diff --git a/kern/arch/x86/pmap64.c b/kern/arch/x86/pmap64.c
index 09469a9..c677380 100644
--- a/kern/arch/x86/pmap64.c
+++ b/kern/arch/x86/pmap64.c
@@ -631,6 +631,9 @@
 	ept = kpte_to_epte(kpt);
 	memset(ept, 0, PGSIZE);
 
+// XXX
+kpt[0] = 0;
+
 	/* This bit of paranoia slows process creation a little, but makes sure that
 	 * there is nothing below ULIM in boot_pgdir.  Any PML4 entries copied from
 	 * boot_pgdir (e.g. the kernel's memory) will be *shared* among all
diff --git a/kern/src/env.c b/kern/src/env.c
index 2abc57c..007bde4 100644
--- a/kern/src/env.c
+++ b/kern/src/env.c
@@ -79,6 +79,11 @@
 	if (page_insert(e->env_pgdir, shared_page, (void*)UGDATA, PTE_USER_RW) < 0)
 		goto env_setup_vm_error;
 
+	extern struct page *mmap_zero_pg;
+	if (page_insert(e->env_pgdir, mmap_zero_pg, 0, PTE_KERN_RW) < 0)
+		panic("ghetto mmap insertion failed");
+
+
 	return 0;
 
 env_setup_vm_error:
diff --git a/kern/src/init.c b/kern/src/init.c
index 9ab93fc..4596a00 100644
--- a/kern/src/init.c
+++ b/kern/src/init.c
@@ -119,6 +119,17 @@
 	}
 }
 
+struct page *mmap_zero_pg;
+
+// XXX if we want to do anything else, we'll need to put it in a section that is
+// linked to be at virtual address 0.
+// 		could have this get turned on, then be in all new processes addr space
+//void xme() {} __attribute__ ((section ("mmap-zero")));
+void xme()
+{
+	breakpoint();
+}
+
 void kernel_init(multiboot_info_t *mboot_info)
 {
 	extern char __start_bss[], __stop_bss[];
@@ -169,6 +180,22 @@
 	devtabreset();
 	devtabinit();
 
+
+
+	int ret;
+	ret = kpage_alloc(&mmap_zero_pg);
+	assert(!ret);
+
+	printk("got paddr %p, ref %d\n", page2pa(mmap_zero_pg),
+	       kref_refcnt(&mmap_zero_pg->pg_kref));
+	ret = map_vmap_segment(0, page2pa(mmap_zero_pg), 1, PTE_KERN_RW);
+	assert(!ret);
+	memcpy(0, (void*)xme, PGSIZE);
+	printk("ref %d\n", kref_refcnt(&mmap_zero_pg->pg_kref));
+
+
+
+
 #ifdef CONFIG_EXT2FS
 	mount_fs(&ext2_fs_type, "/dev/ramdisk", "/mnt", 0);
 #endif /* CONFIG_EXT2FS */
diff --git a/kern/src/process.c b/kern/src/process.c
index 22b26e7..b2185d0 100644
--- a/kern/src/process.c
+++ b/kern/src/process.c
@@ -502,7 +502,8 @@
 	/* all memory below UMAPTOP should have been freed via the VMRs.  the stuff
 	 * above is the global page and procinfo/procdata */
 	env_user_mem_free(p, (void*)UMAPTOP, UVPT - UMAPTOP); /* 3rd arg = len... */
-	env_user_mem_walk(p, 0, UMAPTOP, __cb_assert_no_pg, 0);
+	//env_user_mem_walk(p, 0, UMAPTOP, __cb_assert_no_pg, 0);
+	env_user_mem_walk(p, (void*)PGSIZE, UMAPTOP, __cb_assert_no_pg, 0);
 	/* These need to be freed again, since they were allocated with a refcnt. */
 	free_cont_pages(p->procinfo, LOG2_UP(PROCINFO_NUM_PAGES));
 	free_cont_pages(p->procdata, LOG2_UP(PROCDATA_NUM_PAGES));
diff --git a/kern/src/syscall.c b/kern/src/syscall.c
index 43ce692..0498c71 100644
--- a/kern/src/syscall.c
+++ b/kern/src/syscall.c
@@ -1015,7 +1015,9 @@
 	unmap_and_destroy_vmrs(p);
 	/* close the CLOEXEC ones */
 	close_fdt(&p->open_files, TRUE);
-	env_user_mem_free(p, 0, UMAPTOP);
+	// XXX
+	//env_user_mem_free(p, 0, UMAPTOP);
+	env_user_mem_free(p, (void*)PGSIZE, UMAPTOP);
 	if (load_elf(p, program, argc, argv, envc, envp)) {
 		kref_put(&program->f_kref);
 		user_memdup_free(p, kargenv);