Index: kernel/generic/src/ipc/irq.c
===================================================================
--- kernel/generic/src/ipc/irq.c	(revision 56c167c17d9f374fdab0db27dbc4d039172f1d2a)
+++ kernel/generic/src/ipc/irq.c	(revision 4efeab5eba19b466b561564676dd7a05e0a2be56)
@@ -176,4 +176,44 @@
 }
 
+/** Statically check the top-half pseudocode
+ *
+ * Check the top-half pseudocode for invalid or unsafe
+ * constructs.
+ *
+ */
+static int code_check(irq_cmd_t *cmds, size_t cmdcount)
+{
+	for (size_t i = 0; i < cmdcount; i++) {
+		/*
+		 * Check for accepted ranges.
+		 */
+		if (cmds[i].cmd >= CMD_LAST)
+			return EINVAL;
+		
+		if (cmds[i].srcarg >= IPC_CALL_LEN)
+			return EINVAL;
+		
+		if (cmds[i].dstarg >= IPC_CALL_LEN)
+			return EINVAL;
+		
+		switch (cmds[i].cmd) {
+		case CMD_PREDICATE:
+			/*
+			 * Check for control flow overflow.
+			 * Note that jumping just beyond the last
+			 * command is a correct behaviour.
+			 */
+			if (i + cmds[i].value > cmdcount)
+				return EINVAL;
+			
+			break;
+		default:
+			break;
+		}
+	}
+	
+	return EOK;
+}
+
 /** Free the top-half pseudocode.
  *
@@ -223,5 +263,9 @@
 	if (rc != EOK)
 		goto error;
-
+	
+	rc = code_check(cmds, code->cmdcount);
+	if (rc != EOK)
+		goto error;
+	
 	rc = ranges_map_and_apply(ranges, code->rangecount, cmds,
 	    code->cmdcount);
@@ -492,30 +536,19 @@
 	
 	for (size_t i = 0; i < code->cmdcount; i++) {
-		uint32_t dstval;
-		
 		uintptr_t srcarg = code->cmds[i].srcarg;
 		uintptr_t dstarg = code->cmds[i].dstarg;
 		
-		if (srcarg >= IPC_CALL_LEN)
-			break;
-		
-		if (dstarg >= IPC_CALL_LEN)
-			break;
-	
 		switch (code->cmds[i].cmd) {
 		case CMD_PIO_READ_8:
-			dstval = pio_read_8((ioport8_t *) code->cmds[i].addr);
-			if (dstarg)
-				scratch[dstarg] = dstval;
+			scratch[dstarg] =
+			    pio_read_8((ioport8_t *) code->cmds[i].addr);
 			break;
 		case CMD_PIO_READ_16:
-			dstval = pio_read_16((ioport16_t *) code->cmds[i].addr);
-			if (dstarg)
-				scratch[dstarg] = dstval;
+			scratch[dstarg] =
+			    pio_read_16((ioport16_t *) code->cmds[i].addr);
 			break;
 		case CMD_PIO_READ_32:
-			dstval = pio_read_32((ioport32_t *) code->cmds[i].addr);
-			if (dstarg)
-				scratch[dstarg] = dstval;
+			scratch[dstarg] =
+			    pio_read_32((ioport32_t *) code->cmds[i].addr);
 			break;
 		case CMD_PIO_WRITE_8:
@@ -532,32 +565,26 @@
 			break;
 		case CMD_PIO_WRITE_A_8:
-			if (srcarg) {
-				pio_write_8((ioport8_t *) code->cmds[i].addr,
-				    (uint8_t) scratch[srcarg]);
-			}
+			pio_write_8((ioport8_t *) code->cmds[i].addr,
+			    (uint8_t) scratch[srcarg]);
 			break;
 		case CMD_PIO_WRITE_A_16:
-			if (srcarg) {
-				pio_write_16((ioport16_t *) code->cmds[i].addr,
-				    (uint16_t) scratch[srcarg]);
-			}
+			pio_write_16((ioport16_t *) code->cmds[i].addr,
+			    (uint16_t) scratch[srcarg]);
 			break;
 		case CMD_PIO_WRITE_A_32:
-			if (srcarg) {
-				pio_write_32((ioport32_t *) code->cmds[i].addr,
-				    (uint32_t) scratch[srcarg]);
-			}
-			break;
-		case CMD_BTEST:
-			if ((srcarg) && (dstarg)) {
-				dstval = scratch[srcarg] & code->cmds[i].value;
-				scratch[dstarg] = dstval;
-			}
+			pio_write_32((ioport32_t *) code->cmds[i].addr,
+			    (uint32_t) scratch[srcarg]);
+			break;
+		case CMD_LOAD:
+			scratch[dstarg] = code->cmds[i].value;
+			break;
+		case CMD_AND:
+			scratch[dstarg] = scratch[srcarg] &
+			    code->cmds[i].value;
 			break;
 		case CMD_PREDICATE:
-			if ((srcarg) && (!scratch[srcarg])) {
+			if (scratch[srcarg] == 0)
 				i += code->cmds[i].value;
-				continue;
-			}
+			
 			break;
 		case CMD_ACCEPT: