Index: drivers/filesystems/fastfat/fsctl.c
===================================================================
--- drivers/filesystems/fastfat/fsctl.c	(revision 63811)
+++ drivers/filesystems/fastfat/fsctl.c	(working copy)
@@ -442,8 +442,7 @@
         goto ByeBye;
     }
 
-    DeviceObject->Flags = DeviceObject->Flags | DO_DIRECT_IO;
-    DeviceExt = (PVOID) DeviceObject->DeviceExtension;
+    DeviceExt = DeviceObject->DeviceExtension;
     RtlZeroMemory(DeviceExt, ROUND_UP(sizeof(DEVICE_EXTENSION), sizeof(ULONG)) + sizeof(HASHENTRY*) * HashTableSize);
     DeviceExt->FcbHashTable = (HASHENTRY**)((ULONG_PTR)DeviceExt + ROUND_UP(sizeof(DEVICE_EXTENSION), sizeof(ULONG)));
     DeviceExt->HashTableSize = HashTableSize;
Index: drivers/filesystems/fastfat/rw.c
===================================================================
--- drivers/filesystems/fastfat/rw.c	(revision 63811)
+++ drivers/filesystems/fastfat/rw.c	(working copy)
@@ -947,30 +947,41 @@
     {
         // cached write
 
-        if (IrpContext->FileObject->PrivateCacheMap == NULL)
+        _SEH2_TRY
         {
-            CcInitializeCacheMap(IrpContext->FileObject,
-                                 (PCC_FILE_SIZES)(&Fcb->RFCB.AllocationSize),
-                                 FALSE,
-                                 &VfatGlobalData->CacheMgrCallbacks,
-                                 Fcb);
-        }
+            if (IrpContext->FileObject->PrivateCacheMap == NULL)
+            {
+                CcInitializeCacheMap(IrpContext->FileObject,
+                                     (PCC_FILE_SIZES)(&Fcb->RFCB.AllocationSize),
+                                     FALSE,
+                                     &VfatGlobalData->CacheMgrCallbacks,
+                                     Fcb);
+            }
 
-        if (ByteOffset.QuadPart > OldFileSize.QuadPart)
-        {
-            CcZeroData(IrpContext->FileObject, &OldFileSize, &ByteOffset, TRUE);
-        }
+            if (ByteOffset.QuadPart > OldFileSize.QuadPart)
+            {
+                CcZeroData(IrpContext->FileObject, &OldFileSize, &ByteOffset, TRUE);
+            }
 
-        if (CcCopyWrite(IrpContext->FileObject, &ByteOffset, Length,
-                        1 /*IrpContext->Flags & IRPCONTEXT_CANWAIT*/, Buffer))
-        {
-            IrpContext->Irp->IoStatus.Information = Length;
-            Status = STATUS_SUCCESS;
+            if (CcCopyWrite(IrpContext->FileObject,
+                            &ByteOffset,
+                            Length,
+                            TRUE /*(IrpContext->Flags & IRPCONTEXT_CANWAIT) != 0*/,
+                            Buffer))
+            {
+                IrpContext->Irp->IoStatus.Information = Length;
+                Status = STATUS_SUCCESS;
+            }
+            else
+            {
+                Status = STATUS_UNSUCCESSFUL;
+            }
         }
-        else
+        _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
         {
-            Status = STATUS_UNSUCCESSFUL;
+            Status = _SEH2_GetExceptionCode();
         }
+        _SEH2_END;
     }
     else
     {
Index: drivers/filesystems/fastfat/vfat.h
===================================================================
--- drivers/filesystems/fastfat/vfat.h	(revision 63811)
+++ drivers/filesystems/fastfat/vfat.h	(working copy)
@@ -4,6 +4,7 @@
 #include <ntifs.h>
 #include <ntdddisk.h>
 #include <dos.h>
+#include <pseh/pseh2.h>
 
 #define USE_ROS_CC_AND_FS
 
Index: ntoskrnl/cc/copy.c
===================================================================
--- ntoskrnl/cc/copy.c	(revision 63811)
+++ ntoskrnl/cc/copy.c	(working copy)
@@ -511,11 +511,24 @@
                 return FALSE;
             }
         }
-        RtlCopyMemory((char*)BaseAddress + WriteOffset % VACB_MAPPING_GRANULARITY,
-                      Buffer,
-                      TempLength);
+        Status = STATUS_SUCCESS;
+        _SEH2_TRY
+        {
+            RtlCopyMemory((char*)BaseAddress + WriteOffset % VACB_MAPPING_GRANULARITY,
+                        Buffer,
+                        TempLength);
+        }
+        _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
+        {
+            Status = _SEH2_GetExceptionCode();
+        }
+        _SEH2_END;
+
         CcRosReleaseVacb(SharedCacheMap, Vacb, TRUE, TRUE, FALSE);
 
+        if (!NT_SUCCESS(Status))
+            ExRaiseStatus(STATUS_INVALID_USER_BUFFER);
+
         Length -= TempLength;
         WriteOffset += TempLength;