--- IO-AIO/AIO.xs	2010/05/09 20:42:55	1.165
+++ IO-AIO/AIO.xs	2010/08/04 14:02:58	1.168
@@ -306,13 +306,12 @@
 
 static int req_invoke (eio_req *req)
 {
-  dSP;
-
   if (req->flags & FLAG_SV2_RO_OFF)
     SvREADONLY_off (req->sv2);
 
   if (!EIO_CANCELLED (req) && req->callback)
     {
+      dSP;
       static SV *sv_result_cache; /* caches the result integer SV */
       SV *sv_result;
 
@@ -499,7 +498,7 @@
             }
             break;
 
-          case EIO_DUP2:
+          case EIO_DUP2: /* EIO_DUP2 actually means aio_close(), su fudge result value */
             if (req->result > 0)
               SvIV_set (sv_result, 0);
             /* FALLTHROUGH */
@@ -623,8 +622,11 @@
   mg->mg_obj = 0; /* just in case */
 
   SvREADONLY_off (sv);
+
+  if (SvPVX (sv) != mg->mg_ptr)
+    croak ("ERROR: IO::AIO::mmap-mapped scalar changed location, detected");
+
   SvCUR_set (sv, 0);
-  SvLEN_set (sv, 0);
   SvPVX (sv) = 0;
   SvOK_off (sv);
 
@@ -1389,14 +1391,20 @@
 	if (addr == (void *)-1)
 	  XSRETURN_NO;
 
+        sv_force_normal (scalar);
+
         /* we store the length in mg_obj, as namlen is I32 :/ */
         sv_magicext (scalar, 0, MMAP_MAGIC, &mmap_vtbl, (char *)addr, 0)
           ->mg_obj = (SV *)length;
 
 	SvUPGRADE (scalar, SVt_PV); /* nop... */
+
 	if (!(prot & PROT_WRITE))
 	  SvREADONLY_on (scalar);
 
+        if (SvLEN (scalar))
+          Safefree (SvPVX (scalar));
+
 	SvPVX (scalar) = (char *)addr;
 	SvCUR_set (scalar, length);
 	SvLEN_set (scalar, 0);