Index: firmware/common/file.c
===================================================================
--- firmware/common/file.c	(revision 28289)
+++ firmware/common/file.c	(working copy)
@@ -65,7 +65,8 @@
     DIR_UNCACHED* dir;
     struct dirent_uncached* entry;
     int fd;
-    char pathnamecopy[MAX_PATH];
+    int pathnamesize = strlen(pathname) + 1;
+    char pathnamecopy[pathnamesize];
     char* name;
     struct filedesc* file = NULL;
     int rc;
@@ -133,7 +134,7 @@
     }
 #endif

-    strlcpy(pathnamecopy, pathname, sizeof(pathnamecopy));
+    strlcpy(pathnamecopy, pathname, pathnamesize);

     /* locate filename */
     name=strrchr(pathnamecopy+1,'/');
Index: firmware/export/screendump.h
===================================================================
--- firmware/export/screendump.h	(revision 28289)
+++ firmware/export/screendump.h	(working copy)
@@ -39,7 +39,21 @@
 #define LE16_CONST(x) (x)&0xff, ((x)>>8)&0xff
 #define LE32_CONST(x) (x)&0xff, ((x)>>8)&0xff, ((x)>>16)&0xff, ((x)>>24)&0xff

+#if LCD_DEPTH <= 4
+#define BMP_BPP 4
+#define BMP_LINESIZE ((LCD_WIDTH/2 + 3) & ~3)
+#elif LCD_DEPTH <= 8
+#define BMP_BPP 8
+#define BMP_LINESIZE ((LCD_WIDTH + 3) & ~3)
+#elif LCD_DEPTH <= 16
+#define BMP_BPP 16
+#define BMP_LINESIZE ((LCD_WIDTH*2 + 3) & ~3)
+#else
+#define BMP_BPP 24
+#define BMP_LINESIZE ((LCD_WIDTH*3 + 3) & ~3)
+#endif

+
 #ifdef BOOTLOADER

 #define screen_dump()
Index: firmware/screendump.c
===================================================================
--- firmware/screendump.c	(revision 28289)
+++ firmware/screendump.c	(working copy)
@@ -49,20 +49,6 @@
 #endif /* LCD_DEPTH > 8 */
 #endif /* LCD_DEPTH != 16 */

-#if LCD_DEPTH <= 4
-#define BMP_BPP 4
-#define BMP_LINESIZE ((LCD_WIDTH/2 + 3) & ~3)
-#elif LCD_DEPTH <= 8
-#define BMP_BPP 8
-#define BMP_LINESIZE ((LCD_WIDTH + 3) & ~3)
-#elif LCD_DEPTH <= 16
-#define BMP_BPP 16
-#define BMP_LINESIZE ((LCD_WIDTH*2 + 3) & ~3)
-#else
-#define BMP_BPP 24
-#define BMP_LINESIZE ((LCD_WIDTH*3 + 3) & ~3)
-#endif
-
 #define BMP_HEADERSIZE (54 + 4 * BMP_NUMCOLORS)
 #define BMP_DATASIZE   (BMP_LINESIZE * (LCD_HEIGHT+LCD_SPLIT_LINES))
 #define BMP_TOTALSIZE  (BMP_HEADERSIZE + BMP_DATASIZE)
@@ -115,7 +101,7 @@
 void screen_dump(void)
 {
     int fd, y;
-    char filename[MAX_PATH];
+    char filename[32];

     fb_data *src;
 #if LCD_DEPTH == 1
Index: firmware/target/arm/s5l8700/ipodnano2g/ftl-nano2g.c
===================================================================
--- firmware/target/arm/s5l8700/ipodnano2g/ftl-nano2g.c	(revision 28289)
+++ firmware/target/arm/s5l8700/ipodnano2g/ftl-nano2g.c	(working copy)
@@ -418,8 +418,15 @@

 static struct mutex ftl_mtx;

+/* Pages per hyperblock (ftl_nand_type->pagesperblock * ftl_banks) */
+static uint32_t ppb;

+/* Reserved hyperblocks (ftl_nand_type->blocks
+                       - ftl_nand_type->userblocks - 0x17) */
+static uint32_t syshyperblocks;

+
+
 /* Finds a device info page for the specified bank and returns its number.
    Used to check if one is present, and to read the lowlevel BBT. */
 static uint32_t ftl_find_devinfo(uint32_t bank)
@@ -826,9 +833,6 @@
     DEBUGF("FTL: VFL: Reading page %d\n", vpage);
 #endif

-    uint32_t ppb = ftl_nand_type->pagesperblock * ftl_banks;
-    uint32_t syshyperblocks = ftl_nand_type->blocks
-                            - ftl_nand_type->userblocks - 0x17;
     uint32_t abspage = vpage + ppb * syshyperblocks;
     if (abspage >= ftl_nand_type->blocks * ppb || abspage < ppb)
     {
@@ -875,9 +879,6 @@
 #endif

     uint32_t i, rc = 0;
-    uint32_t ppb = ftl_nand_type->pagesperblock * ftl_banks;
-    uint32_t syshyperblocks = ftl_nand_type->blocks
-                            - ftl_nand_type->userblocks - 0x17;
     uint32_t abspage = vpage + ppb * syshyperblocks;
     if (abspage + ftl_banks - 1 >= ftl_nand_type->blocks * ppb || abspage < ppb)
 	{
@@ -951,9 +952,6 @@
     DEBUGF("FTL: VFL: Writing page %d\n", vpage);
 #endif

-    uint32_t ppb = ftl_nand_type->pagesperblock * ftl_banks;
-    uint32_t syshyperblocks = ftl_nand_type->blocks
-                            - ftl_nand_type->userblocks - 0x17;
     uint32_t abspage = vpage + ppb * syshyperblocks;
     if (abspage + count > ftl_nand_type->blocks * ppb || abspage < ppb)
 	{
@@ -962,9 +960,9 @@
         return 4;
 	}

-    uint32_t bank[5];
-    uint32_t block[5];
-    uint32_t physpage[5];
+    static uint32_t bank[5];
+    static uint32_t block[5];
+    static uint32_t physpage[5];

     for (i = 0; i < count; i++, abspage++)
     {
@@ -1034,9 +1032,6 @@
     uint8_t bbt[0x410];
 #endif

-    uint32_t syshyperblocks = ftl_nand_type->blocks
-                            - ftl_nand_type->userblocks - 0x18;
-
     for (i = 0; i < ftl_banks; i++)
 #ifndef FTL_READONLY
         if (ftl_load_bbt(i, ftl_bbt[i]) == 0)
@@ -1117,7 +1112,6 @@
 {
     uint32_t i;
     uint32_t ret;
-    uint32_t ppb = ftl_nand_type->pagesperblock * ftl_banks;
     struct ftl_vfl_cxt_type* cxt = ftl_vfl_get_newest_cxt();

     uint32_t ftlcxtblock = 0xffffffff;
@@ -1281,7 +1275,6 @@
 uint32_t ftl_read(uint32_t sector, uint32_t count, void* buffer)
 {
     uint32_t i, j;
-    uint32_t ppb = ftl_nand_type->pagesperblock * ftl_banks;
     uint32_t error = 0;

 #ifdef FTL_TRACE
@@ -1513,7 +1506,6 @@
 static uint32_t ftl_next_ctrl_pool_page(void)
 {
     uint32_t i;
-    uint32_t ppb = ftl_nand_type->pagesperblock * ftl_banks;
     if (++ftl_cxt.ftlctrlpage % ppb != 0) return 0;
     for (i = 0; i < 3; i++)
         if ((ftl_cxt.ftlctrlblocks[i] + 1) * ppb == ftl_cxt.ftlctrlpage)
@@ -1552,7 +1544,6 @@
 static uint32_t ftl_copy_page(uint32_t source, uint32_t destination,
                               uint32_t lpn, uint32_t type)
 {
-    uint32_t ppb = ftl_nand_type->pagesperblock * ftl_banks;
     uint32_t rc = ftl_vfl_read(source, ftl_copybuffer[0],
                                &ftl_copyspare[0], 1, 1) & 0x11F;
     memset(&ftl_copyspare[0], 0xFF, 0x40);
@@ -1573,7 +1564,6 @@
 static uint32_t ftl_copy_block(uint32_t source, uint32_t destination)
 {
     uint32_t i, j;
-    uint32_t ppb = ftl_nand_type->pagesperblock * ftl_banks;
     uint32_t error = 0;
     ftl_cxt.nextblockusn++;
     for (i = 0; i < ppb; i += FTL_COPYBUF_SIZE)
@@ -1632,7 +1622,6 @@
 static uint32_t ftl_compact_scattered(struct ftl_log_type* entry)
 {
     uint32_t i, j;
-    uint32_t ppb = ftl_nand_type->pagesperblock * ftl_banks;
     uint32_t error;
     struct ftl_log_type backup;
     if (entry->pagescurrent == 0)
@@ -1716,7 +1705,6 @@
 static uint32_t ftl_commit_sequential(struct ftl_log_type* entry)
 {
     uint32_t i;
-    uint32_t ppb = ftl_nand_type->pagesperblock * ftl_banks;

     if (entry->issequential != 1
      || entry->pagescurrent != entry->pagesused)
@@ -1762,7 +1750,6 @@
 static uint32_t ftl_remove_scattered_block(struct ftl_log_type* entry)
 {
     uint32_t i;
-    uint32_t ppb = ftl_nand_type->pagesperblock * ftl_banks;
     uint32_t age = 0xFFFFFFFF, used = 0;
     if (entry == NULL)
     {
@@ -1855,7 +1842,6 @@
 static uint32_t ftl_commit_cxt(void)
 {
     uint32_t i;
-    uint32_t ppb = ftl_nand_type->pagesperblock * ftl_banks;
     uint32_t mappages = (ftl_nand_type->userblocks + 0x3ff) >> 10;
     uint32_t ctrpages = (ftl_nand_type->userblocks + 23 + 0x3ff) >> 10;
     uint32_t endpage = ftl_cxt.ftlctrlpage + mappages + ctrpages + 1;
@@ -1894,7 +1880,7 @@

 #ifndef FTL_READONLY
 /* Swaps the most and least worn block on the flash,
-   to better distribute wear. It will refuse to do anything
+   to better distribute wear. It will not do anything
    if the wear spread is lower than 5 erases. */
 static uint32_t ftl_swap_blocks(void)
 {
@@ -1940,7 +1926,6 @@
 uint32_t ftl_write(uint32_t sector, uint32_t count, const void* buffer)
 {
     uint32_t i, j, k;
-    uint32_t ppb = ftl_nand_type->pagesperblock * ftl_banks;

 #ifdef FTL_TRACE
     DEBUGF("FTL: Writing %d sectors starting at %d\n", count, sector);
@@ -2119,7 +2104,6 @@
 {
     uint32_t i;
     uint32_t rc = 0;
-    uint32_t ppb = ftl_nand_type->pagesperblock * ftl_banks;
     if (ftl_cxt.clean_flag == 1) return 0;

     mutex_lock(&ftl_mtx);
@@ -2177,6 +2161,8 @@
     for (i = 0; i < 4; i++)
         if (nand_get_device_type(i) != 0) ftl_banks = i + 1;
     ftl_nand_type = nand_get_device_type(0);
+    ppb = ftl_nand_type->pagesperblock * ftl_banks;
+    syshyperblocks = ftl_nand_type->blocks - ftl_nand_type->userblocks - 0x17;
     foundsignature = 0;
     blockwiped = 1;
     for (i = 0; i < ftl_nand_type->pagesperblock; i++)
Index: firmware/usb.c
===================================================================
--- firmware/usb.c	(revision 28289)
+++ firmware/usb.c	(working copy)
@@ -68,10 +68,9 @@
 static int usb_mmc_countdown = 0;
 #endif

-/* FIXME: The extra 0x800 is consumed by fat_mount() when the fsinfo
-   needs updating */
+/* Make sure there's enough stack space for screendump */
 #ifdef USB_FULL_INIT
-static long usb_stack[(DEFAULT_STACK_SIZE + 0x800)/sizeof(long)];
+static long usb_stack[(DEFAULT_STACK_SIZE + SECTOR_SIZE + BMP_LINESIZE)/sizeof(long)];
 static const char usb_thread_name[] = "usb";
 static unsigned int usb_thread_entry = 0;
 #ifndef USB_STATUS_BY_EVENT