--- xnu/xnu-3248.50.21/iokit/Kernel/IODeviceTreeSupport.cpp
+++ xnu/xnu-3789.31.2/iokit/Kernel/IODeviceTreeSupport.cpp
@@ -257,23 +257,29 @@
     OSData				*propObj;
     dtptr_t				*propPtr;
     unsigned int		propSize;
+    int ret = -1;
 
     chosen = IORegistryEntry::fromPath( "/chosen/memory-map", gIODTPlane );
     if ( chosen == 0 ) return -1;
 
     propObj = OSDynamicCast( OSData, chosen->getProperty(key) );
-    if ( propObj == 0 ) return -1;
+    if ( propObj == 0 ) goto cleanup;
 
     propSize = propObj->getLength();
-    if ( propSize != (2 * sizeof(dtptr_t)) ) return -1;
+    if ( propSize != (2 * sizeof(dtptr_t)) ) goto cleanup;
  
     propPtr = (dtptr_t *)propObj->getBytesNoCopy();
-    if ( propPtr == 0 ) return -1;
+    if ( propPtr == 0 ) goto cleanup;
 
     *infoAddr = (void *)(uintptr_t) (propPtr[0]);
     *infoSize = (int)               (propPtr[1]);
 
-    return 0;
+    ret = 0;
+
+cleanup:
+    chosen->release();
+
+    return ret;
 }
 
 void IODTFreeLoaderInfo( const char *key, void *infoAddr, int infoSize )
@@ -289,6 +295,7 @@
         chosen = IORegistryEntry::fromPath( "/chosen/memory-map", gIODTPlane );
         if ( chosen != 0 ) {
             chosen->removeProperty(key);
+            chosen->release();
         }
     }
 }
@@ -337,6 +344,7 @@
     char				*name;
     char				location[ 32 ];
     bool				noLocation = true;
+    bool				kernelOnly;
 
     regEntry = new IOService;
 
@@ -348,6 +356,7 @@
     if( regEntry &&
       (kSuccess == DTCreatePropertyIterator( dtEntry, &dtIter))) {
 
+        kernelOnly = (kSuccess == DTGetProperty(dtEntry, "kernel-only", &prop, &propSize));
         propTable = regEntry->getPropertyTable();
 
         while( kSuccess == DTIterateProperties( dtIter, &name)) {
@@ -363,6 +372,9 @@
                 data = OSData::withBytesNoCopy(prop, propSize);
             }
             assert( nameKey && data );
+
+            if (kernelOnly)
+                data->setSerializable(false);
 
             propTable->setObject( nameKey, data);
             data->release();
@@ -430,14 +442,17 @@
 static bool GetUInt32( IORegistryEntry * regEntry, const OSSymbol * name,
 			UInt32 * value )
 {
-    OSData	*data;
-
-    if( (data = OSDynamicCast( OSData, regEntry->getProperty( name )))
-      && (4 == data->getLength())) {
-        *value = *((UInt32 *) data->getBytesNoCopy());
-        return( true );
-    } else
-        return( false );
+    OSObject * obj;
+    OSData   * data;
+    bool       result;
+
+    if (!(obj = regEntry->copyProperty(name))) return (false);
+
+    result = ((data = OSDynamicCast(OSData, obj)) && (sizeof(UInt32) == data->getLength()));
+    if (result) *value = *((UInt32 *) data->getBytesNoCopy());
+
+    obj->release();
+    return(result);
 }
 
 static IORegistryEntry * IODTFindInterruptParent( IORegistryEntry * regEntry, IOItemCount index )
@@ -771,9 +786,10 @@
 /*
  */
 
-static const char *
+static bool
 CompareKey( OSString * key,
-		const IORegistryEntry * table, const OSSymbol * propName )
+		const IORegistryEntry * table, const OSSymbol * propName,
+		OSString ** matchingName )
 {
     OSObject		*prop;
     OSData			*data;
@@ -787,8 +803,7 @@
     bool			matched;
     const char		*result = 0;
 
-    if( 0 == (prop = table->getProperty( propName )))
-	return( 0 );
+    if( 0 == (prop = table->copyProperty( propName ))) return( 0 );
 
     if( (data = OSDynamicCast( OSData, prop ))) {
         names = (const char *) data->getBytesNoCopy();
@@ -796,47 +811,48 @@
     } else if( (string = OSDynamicCast( OSString, prop ))) {
         names = string->getCStringNoCopy();
         lastName = names + string->getLength() + 1;
-    } else
-		return( 0 );
-
-    ckey = key->getCStringNoCopy();
-    keyLen = key->getLength();
-    wild = ('*' == key->getChar( keyLen - 1 ));
-
-    do {
-        // for each name in the property
-        nlen = strnlen(names, lastName - names);
-        if( wild)
-            matched = ((nlen >= (keyLen - 1)) && (0 == strncmp(ckey, names, keyLen - 1)));
-        else
-            matched = (keyLen == nlen) && (0 == strncmp(ckey, names, keyLen));
-
-        if( matched)
-            result = names;
-
-        names = names + nlen + 1;
-
-    } while( (names < lastName) && (false == matched));
-
-    return( result);
+    } else names = 0;
+
+	if (names) {
+		ckey = key->getCStringNoCopy();
+		keyLen = key->getLength();
+		wild = ('*' == key->getChar( keyLen - 1 ));
+
+		do {
+			// for each name in the property
+			nlen = strnlen(names, lastName - names);
+			if( wild)
+				matched = ((nlen >= (keyLen - 1)) && (0 == strncmp(ckey, names, keyLen - 1)));
+			else
+				matched = (keyLen == nlen) && (0 == strncmp(ckey, names, keyLen));
+
+			if( matched)
+				result = names;
+
+			names = names + nlen + 1;
+
+		} while( (names < lastName) && (false == matched));
+	}
+
+    if (result && matchingName)	*matchingName = OSString::withCString( result );
+
+	if (prop) prop->release();
+
+    return (result != 0);
 }
 
 
 bool IODTCompareNubName( const IORegistryEntry * regEntry,
 			 OSString * name, OSString ** matchingName )
 {
-    const char		*result;
-    bool			matched;
-
-    matched =  (0 != (result = CompareKey( name, regEntry, gIODTNameKey)))
-	    || (0 != (result = CompareKey( name, regEntry, gIODTCompatibleKey)))
-	    || (0 != (result = CompareKey( name, regEntry, gIODTTypeKey)))
-	    || (0 != (result = CompareKey( name, regEntry, gIODTModelKey)));
-
-    if( result && matchingName)
-	*matchingName = OSString::withCString( result );
-
-    return( result != 0 );
+    bool matched;
+
+    matched = CompareKey( name, regEntry, gIODTNameKey,       matchingName)
+		   || CompareKey( name, regEntry, gIODTCompatibleKey, matchingName)
+		   || CompareKey( name, regEntry, gIODTTypeKey,       matchingName)
+		   || CompareKey( name, regEntry, gIODTModelKey,      matchingName);
+
+    return (matched);
 }
 
 bool IODTMatchNubWithKeys( IORegistryEntry * regEntry,