diff --git a/qla2x00t/qla2x00-target/qla2x00t.c b/qla2x00t/qla2x00-target/qla2x00t.c
index 9720c1499..99ad5ca67 100644
--- a/qla2x00t/qla2x00-target/qla2x00t.c
+++ b/qla2x00t/qla2x00-target/qla2x00t.c
@@ -5752,10 +5752,10 @@ static void q2t_async_event(uint16_t code, scsi_qla_host_t *vha,
 
 	default:
 		TRACE(TRACE_MGMT, "qla2x00t(%ld): Async event %#x occurred: "
-			"ignoring (m[1]=%x, m[2]=%x, m[3]=%x, m[4]=%x)",
+			"ignoring (m[0]=%x, m[1]=%x, m[2]=%x, m[3]=%x)",
 			vha->host_no, code,
-			le16_to_cpu(mailbox[1]), le16_to_cpu(mailbox[2]),
-			le16_to_cpu(mailbox[3]), le16_to_cpu(mailbox[4]));
+			le16_to_cpu(mailbox[0]), le16_to_cpu(mailbox[1]),
+			le16_to_cpu(mailbox[2]), le16_to_cpu(mailbox[3]));
 		break;
 	}
 
diff --git a/scst/include/scst.h b/scst/include/scst.h
index 61273fecf..78c0d1973 100644
--- a/scst/include/scst.h
+++ b/scst/include/scst.h
@@ -5043,9 +5043,7 @@ static inline int __scst_get_buf(struct scst_cmd *cmd, int sg_cnt,
 		goto out;
 	}
 
-	*buf = page_address(sg_page(sg));
-	*buf += sg->offset;
-
+	*buf = sg_virt(sg);
 	res = sg->length;
 
 	cmd->get_sg_buf_entry_num++;
diff --git a/scst/src/dev_handlers/scst_user.c b/scst/src/dev_handlers/scst_user.c
index 628e1c0b4..8fb443814 100644
--- a/scst/src/dev_handlers/scst_user.c
+++ b/scst/src/dev_handlers/scst_user.c
@@ -3953,6 +3953,28 @@ out:
 	return 0;
 }
 
+#ifdef CONFIG_SCST_EXTRACHECKS
+static void dev_user_check_lost_ucmds(struct scst_user_dev *dev)
+{
+	int i;
+
+	for (i = 0; i < (int)ARRAY_SIZE(dev->ucmd_hash); i++) {
+		struct list_head *head = &dev->ucmd_hash[i];
+		struct scst_user_cmd *ucmd2, *tmp;
+
+		list_for_each_entry_safe(ucmd2, tmp, head, hash_list_entry) {
+			PRINT_ERROR("Lost ucmd %p (state %x, ref %d)", ucmd2,
+				ucmd2->state, atomic_read(&ucmd2->ucmd_ref));
+			ucmd_put(ucmd2);
+		}
+	}
+}
+#else
+static void dev_user_check_lost_ucmds(struct scst_user_dev *dev)
+{
+}
+#endif
+
 static int dev_user_process_cleanup(struct scst_user_dev *dev)
 {
 	struct scst_user_cmd *ucmd;
@@ -3988,22 +4010,7 @@ static int dev_user_process_cleanup(struct scst_user_dev *dev)
 		}
 	}
 
-#ifdef CONFIG_SCST_EXTRACHECKS
-{
-	int i;
-
-	for (i = 0; i < (int)ARRAY_SIZE(dev->ucmd_hash); i++) {
-		struct list_head *head = &dev->ucmd_hash[i];
-		struct scst_user_cmd *ucmd2, *tmp;
-
-		list_for_each_entry_safe(ucmd2, tmp, head, hash_list_entry) {
-			PRINT_ERROR("Lost ucmd %p (state %x, ref %d)", ucmd2,
-				ucmd2->state, atomic_read(&ucmd2->ucmd_ref));
-			ucmd_put(ucmd2);
-		}
-	}
-}
-#endif
+	dev_user_check_lost_ucmds(dev);
 
 	TRACE_DBG("Cleanuping done (dev %p)", dev);
 	complete_all(&dev->cleanup_cmpl);
diff --git a/scst/src/dev_handlers/scst_vdisk.c b/scst/src/dev_handlers/scst_vdisk.c
index 2ec0d1177..9ec6e4af6 100644
--- a/scst/src/dev_handlers/scst_vdisk.c
+++ b/scst/src/dev_handlers/scst_vdisk.c
@@ -3322,6 +3322,8 @@ static enum compl_status_e fileio_exec_async(struct vdisk_cmd_params *p)
 		length = scst_get_buf_next(cmd, &address);
 	}
 
+	WARN_ON_ONCE(kvec - p->async.kvec != scst_get_buf_count(cmd));
+
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 20, 0)
 	iov_iter_kvec(&iter, dir, p->async.kvec, kvec - p->async.kvec, total);
 #else
diff --git a/scst/src/scst_pres.c b/scst/src/scst_pres.c
index d77fec6bd..1f69d1380 100644
--- a/scst/src/scst_pres.c
+++ b/scst/src/scst_pres.c
@@ -762,7 +762,7 @@ static int scst_pr_do_load_device_file(struct scst_device *dev,
 	}
 	pos += sizeof(version);
 
-	while (data_size < file_size) {
+	while (data_size + 1 < file_size) {
 		uint8_t *tid;
 
 		data_size++;
@@ -794,7 +794,7 @@ static int scst_pr_do_load_device_file(struct scst_device *dev,
 	dev->pr_scope = buf[pos];
 	pos += sizeof(dev->pr_scope);
 
-	while (pos < file_size) {
+	while (pos + 1 < file_size) {
 		uint8_t is_holder;
 		uint8_t *tid;
 		struct scst_dev_registrant *reg = NULL;
diff --git a/scst/src/scst_sysfs.c b/scst/src/scst_sysfs.c
index 6944b0995..b41296141 100644
--- a/scst/src/scst_sysfs.c
+++ b/scst/src/scst_sysfs.c
@@ -4359,8 +4359,10 @@ static ssize_t scst_sess_latency_show(struct kobject *kobj,
 	for (k = 0; k < SCST_CMD_STATE_COUNT; k++) {
 		struct scst_lat_stats *lat_stats = sess->lat_stats;
 
+		if (!lat_stats || res >= PAGE_SIZE)
+			continue;
 		d = &lat_stats->ls[i][j][k];
-		if (!lat_stats || d->count == 0 || res >= PAGE_SIZE)
+		if (d->count == 0)
 			continue;
 		scst_get_cmd_state_name(state_name, sizeof(state_name),
 					k);