:: commit 23a93a85dcaa329715623dc41afc20fe508087f3

diff --git a/stage23/lib/gterm.c b/stage23/lib/gterm.c
index 6223fb06..5c3804f1 100644
--- a/stage23/lib/gterm.c
+++ b/stage23/lib/gterm.c
@@ -104,6 +104,10 @@ static inline uint32_t colour_blend(uint32_t fg, uint32_t bg) {
 }
 
 void gterm_plot_px(size_t x, size_t y, uint32_t hex) {
+    if (x >= gterm_width || y >= gterm_height) {
+        return;
+    }
+
     size_t fb_i = x + (gterm_pitch / sizeof(uint32_t)) * y;
 
     gterm_framebuffer[fb_i] = hex;
@@ -251,6 +255,9 @@ struct gterm_char {
 };
 
 void gterm_plot_char(struct gterm_char *c, size_t x, size_t y) {
+    if (x > gterm_width - vga_font_scale_x || y > gterm_width - vga_font_scale_y) {
+        return;
+    }
     bool *glyph = &vga_font_bool[c->c * vga_font_height * vga_font_width];
     // naming: fx,fy for font coordinates, gx,gy for glyph coordinates
     for (size_t gy = 0; gy < glyph_height; gy++) {
@@ -269,6 +276,9 @@ void gterm_plot_char(struct gterm_char *c, size_t x, size_t y) {
 }
 
 void gterm_plot_char_fast(struct gterm_char *old, struct gterm_char *c, size_t x, size_t y) {
+    if (x > gterm_width - vga_font_scale_x || y > gterm_width - vga_font_scale_y) {
+        return;
+    }
     bool *new_glyph = &vga_font_bool[c->c * vga_font_height * vga_font_width];
     bool *old_glyph = &vga_font_bool[old->c * vga_font_height * vga_font_width];
     for (size_t gy = 0; gy < glyph_height; gy++) {
@@ -290,10 +300,18 @@ void gterm_plot_char_fast(struct gterm_char *old, struct gterm_char *c, size_t x
 }
 
 static void plot_char_grid_force(struct gterm_char *c, size_t x, size_t y) {
+    if (x >= cols || y >= rows) {
+        return;
+    }
+
     gterm_plot_char(c, frame_width + x * glyph_width, frame_height + y * glyph_height);
 }
 
 static void plot_char_grid(struct gterm_char *c, size_t x, size_t y) {
+    if (x >= cols || y >= rows) {
+        return;
+    }
+
     if (!double_buffer_enabled) {
         struct gterm_char *old = &grid[x + y * cols];
 
@@ -320,7 +338,7 @@ static void draw_cursor(void) {
     if (cursor_status) {
         struct gterm_char c = grid[cursor_x + cursor_y * cols];
         c.fg = 0;
-        c.bg = 0xaaaaaa;
+        c.bg = 0xcccccc;
         plot_char_grid_force(&c, cursor_x, cursor_y);
     }
 }
diff --git a/stage23/lib/term.s2.c b/stage23/lib/term.s2.c
index 6fce9900..58a82044 100644
--- a/stage23/lib/term.s2.c
+++ b/stage23/lib/term.s2.c
@@ -163,7 +163,7 @@ static void context_restore(uint64_t ptr) {
 #if defined (__i386__)
 #define TERM_XFER_CHUNK 8192
 
-static char xfer_buf[TERM_XFER_CHUNK];
+static uint8_t xfer_buf[TERM_XFER_CHUNK];
 #endif
 
 void term_write(uint64_t buf, uint64_t count) {
@@ -206,7 +206,13 @@ void term_write(uint64_t buf, uint64_t count) {
     } else {
 #if defined (__i386__)
         while (count != 0) {
-            uint64_t chunk = count % TERM_XFER_CHUNK;
+            uint64_t chunk;
+            if (count > TERM_XFER_CHUNK) {
+                chunk = TERM_XFER_CHUNK;
+            } else {
+                chunk = count;
+            }
+
             memcpy32to64((uint64_t)(uintptr_t)xfer_buf, buf, chunk);
 
             old_cur_stat = disable_cursor();
@@ -688,7 +694,9 @@ static void control_sequence_parse(uint8_t c) {
             if (esc_values_i > 1) {
                 scroll_bottom_margin = esc_values[1];
             }
-            if (scroll_top_margin >= (scroll_bottom_margin - 1)) {
+            if (scroll_top_margin >= term_rows
+             || scroll_bottom_margin >= term_rows
+             || scroll_top_margin >= (scroll_bottom_margin - 1)) {
                 scroll_top_margin = 0;
                 scroll_bottom_margin = term_rows;
             }