diff --git a/include/ipc_handler.h b/include/ipc_handler.h
index 5e83cd1..8ba27b1 100644
--- a/include/ipc_handler.h
+++ b/include/ipc_handler.h
@@ -39,8 +39,8 @@
 	IPC_CMD9_FUNMOUNT          = CMD_ID(1)  | CMD_IN_BUFS(0)  | CMD_OUT_BUFS(0)  | CMD_PARAMS(1),
 	IPC_CMD9_FOPEN             = CMD_ID(2)  | CMD_IN_BUFS(1)  | CMD_OUT_BUFS(0)  | CMD_PARAMS(1),
 	IPC_CMD9_FCLOSE            = CMD_ID(3)  | CMD_IN_BUFS(0)  | CMD_OUT_BUFS(0)  | CMD_PARAMS(1),
-	IPC_CMD9_FREAD             = CMD_ID(4)  | CMD_IN_BUFS(0)  | CMD_OUT_BUFS(1)  | CMD_PARAMS(2),
-	IPC_CMD9_FWRITE            = CMD_ID(5)  | CMD_IN_BUFS(1)  | CMD_OUT_BUFS(0)  | CMD_PARAMS(2),
+	IPC_CMD9_FREAD             = CMD_ID(4)  | CMD_IN_BUFS(0)  | CMD_OUT_BUFS(1)  | CMD_PARAMS(1),
+	IPC_CMD9_FWRITE            = CMD_ID(5)  | CMD_IN_BUFS(1)  | CMD_OUT_BUFS(0)  | CMD_PARAMS(1),
 	IPC_CMD9_FOPEN_DIR         = CMD_ID(6)  | CMD_IN_BUFS(0)  | CMD_OUT_BUFS(0)  | CMD_PARAMS(2),
 	IPC_CMD9_FREAD_DIR         = CMD_ID(7)  | CMD_IN_BUFS(0)  | CMD_OUT_BUFS(1)  | CMD_PARAMS(2),
 	IPC_CMD9_FCLOSE_DIR        = CMD_ID(8)  | CMD_IN_BUFS(0)  | CMD_OUT_BUFS(0)  | CMD_PARAMS(1),
diff --git a/source/arm11/fs.c b/source/arm11/fs.c
index 6548238..33a06e1 100644
--- a/source/arm11/fs.c
+++ b/source/arm11/fs.c
@@ -48,28 +48,26 @@
 
 s32 fClose(s32 handle)
 {
-	const u32 cmdBuf = (u32)handle;
+	const u32 cmdBuf = handle;
 	return (s32)PXI_sendCmd(IPC_CMD9_FCLOSE, &cmdBuf, 1);
 }
 
 s32 fRead(s32 handle, void *const buf, u32 size)
 {
-	u32 cmdBuf[4];
+	u32 cmdBuf[3];
 	cmdBuf[0] = (u32)buf;
 	cmdBuf[1] = size;
-	cmdBuf[2] = (u32)handle;
-	cmdBuf[3] = size;
+	cmdBuf[2] = handle;
 
-	return (s32)PXI_sendCmd(IPC_CMD9_FREAD, cmdBuf, 4);
+	return (s32)PXI_sendCmd(IPC_CMD9_FREAD, cmdBuf, 3);
 }
 
 s32 fWrite(s32 handle, const void *const buf, u32 size)
 {
-	u32 cmdBuf[4];
+	u32 cmdBuf[3];
 	cmdBuf[0] = (u32)buf;
 	cmdBuf[1] = size;
-	cmdBuf[2] = (u32)handle;
-	cmdBuf[3] = size;
+	cmdBuf[2] = handle;
 
-	return (s32)PXI_sendCmd(IPC_CMD9_FWRITE, cmdBuf, 4);
+	return (s32)PXI_sendCmd(IPC_CMD9_FWRITE, cmdBuf, 3);
 }
diff --git a/source/arm11/main.c b/source/arm11/main.c
index 35ad5fe..39a486c 100644
--- a/source/arm11/main.c
+++ b/source/arm11/main.c
@@ -29,6 +29,7 @@
 #include "arm11/menu_fb3ds.h"
 #include "arm11/console.h"
 #include "arm11/fmt.h"
+#include "fs.h"
 
 
 volatile bool g_poweroffAllowed = false;
@@ -49,7 +50,34 @@
 	// init description console
 	PrintConsole desc_con;
 	consoleInit(SCREEN_TOP, &desc_con, false);
-	
+
+	/*ee_puts("fs test...");
+	s32 fs = fMount(FS_DRIVE_SDMC);
+	if(fs < 0)
+	{
+		ee_printf("Failed to mount SD! %d\n", fs);
+		return 1;
+	}
+
+	s32 f = fOpen("sdmc:/_testFile_.txt", FS_OPEN_CREATE_ALWAYS | FS_OPEN_WRITE);
+	if(f < 0)
+	{
+		ee_printf("Failed to open file! %d\n", f);
+		fUnmount(fs);
+		return 1;
+	}
+
+	s32 res = fWrite(f, "It worked!!!", 13);
+	if(res < 0)
+	{
+		ee_printf("Failed to write to file! %d\n", res);
+		fClose(f);
+		fUnmount(fs);
+		return 1;
+	}
+	fClose(f);
+	fUnmount(fs);*/
+
 	// run menu
 	menuProcess(&menu_con, &desc_con, menu_fb3ds);
 	
diff --git a/source/arm9/ipc_handler.c b/source/arm9/ipc_handler.c
index 0f31911..f710a2d 100644
--- a/source/arm9/ipc_handler.c
+++ b/source/arm9/ipc_handler.c
@@ -49,10 +49,10 @@
 			result = (u32)fClose(buf[0]);
 			break;
 		case IPC_CMD_ID_MASK(IPC_CMD9_FREAD):
-			result = (u32)fRead(buf[2], (void *const)buf[0], buf[3]);
+			result = (u32)fRead(buf[2], (void *const)buf[0], buf[1]);
 			break;
 		case IPC_CMD_ID_MASK(IPC_CMD9_FWRITE):
-			result = (u32)fWrite(buf[2], (const void *const)buf[0], buf[3]);
+			result = (u32)fWrite(buf[2], (const void *const)buf[0], buf[1]);
 			break;
 		case IPC_CMD_ID_MASK(IPC_CMD9_FOPEN_DIR):
 			break;
@@ -69,15 +69,8 @@
 		case IPC_CMD_ID_MASK(IPC_CMD9_WRITE_SECTORS):
 			break;
 		case IPC_CMD_ID_MASK(IPC_CMD9_MALLOC):
-			//result = (u32)malloc(buf[0]);
 			break;
 		case IPC_CMD_ID_MASK(IPC_CMD9_FREE):
-			/*{
-				extern char* fake_heap_start;
-				extern char* fake_heap_end;
-				if(buf[0] > (u32)fake_heap_end || buf[0] < (u32)fake_heap_start) panic();
-				free((void*)buf[0]);
-			}*/
 			break;
 		case IPC_CMD_ID_MASK(IPC_CMD9_LOAD_VERIFY_FIRM):
 			break;
diff --git a/source/hardware/pxi.c b/source/hardware/pxi.c
index 81317a7..110db5b 100644
--- a/source/hardware/pxi.c
+++ b/source/hardware/pxi.c
@@ -84,10 +84,15 @@
 	const u8 inBufs = IPC_CMD_IN_BUFS_MASK(cmd);
 	const u8 outBufs = IPC_CMD_OUT_BUFS_MASK(cmd);
 	for(u32 i = 0; i < inBufs; i++)
-		flushDCacheRange((void*)buf[i * 2], buf[i * 2 + 1]);
-
+	{
+		const IpcBuffer *const inBuf = (IpcBuffer*)&buf[i * sizeof(IpcBuffer) / 4];
+		flushDCacheRange(inBuf->ptr, inBuf->size);
+	}
 	for(u32 i = inBufs; i < inBufs + outBufs; i++)
-		invalidateDCacheRange((void*)buf[i * 2], buf[i * 2 + 1]);
+	{
+		const IpcBuffer *const outBuf = (IpcBuffer*)&buf[i * sizeof(IpcBuffer) / 4];
+		invalidateDCacheRange(outBuf->ptr, outBuf->size);
+	}
 
 	while(REG_PXI_CNT & PXI_SEND_FIFO_FULL);
 	REG_PXI_SEND = cmd;