Console);
 
+    /* In text-mode only, draw the VDM buffer if present */
+    if (GetType(Buffer) == TEXTMODE_BUFFER)
+    {
+        PTEXTMODE_SCREEN_BUFFER TextBuffer = (PTEXTMODE_SCREEN_BUFFER)Buffer;
+
+        /*Status =*/ ConDrvWriteConsoleOutputVDM(Buffer->Header.Console,
+                                                 TextBuffer,
+                                                 Console->VDMBuffer,
+                                                 Console->VDMBufferSize,
+                                                 Region,
+                                                 FALSE);
+    }
+
     /* If the output buffer is the current one, redraw the correct portion of the screen */
     if (Buffer == Console->ActiveBuffer) TermDrawRegion(Console, Region);
 
diff --git a/win32ss/user/winsrv/consrv/condrv/text.c b/win32ss/user/winsrv/consrv/condrv/text.c
index 96e30035931..6b8dbdcbc8a 100644
--- a/win32ss/user/winsrv/consrv/condrv/text.c
+++ b/win32ss/user/winsrv/consrv/condrv/text.c
@@ -722,6 +722,68 @@ ConDrvWriteConsoleOutput(IN PCONSOLE Console,
     return STATUS_SUCCESS;
 }
 
+/*
+ * NOTE: This function is strongly inspired by ConDrvWriteConsoleOutput...
+ */
+NTSTATUS NTAPI
+ConDrvWriteConsoleOutputVDM(IN PCONSOLE Console,
+                            IN PTEXTMODE_SCREEN_BUFFER Buffer,
+                            IN PCHAR_CELL CharInfo/*Buffer*/,
+                            IN COORD CharInfoSize,
+                            IN OUT PSMALL_RECT WriteRegion,
+                            IN BOOLEAN DrawRegion)
+{
+    SHORT X, Y;
+    SMALL_RECT ScreenBuffer;
+    PCHAR_CELL CurCharInfo;
+    SMALL_RECT CapturedWriteRegion;
+    PCHAR_INFO Ptr;
+
+    if (Console == NULL || Buffer == NULL || CharInfo == NULL || WriteRegion == NULL)
+    {
+        return STATUS_INVALID_PARAMETER;
+    }
+
+    /* Validity check */
+    ASSERT(Console == Buffer->Header.Console);
+
+    CapturedWriteRegion = *WriteRegion;
+
+    /* Make sure WriteRegion is inside the screen buffer */
+    ConioInitRect(&ScreenBuffer, 0, 0,
+                  Buffer->ScreenBufferSize.Y - 1, Buffer->ScreenBufferSize.X - 1);
+    if (!ConioGetIntersection(&CapturedWriteRegion, &ScreenBuffer, &CapturedWriteRegion))
+    {
+        /*
+         * It is okay to have a WriteRegion completely outside
+         * the screen buffer. No data is written then.
+         */
+        return STATUS_SUCCESS;
+    }
+
+    // CurCharInfo = CharInfo;
+
+    for (Y = CapturedWriteRegion.Top; Y <= CapturedWriteRegion.Bottom; ++Y)
+    {
+        /**/CurCharInfo = CharInfo + Y * CharInfoSize.X + CapturedWriteRegion.Left;/**/
+
+        Ptr = ConioCoordToPointer(Buffer, CapturedWriteRegion.Left, Y);
+        for (X = CapturedWriteRegion.Left; X <= CapturedWriteRegion.Right; ++X)
+        {
+            ConsoleAnsiCharToUnicodeChar(Console, &Ptr->Char.UnicodeChar, &CurCharInfo->Char);
+            Ptr->Attributes = CurCharInfo->Attributes;
+            ++Ptr;
+            ++CurCharInfo;
+        }
+    }
+
+    if (DrawRegion) TermDrawRegion(Console, &CapturedWriteRegion);
+
+    *WriteRegion = CapturedWriteRegion;
+
+    return STATUS_SUCCESS;
+}
+
 NTSTATUS NTAPI
 ConDrvWriteConsole(IN PCONSOLE Console,
                    IN PTEXTMODE_SCREEN_BUFFER ScreenBuffer,
diff --git a/win32ss/user/winsrv/consrv/conoutput.c b/win32ss/user/winsrv/consrv/conoutput.c
index 833b3cdbb79..12a4d4d8e00 100644
--- a/win32ss/user/winsrv/consrv/conoutput.c
+++ b/win32ss/user/winsrv/consrv/conoutput.c
@@ -463,15 +463,15 @@ CSR_API(SrvReadConsoleOutput)
 
     DPRINT("SrvReadConsoleOutput\n");
 
+    NumCells = (ReadOutputRequest->ReadRegion.Right - ReadOutputRequest->ReadRegion.Left + 1) *
+               (ReadOutputRequest->ReadRegion.Bottom - ReadOutputRequest->ReadRegion.Top + 1);
+
     /*
      * For optimization purposes, Windows (and hence ReactOS, too, for
      * compatibility reasons) uses a static buffer if no more than one
      * cell is read. Otherwise a new buffer is used.
      * The client-side expects that we know this behaviour.
      */
-    NumCells = (ReadOutputRequest->ReadRegion.Right - ReadOutputRequest->ReadRegion.Left + 1) *
-               (ReadOutputRequest->ReadRegion.Bottom - ReadOutputRequest->ReadRegion.Top + 1);
-
     if (NumCells <= 1)
     {
         /*
@@ -520,54 +520,95 @@ CSR_API(SrvWriteConsoleOutput)
     NTSTATUS Status;
     PCONSOLE_WRITEOUTPUT WriteOutputRequest = &((PCONSOLE_API_MESSAGE)ApiMessage)->Data.WriteOutputRequest;
     PTEXTMODE_SCREEN_BUFFER Buffer;
+    PCSR_PROCESS Process = CsrGetClientThread()->Process;
 
     ULONG NumCells;
     PCHAR_INFO CharInfo;
 
     DPRINT("SrvWriteConsoleOutput\n");
 
-    /*
-     * For optimization purposes, Windows (and hence ReactOS, too, for
-     * compatibility reasons) uses a static buffer if no more than one
-     * cell is written. Otherwise a new buffer is used.
-     * The client-side expects that we know this behaviour.
-     */
     NumCells = (WriteOutputRequest->WriteRegion.Right - WriteOutputRequest->WriteRegion.Left + 1) *
                (WriteOutputRequest->WriteRegion.Bottom - WriteOutputRequest->WriteRegion.Top + 1);
 
-    if (NumCells <= 1)
-    {
-        /*
-         * Adjust the internal pointer, because its old value points to
-         * the static buffer in the original ApiMessage structure.
-         */
-        // WriteOutputRequest->CharInfo = &WriteOutputRequest->StaticBuffer;
-        CharInfo = &WriteOutputRequest->StaticBuffer;
-    }
-    else
-    {
-        if (!CsrValidateMessageBuffer(ApiMessage,
-                                      (PVOID*)&WriteOutputRequest->CharInfo,
-                                      NumCells,
-                                      sizeof(CHAR_INFO)))
-        {
-            return STATUS_INVALID_PARAMETER;
-        }
-
-        CharInfo = WriteOutputRequest->CharInfo;
-    }
-
-    Status = ConSrvGetTextModeBuffer(ConsoleGetPerProcessData(CsrGetClientThread()->Process),
+    Status = ConSrvGetTextModeBuffer(ConsoleGetPerProcessData(Process),
                                      WriteOutputRequest->OutputHandle,
                                      &Buffer, GENERIC_WRITE, TRUE);
     if (!NT_SUCCESS(Status)) return Status;
 
+    /*
+     * Validate the message buffer if we do not use a process' heap buffer
+     * (CsrAllocateCaptureBuffer succeeded because we haven't allocated
+     * a too large (>= 64 kB, size of the CSR heap) data buffer).
+     */
+    if (!WriteOutputRequest->UseVirtualMemory)
+    {
+        /*
+         * For optimization purposes, Windows (and hence ReactOS, too, for
+         * compatibility reasons) uses a static buffer if no more than one
+         * cell is written. Otherwise a new buffer is used.
+         * The client-side expects that we know this behaviour.
+         */
+        if (NumCells <= 1)
+        {
+            /*
+             * Adjust the internal pointer, because its old value points to
+             * the static buffer in the original ApiMessage structure.
+             */
+            // WriteOutputRequest->CharInfo = &WriteOutputRequest->StaticBuffer;
+            CharInfo = &WriteOutputRequest->StaticBuffer;
+        }
+        else
+        {
+            if (!CsrValidateMessageBuffer(ApiMessage,
+                                          (PVOID*)&WriteOutputRequest->CharInfo,
+                                          NumCells,
+                                          sizeof(CHAR_INFO)))
+            {
+                Status = STATUS_INVALID_PARAMETER;
+                goto Quit;
+            }
+
+            CharInfo = WriteOutputRequest->CharInfo;
+        }
+    }
+    else
+    {
+        /*
+         * This was not the case: we use a heap buffer. Retrieve its contents.
+         */
+        ULONG Size = NumCells * sizeof(CHAR_INFO);
+
+        CharInfo = ConsoleAllocHeap(HEAP_ZERO_MEMORY, Size);
+        if (CharInfo == NULL)
+        {
+            Status = STATUS_NO_MEMORY;
+            goto Quit;
+        }
+
+        Status = NtReadVirtualMemory(Process->ProcessHandle,
+                                     WriteOutputRequest->CharInfo,
+                                     CharInfo,
+                                     Size,
+                                     NULL);
+        if (!NT_SUCCESS(Status))
+        {
+            ConsoleFreeHeap(CharInfo);
+            // Status = STATUS_NO_MEMORY;
+            goto Quit;
+        }
+    }
+
     Status = ConDrvWriteConsoleOutput(Buffer->Header.Console,
                                       Buffer,
                                       WriteOutputRequest->Unicode,
                                       CharInfo,
                                       &WriteOutputRequest->WriteRegion);
 
+    /* Free the temporary buffer if we used the process' heap buffer */
+    if (WriteOutputRequest->UseVirtualMemory && CharInfo)
+        ConsoleFreeHeap(CharInfo);
+
+Quit:
     ConSrvReleaseScreenBuffer(Buffer, TRUE);
     return Status;
 }
diff --git a/win32ss/user/winsrv/consrv/frontends/gui/conwnd.c b/win32ss/user/winsrv/consrv/frontends/gui/conwnd.c
index fc229215fe4..2a7ff36cc40 100644
--- a/win32ss/user/winsrv/consrv/frontends/gui/conwnd.c
+++ b/win32ss/user/winsrv/consrv/frontends/gui/conwnd.c
@@ -506,8 +506,8 @@ OnNcCreate(HWND hWnd, LPCREATESTRUCTW Create)
 
     GuiData->hWindow = hWnd;
 
-    GuiData->Font = CreateFontW(GuiData->GuiInfo.FontSize.X,
-                                0, // GuiData->GuiInfo.FontSize.Y,
+    GuiData->Font = CreateFontW(GuiData->GuiInfo.FontSize.Y,
+                                0, // GuiData->GuiInfo.FontSize.X,
                                 0,
                                 TA_BASELINE,
                                 GuiData->GuiInfo.FontWeight,
diff --git a/win32ss/user/winsrv/consrv/frontends/gui/guisettings.c b/win32ss/user/winsrv/consrv/frontends/gui/guisettings.c
index 3220152419a..a3969fe3a23 100644
--- a/win32ss/user/winsrv/consrv/frontends/gui/guisettings.c
+++ b/win32ss/user/winsrv/consrv/frontends/gui/guisettings.c
@@ -98,8 +98,8 @@ GuiConsoleReadUserSettings(IN OUT PGUI_CONSOLE_INFO TermInfo,
         }
         else if (!wcscmp(szValueName, L"FontSize"))
         {
-            TermInfo->FontSize.X = LOWORD(Value);
-            TermInfo->FontSize.Y = HIWORD(Value);
+            TermInfo->FontSize.X = LOWORD(Value); // Width
+            TermInfo->FontSize.Y = HIWORD(Value); // Height
             RetVal = TRUE;
         }
         else if (!wcscmp(szValueName, L"FontWeight"))
@@ -161,7 +161,7 @@ do {
     SetConsoleSetting(L"FaceName", REG_SZ, (wcslen(TermInfo->FaceName) + 1) * sizeof(WCHAR), TermInfo->FaceName, L'\0'); // wcsnlen
     SetConsoleSetting(L"FontFamily", REG_DWORD, sizeof(DWORD), &TermInfo->FontFamily, FF_DONTCARE);
 
-    Storage = MAKELONG(TermInfo->FontSize.X, TermInfo->FontSize.Y);
+    Storage = MAKELONG(TermInfo->FontSize.X, TermInfo->FontSize.Y); // Width, Height
     SetConsoleSetting(L"FontSize", REG_DWORD, sizeof(DWORD), &Storage, 0);
 
     SetConsoleSetting(L"FontWeight", REG_DWORD, sizeof(DWORD), &TermInfo->FontWeight, FW_DONTCARE);
@@ -197,7 +197,7 @@ GuiConsoleGetDefaultSettings(IN OUT PGUI_CONSOLE_INFO TermInfo,
      * 1. Load the default values
      */
     // wcsncpy(TermInfo->FaceName, L"DejaVu Sans Mono", LF_FACESIZE);
-    // TermInfo->FontSize = MAKELONG(12, 8); // 0x0008000C; // font is 8x12
+    // TermInfo->FontSize = MAKELONG(8, 12); // 0x000C0008; // font is 8x12
     // TermInfo->FontSize = MAKELONG(16, 16); // font is 16x16
     // TermInfo->FontWeight = FW_NORMAL;
 
@@ -207,7 +207,6 @@ GuiConsoleGetDefaultSettings(IN OUT PGUI_CONSOLE_INFO TermInfo,
     TermInfo->FontSize.X = 0;
     TermInfo->FontSize.Y = 0;
     TermInfo->FontWeight = FW_DONTCARE;
-    TermInfo->UseRasterFonts = TRUE;
 
     TermInfo->FullScreen   = FALSE;
     TermInfo->ShowWindow   = SW_SHOWNORMAL;
@@ -333,7 +332,6 @@ GuiConsoleShowConsoleProperties(PGUI_CONSOLE_DATA GuiData,
         GuiInfo->FontFamily = GuiData->GuiInfo.FontFamily;
         GuiInfo->FontSize   = GuiData->GuiInfo.FontSize;
         GuiInfo->FontWeight = GuiData->GuiInfo.FontWeight;
-        GuiInfo->UseRasterFonts = GuiData->GuiInfo.UseRasterFonts;
         GuiInfo->FullScreen = GuiData->GuiInfo.FullScreen;
         GuiInfo->AutoPosition = GuiData->GuiInfo.AutoPosition;
         GuiInfo->WindowOrigin = GuiData->GuiInfo.WindowOrigin;
@@ -420,6 +418,92 @@ Quit:
     return;
 }
 
+
+
+
+BOOL
+ChangeFont(PGUI_CONSOLE_DATA GuiData,
+           LPWSTR FaceName, // Points to a WCHAR array of LF_FACESIZE elements.
+           ULONG  FontFamily,
+           COORD  FontSize,
+           ULONG  FontWeight)
+{
+    HDC hDC;
+    HFONT OldFont, NewFont;
+    TEXTMETRICW Metrics;
+    SIZE CharSize;
+    SIZE_T Length;
+
+    NewFont = CreateFontW(FontSize.Y,
+                          0, // FontSize.X,
+                          0,
+                          TA_BASELINE,
+                          FontWeight,
+                          FALSE,
+                          FALSE,
+                          FALSE,
+                          OEM_CHARSET,
+                          OUT_DEFAULT_PRECIS,
+                          CLIP_DEFAULT_PRECIS,
+                          NONANTIALIASED_QUALITY,
+                          FIXED_PITCH | FontFamily /* FF_DONTCARE */,
+                          FaceName);
+    if (NewFont == NULL)
+    {
+        DPRINT1("ChangeFont: CreateFont failed\n");
+        return FALSE;
+    }
+
+    hDC = GetDC(GuiData->hWindow);
+    if (hDC == NULL)
+    {
+        DPRINT1("ChangeFont: GetDC failed\n");
+        DeleteObject(NewFont);
+        return FALSE;
+    }
+
+    OldFont = SelectObject(hDC, NewFont);
+    if (OldFont == NULL)
+    {
+        DPRINT1("ChangeFont: SelectObject failed\n");
+        ReleaseDC(GuiData->hWindow, hDC);
+        DeleteObject(NewFont);
+        return FALSE;
+    }
+
+    if (!GetTextMetricsW(hDC, &Metrics))
+    {
+        DPRINT1("ChangeFont: GetTextMetrics failed\n");
+        SelectObject(hDC, OldFont);
+        ReleaseDC(GuiData->hWindow, hDC);
+        DeleteObject(NewFont);
+        return FALSE;
+    }
+    GuiData->CharWidth  = Metrics.tmMaxCharWidth;
+    GuiData->CharHeight = Metrics.tmHeight + Metrics.tmExternalLeading;
+
+    /* Measure real char width more precisely if possible. */
+    if (GetTextExtentPoint32W(hDC, L"R", 1, &CharSize))
+        GuiData->CharWidth = CharSize.cx;
+
+    SelectObject(hDC, OldFont);
+    ReleaseDC(GuiData->hWindow, hDC);
+
+    if (GuiData->Font != NULL) DeleteObject(GuiData->Font);
+    GuiData->Font = NewFont;
+
+    Length = min(wcslen(FaceName) + 1, LF_FACESIZE); // wcsnlen
+    wcsncpy(GuiData->GuiInfo.FaceName, FaceName, LF_FACESIZE);
+    GuiData->GuiInfo.FaceName[Length] = L'\0'; // NULL-terminate
+    GuiData->GuiInfo.FontFamily     = FontFamily;
+    GuiData->GuiInfo.FontSize       = FontSize;
+    GuiData->GuiInfo.FontWeight     = FontWeight;
+
+    return TRUE;
+}
+
+
+
 VOID
 GuiApplyUserSettings(PGUI_CONSOLE_DATA GuiData,
                      HANDLE hClientSection,
@@ -501,6 +585,15 @@ GuiApplyUserSettings(PGUI_CONSOLE_DATA GuiData,
 
             // memcpy(&GuiData->GuiInfo, GuiInfo, sizeof(GUI_CONSOLE_INFO));
 
+            /* Change the font */
+            ChangeFont(GuiData,
+                       GuiInfo->FaceName,
+                       GuiInfo->FontFamily,
+                       GuiInfo->FontSize,
+                       GuiInfo->FontWeight);
+           // HACK, needed because changing font may change the size of the window
+           /**/TermResizeTerminal(Console);/**/
+
             /* Move the window to the user's values */
             GuiData->GuiInfo.AutoPosition = GuiInfo->AutoPosition;
             GuiData->GuiInfo.WindowOrigin = GuiInfo->WindowOrigin;
@@ -655,7 +748,6 @@ GuiApplyWindowsConsoleSettings(PGUI_CONSOLE_DATA GuiData,
         GuiInfo.FullScreen = !!pConInfo->FullScreen;
         GuiInfo.AutoPosition = !!pConInfo->AutoPosition;
         GuiInfo.WindowOrigin = pConInfo->WindowPosition;
-        // BOOL  GuiInfo.UseRasterFonts = pConInfo->
         // WORD  GuiInfo.ShowWindow = pConInfo->
 
 
@@ -675,6 +767,15 @@ GuiApplyWindowsConsoleSettings(PGUI_CONSOLE_DATA GuiData,
 
             // memcpy(&GuiData->GuiInfo, &GuiInfo, sizeof(GUI_CONSOLE_INFO));
 
+            /* Change the font */
+            ChangeFont(GuiData,
+                       GuiInfo.FaceName,
+                       GuiInfo.FontFamily,
+                       GuiInfo.FontSize,
+                       GuiInfo.FontWeight);
+           // HACK, needed because changing font may change the size of the window
+           /**/TermResizeTerminal(Console);/**/
+
             /* Move the window to the user's values */
             GuiData->GuiInfo.AutoPosition = GuiInfo.AutoPosition;
             GuiData->GuiInfo.WindowOrigin = GuiInfo.WindowOrigin;
diff --git a/win32ss/user/winsrv/consrv/frontends/gui/guisettings.h b/win32ss/user/winsrv/consrv/frontends/gui/guisettings.h
index ff8a91265d8..df95bdc28c2 100644
--- a/win32ss/user/winsrv/consrv/frontends/gui/guisettings.h
+++ b/win32ss/user/winsrv/consrv/frontends/gui/guisettings.h
@@ -34,7 +34,6 @@ typedef struct _GUI_CONSOLE_INFO
     ULONG FontFamily;
     COORD FontSize;
     ULONG FontWeight;
-    BOOL  UseRasterFonts;
 
     BOOL  FullScreen;       /* Whether the console is displayed in full-screen or windowed mode */
 //  ULONG HardwareState;    /* _GDI_MANAGED, _DIRECT */
diff --git a/win32ss/user/winsrv/consrv/frontends/gui/guiterm.c b/win32ss/user/winsrv/consrv/frontends/gui/guiterm.c
index 6fb343a324d..8b6bc26bd67 100644
--- a/win32ss/user/winsrv/consrv/frontends/gui/guiterm.c
+++ b/win32ss/user/winsrv/consrv/frontends/gui/guiterm.c
@@ -486,13 +486,15 @@ GuiInitFrontEnd(IN OUT PFRONTEND This,
      * Set up GUI data
      */
 
+    // Font data
     Length = min(wcslen(TermInfo.FaceName) + 1, LF_FACESIZE); // wcsnlen
     wcsncpy(GuiData->GuiInfo.FaceName, TermInfo.FaceName, LF_FACESIZE);
     GuiData->GuiInfo.FaceName[Length] = L'\0';
     GuiData->GuiInfo.FontFamily     = TermInfo.FontFamily;
     GuiData->GuiInfo.FontSize       = TermInfo.FontSize;
     GuiData->GuiInfo.FontWeight     = TermInfo.FontWeight;
-    GuiData->GuiInfo.UseRasterFonts = TermInfo.UseRasterFonts;
+
+    // Display
     GuiData->GuiInfo.FullScreen     = TermInfo.FullScreen;
     GuiData->GuiInfo.ShowWindow     = TermInfo.ShowWindow;
     GuiData->GuiInfo.AutoPosition   = TermInfo.AutoPosition;
diff --git a/win32ss/user/winsrv/consrv/frontends/gui/text.c b/win32ss/user/winsrv/consrv/frontends/gui/text.c
index 078cb40fe03..50ebbb6d899 100644
--- a/win32ss/user/winsrv/consrv/frontends/gui/text.c
+++ b/win32ss/user/winsrv/consrv/frontends/gui/text.c
@@ -24,7 +24,8 @@
 
 /* FUNCTIONS ******************************************************************/
 
-COLORREF PaletteRGBFromAttrib(PCONSOLE Console, WORD Attribute)
+static COLORREF
+PaletteRGBFromAttrib(PCONSOLE Console, WORD Attribute)
 {
     HPALETTE hPalette = Console->ActiveBuffer->PaletteHandle;
     PALETTEENTRY pe;
@@ -35,6 +36,44 @@ COLORREF PaletteRGBFromAttrib(PCONSOLE Console, WORD Attribute)
     return PALETTERGB(pe.peRed, pe.peGreen, pe.peBlue);
 }
 
+static HFONT
+ChangeFontAttributes(PGUI_CONSOLE_DATA GuiData,
+                     // COORD   FontSize,
+                     ULONG   FontWeight,
+                     BOOLEAN bItalic,
+                     BOOLEAN bUnderline,
+                     BOOLEAN bStrikeOut)
+{
+    HFONT NewFont;
+    LOGFONT lf;
+
+    /* Initialize the LOGFONT structure */
+    RtlZeroMemory(&lf, sizeof(lf));
+
+    /* Retrieve the details of the current font */
+    if (GetObject(GuiData->Font, sizeof(lf), &lf) == 0)
+        return NULL; // GuiData->Font;
+
+    /* Change the font attributes */
+    // lf.lfHeight = FontSize.Y;
+    // lf.lfWidth  = FontSize.X;
+    lf.lfWeight = FontWeight;
+    lf.lfItalic = bItalic;
+    lf.lfUnderline = bUnderline;
+    lf.lfStrikeOut = bStrikeOut;
+
+    /* Build a new font */
+    NewFont = CreateFontIndirect(&lf);
+    if (NewFont == NULL)
+        return NULL; // GuiData->Font;
+
+    // FIXME: Do we need to update GuiData->CharWidth and GuiData->CharHeight ??
+
+    /* Select it (return the old font) */
+    // return SelectObject(GuiData->hMemDC, NewFont);
+    return NewFont;
+}
+
 static VOID
 CopyBlock(PTEXTMODE_SCREEN_BUFFER Buffer,
           PSMALL_RECT Selection)
@@ -348,7 +387,8 @@ GuiPaintTextModeBuffer(PTEXTMODE_SCREEN_BUFFER Buffer,
     WORD LastAttribute, Attribute;
     ULONG CursorX, CursorY, CursorHeight;
     HBRUSH CursorBrush, OldBrush;
-    HFONT OldFont;
+    HFONT OldFont, NewFont;
+    BOOLEAN IsUnderscore;
 
     if (Buffer->Buffer == NULL) return;
 
@@ -372,7 +412,18 @@ GuiPaintTextModeBuffer(PTEXTMODE_SCREEN_BUFFER Buffer,
     SetTextColor(GuiData->hMemDC, PaletteRGBFromAttrib(Console, TextAttribFromAttrib(LastAttribute)));
     SetBkColor(GuiData->hMemDC, PaletteRGBFromAttrib(Console, BkgdAttribFromAttrib(LastAttribute)));
 
-    OldFont = SelectObject(GuiData->hMemDC, GuiData->Font);
+    // OldFont = ChangeFontAttributes(GuiData, /* {0}, */ GuiData->GuiInfo.FontWeight, FALSE, FALSE, FALSE);
+    IsUnderscore = !!(LastAttribute & COMMON_LVB_UNDERSCORE);
+    NewFont = ChangeFontAttributes(GuiData, /* {0}, */ GuiData->GuiInfo.FontWeight,
+                                   FALSE,
+                                   IsUnderscore,
+                                   FALSE);
+    if (NewFont == NULL)
+    {
+        DPRINT1("ChangeFontAttributes failed, use the original font\n");
+        NewFont = GuiData->Font;
+    }
+    OldFont = SelectObject(GuiData->hMemDC, NewFont);
 
     for (Line = TopLine; Line <= BottomLine; Line++)
     {
@@ -399,9 +450,31 @@ GuiPaintTextModeBuffer(PTEXTMODE_SCREEN_BUFFER Buffer,
                 Attribute = From->Attributes;
                 if (Attribute != LastAttribute)
                 {
-                    SetTextColor(GuiData->hMemDC, PaletteRGBFromAttrib(Console, TextAttribFromAttrib(Attribute)));
-                    SetBkColor(GuiData->hMemDC, PaletteRGBFromAttrib(Console, BkgdAttribFromAttrib(Attribute)));
                     LastAttribute = Attribute;
+                    SetTextColor(GuiData->hMemDC, PaletteRGBFromAttrib(Console, TextAttribFromAttrib(LastAttribute)));
+                    SetBkColor(GuiData->hMemDC, PaletteRGBFromAttrib(Console, BkgdAttribFromAttrib(LastAttribute)));
+
+                    /* Change underscore state if needed */
+                    if (!!(LastAttribute & COMMON_LVB_UNDERSCORE) != IsUnderscore)
+                    {
+                        IsUnderscore = !!(LastAttribute & COMMON_LVB_UNDERSCORE);
+
+                        /* Delete the font we used up to now */
+                        // SelectObject(GuiData->hMemDC, OldFont);
+                        if (NewFont != GuiData->Font) DeleteObject(NewFont);
+                        /* Recreate it */
+                        NewFont = ChangeFontAttributes(GuiData, /* {0}, */ GuiData->GuiInfo.FontWeight,
+                                                       FALSE,
+                                                       IsUnderscore,
+                                                       FALSE);
+                        if (NewFont == NULL)
+                        {
+                            DPRINT1("ChangeFontAttributes failed, use the original font\n");
+                            NewFont = GuiData->Font;
+                        }
+                        /* Select it */
+                        /* OldFont = */ SelectObject(GuiData->hMemDC, NewFont);
+                    }
                 }
             }
 
@@ -441,12 +514,15 @@ GuiPaintTextModeBuffer(PTEXTMODE_SCREEN_BUFFER Buffer,
                    GuiData->CharWidth,
                    CursorHeight,
                    PATCOPY);
+
             SelectObject(GuiData->hMemDC, OldBrush);
             DeleteObject(CursorBrush);
         }
     }
 
+    /* Restore the old font and delete the font we used up to now */
     SelectObject(GuiData->hMemDC, OldFont);
+    if (NewFont != GuiData->Font) DeleteObject(NewFont);
 
     LeaveCriticalSection(&Console->Lock);
 }
diff --git a/win32ss/user/winsrv/consrv/handle.c b/win32ss/user/winsrv/consrv/handle.c
index 721f3375558..a114411fc80 100644
--- a/win32ss/user/winsrv/consrv/handle.c
+++ b/win32ss/user/winsrv/consrv/handle.c
@@ -19,53 +19,45 @@
 
 /* GLOBALS ********************************************************************/
 
+/* Console handle */
 typedef struct _CONSOLE_IO_HANDLE
 {
     PCONSOLE_IO_OBJECT Object;   /* The object on which the handle points to */
-    DWORD Access;
-    BOOL Inheritable;
-    DWORD ShareMode;
+    ULONG   Access;
+    ULONG   ShareMode;
+    BOOLEAN Inheritable;
 } CONSOLE_IO_HANDLE, *PCONSOLE_IO_HANDLE;
 
 
 /* PRIVATE FUNCTIONS **********************************************************/
 
-static INT
-AdjustHandleCounts(PCONSOLE_IO_HANDLE Entry, INT Change)
+static LONG
+AdjustHandleCounts(IN PCONSOLE_IO_HANDLE Handle,
+                   IN LONG Change)
 {
-    PCONSOLE_IO_OBJECT Object = Entry->Object;
+    PCONSOLE_IO_OBJECT Object = Handle->Object;
 
-    DPRINT("AdjustHandleCounts(0x%p, %d), Object = 0x%p\n", Entry, Change, Object);
-    DPRINT("\tAdjustHandleCounts(0x%p, %d), Object = 0x%p, Object->HandleCount = %d, Object->Type = %lu\n", Entry, Change, Object, Object->HandleCount, Object->Type);
+    DPRINT("AdjustHandleCounts(0x%p, %d), Object = 0x%p\n",
+           Handle, Change, Object);
+    DPRINT("\tAdjustHandleCounts(0x%p, %d), Object = 0x%p, Object->ReferenceCount = %d, Object->Type = %lu\n",
+           Handle, Change, Object, Object->ReferenceCount, Object->Type);
 
-    if (Entry->Access & GENERIC_READ)           Object->AccessRead += Change;
-    if (Entry->Access & GENERIC_WRITE)          Object->AccessWrite += Change;
-    if (!(Entry->ShareMode & FILE_SHARE_READ))  Object->ExclusiveRead += Change;
-    if (!(Entry->ShareMode & FILE_SHARE_WRITE)) Object->ExclusiveWrite += Change;
+    if (Handle->Access & GENERIC_READ)           Object->AccessRead += Change;
+    if (Handle->Access & GENERIC_WRITE)          Object->AccessWrite += Change;
+    if (!(Handle->ShareMode & FILE_SHARE_READ))  Object->ExclusiveRead += Change;
+    if (!(Handle->ShareMode & FILE_SHARE_WRITE)) Object->ExclusiveWrite += Change;
 
-    Object->HandleCount += Change;
+    Object->ReferenceCount += Change;
 
-    return Object->HandleCount;
+    return Object->ReferenceCount;
 }
 
 static VOID
-ConSrvCreateHandleEntry(PCONSOLE_IO_HANDLE Entry)
+ConSrvCloseHandle(IN PCONSOLE_IO_HANDLE Handle)
 {
-    /// LOCK /// PCONSOLE_IO_OBJECT Object = Entry->Object;
-    /// LOCK /// EnterCriticalSection(&Object->Console->Lock);
-    AdjustHandleCounts(Entry, +1);
-    /// LOCK /// LeaveCriticalSection(&Object->Console->Lock);
-}
-
-static VOID
-ConSrvCloseHandleEntry(PCONSOLE_IO_HANDLE Entry)
-{
-    PCONSOLE_IO_OBJECT Object = Entry->Object;
+    PCONSOLE_IO_OBJECT Object = Handle->Object;
     if (Object != NULL)
     {
-        /// LOCK /// PCONSOLE Console = Object->Console;
-        /// LOCK /// EnterCriticalSection(&Console->Lock);
-
         /*
          * If this is a input handle, notify and dereference
          * all the waits related to this handle.
@@ -87,7 +79,7 @@ ConSrvCloseHandleEntry(PCONSOLE_IO_HANDLE Entry)
             CsrNotifyWait(&Console->ReadWaitQueue,
                           TRUE,
                           NULL,
-                          (PVOID)Entry);
+                          (PVOID)Handle);
             if (!IsListEmpty(&Console->ReadWaitQueue))
             {
                 CsrDereferenceWait(&Console->ReadWaitQueue);
@@ -95,7 +87,7 @@ ConSrvCloseHandleEntry(PCONSOLE_IO_HANDLE Entry)
         }
 
         /* If the last handle to a screen buffer is closed, delete it... */
-        if (AdjustHandleCounts(Entry, -1) == 0)
+        if (AdjustHandleCounts(Handle, -1) == 0)
         {
             if (Object->Type == TEXTMODE_BUFFER || Object->Type == GRAPHICS_BUFFER)
             {
@@ -116,16 +108,18 @@ ConSrvCloseHandleEntry(PCONSOLE_IO_HANDLE Entry)
             }
         }
 
-        /// LOCK /// LeaveCriticalSection(&Console->Lock);
-
         /* Invalidate (zero-out) this handle entry */
-        // Entry->Object = NULL;
-        // RtlZeroMemory(Entry, sizeof(*Entry));
+        // Handle->Object = NULL;
+        // RtlZeroMemory(Handle, sizeof(*Handle));
     }
-    RtlZeroMemory(Entry, sizeof(*Entry)); // Be sure the whole entry is invalidated.
+    RtlZeroMemory(Handle, sizeof(*Handle)); // Be sure the whole entry is invalidated.
 }
 
 
+
+
+
+
 /* Forward declaration, used in ConSrvInitHandlesTable */
 static VOID ConSrvFreeHandlesTable(PCONSOLE_PROCESS_DATA ProcessData);
 
@@ -244,10 +238,10 @@ ConSrvInheritHandlesTable(IN PCONSOLE_PROCESS_DATA SourceProcessData,
         {
             /*
              * Copy the handle data and increment the reference count of the
-             * pointed object (via the call to ConSrvCreateHandleEntry).
+             * pointed object (via the call to ConSrvCreateHandleEntry == AdjustHandleCounts).
              */
             TargetProcessData->HandleTable[j] = SourceProcessData->HandleTable[i];
-            ConSrvCreateHandleEntry(&TargetProcessData->HandleTable[j]);
+            AdjustHandleCounts(&TargetProcessData->HandleTable[j], +1);
             ++j;
         }
     }
@@ -258,7 +252,7 @@ Quit:
 }
 
 static VOID
-ConSrvFreeHandlesTable(PCONSOLE_PROCESS_DATA ProcessData)
+ConSrvFreeHandlesTable(IN PCONSOLE_PROCESS_DATA ProcessData)
 {
     RtlEnterCriticalSection(&ProcessData->HandleTableLock);
 
@@ -277,7 +271,7 @@ ConSrvFreeHandlesTable(PCONSOLE_PROCESS_DATA ProcessData)
             /* Close all the console handles */
             for (i = 0; i < ProcessData->HandleTableSize; i++)
             {
-                ConSrvCloseHandleEntry(&ProcessData->HandleTable[i]);
+                ConSrvCloseHandle(&ProcessData->HandleTable[i]);
             }
         }
         /* Free the handles table memory */
@@ -290,6 +284,12 @@ ConSrvFreeHandlesTable(PCONSOLE_PROCESS_DATA ProcessData)
     RtlLeaveCriticalSection(&ProcessData->HandleTableLock);
 }
 
+
+
+
+
+
+// ConSrvCreateObject
 VOID
 ConSrvInitObject(IN OUT PCONSOLE_IO_OBJECT Object,
                  IN CONSOLE_IO_OBJECT_TYPE Type,
@@ -300,18 +300,19 @@ ConSrvInitObject(IN OUT PCONSOLE_IO_OBJECT Object,
 
     Object->Type    = Type;
     Object->Console = Console;
+    Object->ReferenceCount = 0;
+
     Object->AccessRead    = Object->AccessWrite    = 0;
     Object->ExclusiveRead = Object->ExclusiveWrite = 0;
-    Object->HandleCount   = 0;
 }
 
 NTSTATUS
-ConSrvInsertObject(PCONSOLE_PROCESS_DATA ProcessData,
-                   PHANDLE Handle,
-                   PCONSOLE_IO_OBJECT Object,
-                   DWORD Access,
-                   BOOL Inheritable,
-                   DWORD ShareMode)
+ConSrvInsertObject(IN PCONSOLE_PROCESS_DATA ProcessData,
+                   OUT PHANDLE Handle,
+                   IN PCONSOLE_IO_OBJECT Object,
+                   IN ULONG Access,
+                   IN BOOLEAN Inheritable,
+                   IN ULONG ShareMode)
 {
 #define IO_HANDLES_INCREMENT    2 * 3
 
@@ -362,7 +363,7 @@ ConSrvInsertObject(PCONSOLE_PROCESS_DATA ProcessData,
     ProcessData->HandleTable[i].Access      = Access;
     ProcessData->HandleTable[i].Inheritable = Inheritable;
     ProcessData->HandleTable[i].ShareMode   = ShareMode;
-    ConSrvCreateHandleEntry(&ProcessData->HandleTable[i]);
+    AdjustHandleCounts(&ProcessData->HandleTable[i], +1);
     *Handle = ULongToHandle((i << 2) | 0x3);
 
     // RtlLeaveCriticalSection(&ProcessData->HandleTableLock);
@@ -371,8 +372,8 @@ ConSrvInsertObject(PCONSOLE_PROCESS_DATA ProcessData,
 }
 
 NTSTATUS
-ConSrvRemoveObject(PCONSOLE_PROCESS_DATA ProcessData,
-                   HANDLE Handle)
+ConSrvRemoveObject(IN PCONSOLE_PROCESS_DATA ProcessData,
+                   IN HANDLE Handle)
 {
     ULONG Index = HandleToULong(Handle) >> 2;
 
@@ -390,20 +391,20 @@ ConSrvRemoveObject(PCONSOLE_PROCESS_DATA ProcessData,
     }
 
     ASSERT(ProcessData->ConsoleHandle);
-    ConSrvCloseHandleEntry(&ProcessData->HandleTable[Index]);
+    ConSrvCloseHandle(&ProcessData->HandleTable[Index]);
 
     RtlLeaveCriticalSection(&ProcessData->HandleTableLock);
     return STATUS_SUCCESS;
 }
 
 NTSTATUS
-ConSrvGetObject(PCONSOLE_PROCESS_DATA ProcessData,
-                HANDLE Handle,
-                PCONSOLE_IO_OBJECT* Object,
-                PVOID* Entry OPTIONAL,
-                DWORD Access,
-                BOOL LockConsole,
-                CONSOLE_IO_OBJECT_TYPE Type)
+ConSrvGetObject(IN PCONSOLE_PROCESS_DATA ProcessData,
+                IN HANDLE Handle,
+                OUT PCONSOLE_IO_OBJECT* Object,
+                OUT PVOID* Entry OPTIONAL,
+                IN ULONG Access,
+                IN BOOLEAN LockConsole,
+                IN CONSOLE_IO_OBJECT_TYPE Type)
 {
     // NTSTATUS Status;
     ULONG Index = HandleToULong(Handle) >> 2;
@@ -461,12 +462,17 @@ ConSrvGetObject(PCONSOLE_PROCESS_DATA ProcessData,
 }
 
 VOID
-ConSrvReleaseObject(PCONSOLE_IO_OBJECT Object,
-                    BOOL IsConsoleLocked)
+ConSrvReleaseObject(IN PCONSOLE_IO_OBJECT Object,
+                    IN BOOLEAN IsConsoleLocked)
 {
     ConSrvReleaseConsole(Object->Console, IsConsoleLocked);
 }
 
+
+
+
+
+
 NTSTATUS
 ConSrvAllocateConsole(PCONSOLE_PROCESS_DATA ProcessData,
                       PHANDLE pInputHandle,
@@ -548,7 +554,7 @@ ConSrvAllocateConsole(PCONSOLE_PROCESS_DATA ProcessData,
 NTSTATUS
 ConSrvInheritConsole(PCONSOLE_PROCESS_DATA ProcessData,
                      HANDLE ConsoleHandle,
-                     BOOL CreateNewHandlesTable,
+                     BOOLEAN CreateNewHandlesTable,
                      PHANDLE pInputHandle,
                      PHANDLE pOutputHandle,
                      PHANDLE pErrorHandle)
@@ -826,7 +832,7 @@ CSR_API(SrvDuplicateHandle)
         (DuplicateHandleRequest->Options & DUPLICATE_CLOSE_SOURCE))
     {
         /* Close the original handle if needed */
-        ConSrvCloseHandleEntry(Entry);
+        ConSrvCloseHandle(Entry);
     }
 
 Quit:
diff --git a/win32ss/user/winsrv/consrv/handle.h b/win32ss/user/winsrv/consrv/handle.h
index 2e75f884a4b..d154c5cc17c 100644
--- a/win32ss/user/winsrv/consrv/handle.h
+++ b/win32ss/user/winsrv/consrv/handle.h
@@ -10,23 +10,28 @@
 
 #pragma once
 
-VOID ConSrvInitObject(IN OUT PCONSOLE_IO_OBJECT Object,
-                               IN CONSOLE_IO_OBJECT_TYPE Type,
-                               IN PCONSOLE Console);
-NTSTATUS ConSrvInsertObject(PCONSOLE_PROCESS_DATA ProcessData,
-                                     PHANDLE Handle,
-                                     PCONSOLE_IO_OBJECT Object,
-                                     DWORD Access,
-                                     BOOL Inheritable,
-                                     DWORD ShareMode);
-NTSTATUS ConSrvRemoveObject(PCONSOLE_PROCESS_DATA ProcessData,
-                                     HANDLE Handle);
-NTSTATUS ConSrvGetObject(PCONSOLE_PROCESS_DATA ProcessData,
-                                  HANDLE Handle,
-                                  PCONSOLE_IO_OBJECT* Object,
-                                  PVOID* Entry OPTIONAL,
-                                  DWORD Access,
-                                  BOOL LockConsole,
-                                  CONSOLE_IO_OBJECT_TYPE Type);
-VOID ConSrvReleaseObject(PCONSOLE_IO_OBJECT Object,
-                                  BOOL IsConsoleLocked);
+VOID
+ConSrvInitObject(IN OUT PCONSOLE_IO_OBJECT Object,
+                 IN CONSOLE_IO_OBJECT_TYPE Type,
+                 IN PCONSOLE Console);
+NTSTATUS
+ConSrvInsertObject(IN PCONSOLE_PROCESS_DATA ProcessData,
+                   OUT PHANDLE Handle,
+                   IN PCONSOLE_IO_OBJECT Object,
+                   IN ULONG Access,
+                   IN BOOLEAN Inheritable,
+                   IN ULONG ShareMode);
+NTSTATUS
+ConSrvRemoveObject(IN PCONSOLE_PROCESS_DATA ProcessData,
+                   IN HANDLE Handle);
+NTSTATUS
+ConSrvGetObject(IN PCONSOLE_PROCESS_DATA ProcessData,
+                IN HANDLE Handle,
+                OUT PCONSOLE_IO_OBJECT* Object,
+                OUT PVOID* Entry OPTIONAL,
+                IN ULONG Access,
+                IN BOOLEAN LockConsole,
+                IN CONSOLE_IO_OBJECT_TYPE Type);
+VOID
+ConSrvReleaseObject(IN PCONSOLE_IO_OBJECT Object,
+                    IN BOOLEAN IsConsoleLocked);
diff --git a/win32ss/user/winsrv/consrv/include/conio.h b/win32ss/user/winsrv/consrv/include/conio.h
index 90defe0ea42..8d3dc9f6a4d 100644
--- a/win32ss/user/winsrv/consrv/include/conio.h
+++ b/win32ss/user/winsrv/consrv/include/conio.h
@@ -19,23 +19,35 @@
 #define DEFAULT_POPUP_ATTRIB    (FOREGROUND_BLUE | FOREGROUND_RED   | \
                                  BACKGROUND_BLUE | BACKGROUND_GREEN | BACKGROUND_RED | BACKGROUND_INTENSITY)
 
+/* VGA character cell */
+typedef struct _CHAR_CELL
+{
+    CHAR Char;
+    BYTE Attributes;
+} CHAR_CELL, *PCHAR_CELL;
+C_ASSERT(sizeof(CHAR_CELL) == 2);
+
+
 /* Object type magic numbers */
 typedef enum _CONSOLE_IO_OBJECT_TYPE
 {
-//  ANY_TYPE_BUFFER = 0x00, // --> Match any types of IO handles
-    TEXTMODE_BUFFER = 0x01, // --> Output-type handles for text SBs
-    GRAPHICS_BUFFER = 0x02, // --> Output-type handles for graphics SBs
+    UNKNOWN         = 0x00, // --> Unknown object
+    TEXTMODE_BUFFER = 0x01, // --> Output-type object for text SBs
+    GRAPHICS_BUFFER = 0x02, // --> Output-type object for graphics SBs
     SCREEN_BUFFER   = 0x03, // --> Any SB type
-    INPUT_BUFFER    = 0x04  // --> Input-type handles
+    INPUT_BUFFER    = 0x04, // --> Input-type object
+    ANY_TYPE_BUFFER = 0x07, // --> Any IO object
 } CONSOLE_IO_OBJECT_TYPE;
 
 typedef struct _CONSOLE_IO_OBJECT
 {
     CONSOLE_IO_OBJECT_TYPE Type;
+
     struct _CONSOLE* /* PCONSOLE */ Console;
+    LONG ReferenceCount;    /* Is incremented each time a console object gets referenced */
+
     LONG AccessRead, AccessWrite;
     LONG ExclusiveRead, ExclusiveWrite;
-    LONG HandleCount;
 } CONSOLE_IO_OBJECT, *PCONSOLE_IO_OBJECT;
 
 
@@ -300,6 +312,17 @@ typedef struct _CONSOLE
     PCONSOLE_SCREEN_BUFFER ActiveBuffer;    /* Pointer to currently active screen buffer */
     UINT OutputCodePage;
 
+    /**** Per-console Virtual DOS Machine Text-mode Buffer ****/
+    COORD   VDMBufferSize;             /* Real size of the VDM buffer, in units of ??? */
+    HANDLE  VDMBufferSection;          /* Handle to the memory shared section for the VDM buffer */
+    PVOID   VDMBuffer;                 /* Our VDM buffer */
+    PVOID   ClientVDMBuffer;           /* A copy of the client view of our VDM buffer */
+    HANDLE  VDMClientProcess;          /* Handle to the client process who opened the buffer, to unmap the view */
+
+    HANDLE StartHardwareEvent;
+    HANDLE EndHardwareEvent;
+    HANDLE ErrorHardwareEvent;
+
 /****************************** Other properties ******************************/
     UNICODE_STRING OriginalTitle;           /* Original title of console, the one defined when the console leader is launched; it never changes. Always NULL-terminated */
     UNICODE_STRING Title;                   /* Title of console. Always NULL-terminated */
diff --git a/win32ss/user/winsrv/consrv/include/conio_winsrv.h b/win32ss/user/winsrv/consrv/include/conio_winsrv.h
index aba4715a2b8..4669dae0255 100644
--- a/win32ss/user/winsrv/consrv/include/conio_winsrv.h
+++ b/win32ss/user/winsrv/consrv/include/conio_winsrv.h
@@ -83,6 +83,7 @@ struct _FRONTEND
     PFRONTEND_VTBL Vtbl;        /* Virtual table */
     NTSTATUS (NTAPI *UnloadFrontEnd)(IN OUT PFRONTEND This);
 
+    // struct _WINSRV_CONSOLE*
     struct _CONSOLE* Console;   /* Console to which the frontend is attached to */
     PVOID Data;                 /* Private data  */
     PVOID OldData;              /* Reserved      */
diff --git a/win32ss/user/winsrv/consrv/include/settings.h b/win32ss/user/winsrv/consrv/include/settings.h
index be00e502073..fcef0f18b58 100644
--- a/win32ss/user/winsrv/consrv/include/settings.h
+++ b/win32ss/user/winsrv/consrv/include/settings.h
@@ -51,10 +51,14 @@ typedef struct _CONSOLE_INFO
     WCHAR ConsoleTitle[MAX_PATH + 1];
 } CONSOLE_INFO, *PCONSOLE_INFO;
 
+/*
+ * BYTE Foreground = LOBYTE(Attributes) & 0x0F;
+ * BYTE Background = (LOBYTE(Attributes) & 0xF0) >> 4;
+ */
 #define RGBFromAttrib(Console, Attribute)   ((Console)->Colors[(Attribute) & 0xF])
-#define TextAttribFromAttrib(Attribute)     ((Attribute) & 0xF)
-#define BkgdAttribFromAttrib(Attribute)     (((Attribute) >> 4) & 0xF)
-#define MakeAttrib(TextAttrib, BkgdAttrib)  (DWORD)((((BkgdAttrib) & 0xF) << 4) | ((TextAttrib) & 0xF))
+#define TextAttribFromAttrib(Attribute)     ( !((Attribute) & COMMON_LVB_REVERSE_VIDEO) ? (Attribute) & 0xF : ((Attribute) >> 4) & 0xF )
+#define BkgdAttribFromAttrib(Attribute)     ( !((Attribute) & COMMON_LVB_REVERSE_VIDEO) ? ((Attribute) >> 4) & 0xF : (Attribute) & 0xF )
+#define MakeAttrib(TextAttrib, BkgdAttrib)  (USHORT)((((BkgdAttrib) & 0xF) << 4) | ((TextAttrib) & 0xF))
 
 /*
  * Structure used to communicate with console.dll
diff --git a/win32ss/user/winsrv/consrv/procinit.h b/win32ss/user/winsrv/consrv/procinit.h
index 9c7186667dd..493415156eb 100644
--- a/win32ss/user/winsrv/consrv/procinit.h
+++ b/win32ss/user/winsrv/consrv/procinit.h
@@ -15,7 +15,7 @@ NTSTATUS ConSrvAllocateConsole(PCONSOLE_PROCESS_DATA ProcessData,
                                         PCONSOLE_START_INFO ConsoleStartInfo);
 NTSTATUS ConSrvInheritConsole(PCONSOLE_PROCESS_DATA ProcessData,
                                        HANDLE ConsoleHandle,
-                                       BOOL CreateNewHandlesTable,
+                                       BOOLEAN CreateNewHandlesTable,
                                        PHANDLE pInputHandle,
                                        PHANDLE pOutputHandle,
                                        PHANDLE pErrorHandle);
diff --git a/win32ss/user/winsrv/consrv/subsysreg.c b/win32ss/user/winsrv/consrv/subsysreg.c
index 0ba10afce3a..40f974040c1 100644
--- a/win32ss/user/winsrv/consrv/subsysreg.c
+++ b/win32ss/user/winsrv/consrv/subsysreg.c
@@ -21,8 +21,132 @@
 
 CSR_API(SrvRegisterConsoleVDM)
 {
-    DPRINT1("%s not yet implemented\n", __FUNCTION__);
-    return STATUS_NOT_IMPLEMENTED;
+    NTSTATUS Status;
+    PCONSOLE_REGISTERVDM RegisterVDMRequest = &((PCONSOLE_API_MESSAGE)ApiMessage)->Data.RegisterVDMRequest;
+    PCONSOLE Console;
+
+    DPRINT1("SrvRegisterConsoleVDM(%d)\n", RegisterVDMRequest->RegisterFlags);
+
+    Status = ConSrvGetConsole(ConsoleGetPerProcessData(CsrGetClientThread()->Process),
+                              &Console, TRUE);
+    if (!NT_SUCCESS(Status))
+    {
+        DPRINT1("Can't get console\n");
+        return Status;
+    }
+
+    if (RegisterVDMRequest->RegisterFlags != 0)
+    {
+        LARGE_INTEGER SectionSize;
+        ULONG Size, ViewSize = 0;
+        HANDLE ProcessHandle;
+
+        /*
+         * Remember the handle to the process so that we can close or unmap
+         * correctly the allocated resources when the client releases the
+         * screen buffer.
+         */
+        ProcessHandle = CsrGetClientThread()->Process->ProcessHandle;
+        Console->VDMClientProcess = ProcessHandle;
+
+        Console->VDMBufferSize = RegisterVDMRequest->VDMBufferSize;
+
+        Size = Console->VDMBufferSize.X * Console->VDMBufferSize.Y
+                                        * sizeof(CHAR_CELL);
+
+        /*
+         * Create a memory section for the VDM buffer, to share with the client.
+         */
+        SectionSize.QuadPart = Size;
+        Status = NtCreateSection(&Console->VDMBufferSection,
+                                 SECTION_ALL_ACCESS,
+                                 NULL,
+                                 &SectionSize,
+                                 PAGE_READWRITE,
+                                 SEC_COMMIT,
+                                 NULL);
+        if (!NT_SUCCESS(Status))
+        {
+            DPRINT1("Error: Impossible to create a shared section ; Status = %lu\n", Status);
+            goto Quit;
+        }
+
+        /*
+         * Create a view for our needs.
+         */
+        ViewSize = 0;
+        Console->VDMBuffer = NULL;
+        Status = NtMapViewOfSection(Console->VDMBufferSection,
+                                    NtCurrentProcess(),
+                                    (PVOID*)&Console->VDMBuffer,
+                                    0,
+                                    0,
+                                    NULL,
+                                    &ViewSize,
+                                    ViewUnmap,
+                                    0,
+                                    PAGE_READWRITE);
+        if (!NT_SUCCESS(Status))
+        {
+            DPRINT1("Error: Impossible to map the shared section ; Status = %lu\n", Status);
+            NtClose(Console->VDMBufferSection);
+            goto Quit;
+        }
+
+        /*
+         * Create a view for the client. We must keep a trace of it so that
+         * we can unmap it when the client releases the VDM buffer.
+         */
+        ViewSize = 0;
+        Console->ClientVDMBuffer = NULL;
+        Status = NtMapViewOfSection(Console->VDMBufferSection,
+                                    ProcessHandle,
+                                    (PVOID*)&Console->ClientVDMBuffer,
+                                    0,
+                                    0,
+                                    NULL,
+                                    &ViewSize,
+                                    ViewUnmap,
+                                    0,
+                                    PAGE_READWRITE);
+        if (!NT_SUCCESS(Status))
+        {
+            DPRINT1("Error: Impossible to map the shared section ; Status = %lu\n", Status);
+            NtUnmapViewOfSection(NtCurrentProcess(), Console->VDMBuffer);
+            NtClose(Console->VDMBufferSection);
+            goto Quit;
+        }
+
+        // TODO: Duplicate the event handles.
+
+        RegisterVDMRequest->VDMBuffer = Console->ClientVDMBuffer;
+
+        Status = STATUS_SUCCESS;
+    }
+    else
+    {
+        /* RegisterFlags == 0 means we are unregistering the VDM */
+
+        // TODO: Close the duplicated handles.
+
+        if (Console->VDMBuffer)
+        {
+            /*
+             * Uninitialize the graphics screen buffer
+             * in the reverse way we initialized it.
+             */
+            NtUnmapViewOfSection(Console->VDMClientProcess, Console->ClientVDMBuffer);
+            NtUnmapViewOfSection(NtCurrentProcess(), Console->VDMBuffer);
+            NtClose(Console->VDMBufferSection);
+        }
+        Console->VDMBuffer = Console->ClientVDMBuffer = NULL;
+
+        Console->VDMBufferSize.X = Console->VDMBufferSize.Y = 0;
+    }
+
+Quit:
+    ConSrvReleaseConsole(Console, TRUE);
+    return Status;
 }
 
 CSR_API(SrvVDMConsoleOperation)