Jens, may I politely inquire why is struct io_rw playing these games with overloading ->rw.addr, instead of simply having struct io_buffer *kbuf in it? Another question: what the hell are the rules for REQ_F_BUFFER_SELECT? The first time around io_iov_buffer_select() will * read iovec from ->rw.addr * replace iovec.iov_base with value derived from ->buf_index * cap iovec.iov_len with value derived from ->buf_index Next time around it will use the same base *AND* replace the length with the value used to cap the original. Is that deliberate?