diff --git a/bochs/iodev/cdrom.cc b/bochs/iodev/cdrom.cc
index 08dbe6094..2fdcda2d0 100644
--- a/bochs/iodev/cdrom.cc
+++ b/bochs/iodev/cdrom.cc
@@ -1,5 +1,5 @@
 /////////////////////////////////////////////////////////////////////////
-// $Id: cdrom.cc,v 1.88 2006-03-07 18:16:40 sshwarts Exp $
+// $Id: cdrom.cc,v 1.89 2006-03-26 00:38:57 vruppert Exp $
 /////////////////////////////////////////////////////////////////////////
 //
 //  Copyright (C) 2002  MandrakeSoft S.A.
@@ -532,7 +532,7 @@ cdrom_interface::cdrom_interface(char *dev)
 
 void
 cdrom_interface::init(void) {
-  BX_DEBUG(("Init $Id: cdrom.cc,v 1.88 2006-03-07 18:16:40 sshwarts Exp $"));
+  BX_DEBUG(("Init $Id: cdrom.cc,v 1.89 2006-03-26 00:38:57 vruppert Exp $"));
   BX_INFO(("file = '%s'",path));
 }
 
@@ -1181,7 +1181,7 @@ cdrom_interface::capacity()
     if ((stat_buf.st_size % 2048) != 0)  {
       BX_ERROR (("expected cdrom image to be a multiple of 2048 bytes"));
     }
-    return (stat_buf.st_size / 2048) + 150;
+    return (stat_buf.st_size / 2048);
   }
 #endif
 
@@ -1319,7 +1319,7 @@ cdrom_interface::capacity()
     } else if (using_file) {
       ULARGE_INTEGER FileSize;
       FileSize.LowPart = GetFileSize(hFile, &FileSize.HighPart);
-      return (Bit32u)((FileSize.QuadPart / 2048) + 150);
+      return (Bit32u)(FileSize.QuadPart / 2048);
     } else {  /* direct device access */
       if (isWindowsXP) {
         LARGE_INTEGER length;
diff --git a/bochs/iodev/harddrv.cc b/bochs/iodev/harddrv.cc
index e718ce3af..a091163cd 100644
--- a/bochs/iodev/harddrv.cc
+++ b/bochs/iodev/harddrv.cc
@@ -1,5 +1,5 @@
 /////////////////////////////////////////////////////////////////////////
-// $Id: harddrv.cc,v 1.164 2006-03-07 18:16:40 sshwarts Exp $
+// $Id: harddrv.cc,v 1.165 2006-03-26 00:38:58 vruppert Exp $
 /////////////////////////////////////////////////////////////////////////
 //
 //  Copyright (C) 2002  MandrakeSoft S.A.
@@ -143,7 +143,7 @@ void bx_hard_drive_c::init(void)
   char  ata_name[20];
   bx_list_c *base;
 
-  BX_DEBUG(("Init $Id: harddrv.cc,v 1.164 2006-03-07 18:16:40 sshwarts Exp $"));
+  BX_DEBUG(("Init $Id: harddrv.cc,v 1.165 2006-03-26 00:38:58 vruppert Exp $"));
 
   for (channel=0; channel<BX_MAX_ATA_CHANNEL; channel++) {
     sprintf(ata_name, "ata.%d.resources", channel);
@@ -1752,13 +1752,16 @@ void bx_hard_drive_c::write(Bit32u address, Bit32u value, unsigned io_len)
                     raise_interrupt(channel);
                     break;
                   }
+                  if (lba > BX_SELECTED_DRIVE(channel).cdrom.capacity) {
+                    atapi_cmd_error(channel, SENSE_ILLEGAL_REQUEST, ASC_LOGICAL_BLOCK_OOR, 1);
+                    raise_interrupt(channel);
+                    break;
+                  }
 
                   // Ben: see comment below
                   if (lba + transfer_length > BX_SELECTED_DRIVE(channel).cdrom.capacity) {
                     transfer_length = (BX_SELECTED_DRIVE(channel).cdrom.capacity - lba);
                   }
-
-                  //if (transfer_length == 0) {
                   if (transfer_length <= 0) {
                     atapi_cmd_nop(channel);
                     raise_interrupt(channel);