Index: kernel/generic/src/mm/as.c
===================================================================
--- kernel/generic/src/mm/as.c	(revision ab87db55cb5f202637cfdb407053e0d954a16e7d)
+++ kernel/generic/src/mm/as.c	(revision 9675296fe33ff287a6d2d86321c97dbd34619703)
@@ -2092,5 +2092,5 @@
 
 sysarg_t sys_as_area_create(uintptr_t base, size_t size, unsigned int flags,
-    uintptr_t bound, as_area_pager_info_t *pager_info)
+    uintptr_t bound, uspace_ptr_as_area_pager_info_t pager_info)
 {
 	uintptr_t virt = base;
@@ -2098,5 +2098,5 @@
 	mem_backend_data_t backend_data;
 
-	if (pager_info == AS_AREA_UNPAGED)
+	if (!pager_info)
 		backend = &anon_backend;
 	else {
@@ -2125,7 +2125,11 @@
 }
 
-sys_errno_t sys_as_area_get_info(uintptr_t address, as_area_info_t *dest)
+sys_errno_t sys_as_area_get_info(uintptr_t address, uspace_ptr_as_area_info_t dest)
 {
 	as_area_t *area;
+	as_area_info_t info;
+
+	/* Prevent leaking stack bytes via structure padding. */
+	memset(&info, 0, sizeof(info));
 
 	mutex_lock(&AS->lock);
@@ -2136,10 +2140,12 @@
 	}
 
-	dest->start_addr = area->base;
-	dest->size = P2SZ(area->pages);
-	dest->flags = area->flags;
+	info.start_addr = area->base;
+	info.size = P2SZ(area->pages);
+	info.flags = area->flags;
 
 	mutex_unlock(&area->lock);
 	mutex_unlock(&AS->lock);
+
+	copy_to_uspace(dest, &info, sizeof(info));
 	return EOK;
 }
Index: kernel/generic/src/mm/page.c
===================================================================
--- kernel/generic/src/mm/page.c	(revision ab87db55cb5f202637cfdb407053e0d954a16e7d)
+++ kernel/generic/src/mm/page.c	(revision 9675296fe33ff287a6d2d86321c97dbd34619703)
@@ -215,5 +215,5 @@
  *
  */
-sys_errno_t sys_page_find_mapping(uintptr_t virt, uintptr_t *phys_ptr)
+sys_errno_t sys_page_find_mapping(uintptr_t virt, uspace_ptr_uintptr_t phys_ptr)
 {
 	uintptr_t phys;