--- xnu/xnu-1228.12.14/iokit/Kernel/IOBufferMemoryDescriptor.cpp
+++ xnu/xnu-1228/iokit/Kernel/IOBufferMemoryDescriptor.cpp
@@ -31,7 +31,6 @@
 #include <IOKit/IOLib.h>
 #include <IOKit/IOMapper.h>
 #include <IOKit/IOBufferMemoryDescriptor.h>
-#include <libkern/OSDebug.h>
 
 #include "IOKitKernelInternal.h"
 #include "IOCopyMapper.h"
@@ -133,8 +132,8 @@
     range.length  = 0;
     _ranges.v64   = &range;
 
-    // Grab IOMD bits from the Buffer MD options
-    iomdOptions  |= (options & kIOBufferDescriptorMemoryFlags);
+    // Grab the direction and the Auto Prepare bits from the Buffer MD options
+    iomdOptions  |= options & (kIOMemoryDirectionMask | kIOMemoryAutoPrepare);
 
     if ((options & (kIOMemorySharingTypeMask | kIOMapCacheMask)) && (alignment < page_size))
 	alignment = page_size;
@@ -501,7 +500,7 @@
     IOOptionBits     options   = _options;
     vm_size_t        size      = _capacity;
     void *           buffer    = _buffer;
-    mach_vm_address_t source   = (_ranges.v) ? _ranges.v64->address : 0;
+    IOVirtualAddress source    = _ranges.v64->address;
     IOMemoryMap *    map       = 0;
     vm_offset_t      alignment = _alignment;
 
@@ -525,7 +524,7 @@
     else if (buffer)
     {
 	if (kIOMemoryTypePhysical64 == (flags & kIOMemoryTypeMask))
-	    IOFreePhysical(source, size);
+	    IOFreePhysical((mach_vm_address_t) source, size);
         else if (options & kIOMemoryPhysicallyContiguous)
             IOKernelFreeContiguous((mach_vm_address_t) buffer, size);
         else if (alignment > 1)