Index: uspace/lib/libc/generic/vfs/vfs.c
===================================================================
--- uspace/lib/libc/generic/vfs/vfs.c	(revision 9fcdb2e47bf10ab0360bec803e2a1699dbf56f42)
+++ uspace/lib/libc/generic/vfs/vfs.c	(revision 34a74ab48411f1258fe12a5bce99c172084075ea)
@@ -63,4 +63,5 @@
 {
 	char *ncwd_path;
+	char *ncwd_path_nc;
 
 	futex_down(&cwd_futex);
@@ -71,24 +72,36 @@
 			return NULL;
 		}
-		ncwd_path = malloc(len + cwd_len + 1);
-		if (!ncwd_path) {
+		ncwd_path_nc = malloc(len + cwd_len + 1);
+		if (!ncwd_path_nc) {
 			futex_up(&cwd_futex);
 			return NULL;
 		}
-		strcpy(ncwd_path, cwd_path);
-		ncwd_path[cwd_len] = '/';
-		ncwd_path[cwd_len + 1] = '\0';
+		strcpy(ncwd_path_nc, cwd_path);
+		ncwd_path_nc[cwd_len] = '/';
+		ncwd_path_nc[cwd_len + 1] = '\0';
 	} else {
-		ncwd_path = malloc(len + 1);
-		if (!ncwd_path) {
+		ncwd_path_nc = malloc(len + 1);
+		if (!ncwd_path_nc) {
 			futex_up(&cwd_futex);
 			return NULL;
 		}
-		ncwd_path[0] = '\0';
-	}
-	strcat(ncwd_path, path);
-	if (!canonify(ncwd_path, retlen)) {
+		ncwd_path_nc[0] = '\0';
+	}
+	strcat(ncwd_path_nc, path);
+	ncwd_path = canonify(ncwd_path_nc, retlen);
+	if (!ncwd_path) {
 		futex_up(&cwd_futex);
-		free(ncwd_path);
+		free(ncwd_path_nc);
+		return NULL;
+	}
+	/*
+	 * We need to clone ncwd_path because canonify() works in-place and thus
+	 * the address in ncwd_path need not be the same as ncwd_path_nc, even
+	 * though they both point into the same dynamically allocated buffer.
+	 */
+	ncwd_path = strdup(ncwd_path);
+	free(ncwd_path_nc);
+	if (!ncwd_path) {
+		futex_up(&cwd_futex);
 		return NULL;
 	}