Index: kernel/generic/src/mm/as.c
===================================================================
--- kernel/generic/src/mm/as.c	(revision 8df5f20c3e20072bcf616568836c1d08eba227c2)
+++ kernel/generic/src/mm/as.c	(revision a3f63ac154a8851b99a2cdc01fb73050f4b9ca43)
@@ -2092,5 +2092,5 @@
 
 sysarg_t sys_as_area_create(uintptr_t base, size_t size, unsigned int flags,
-    uintptr_t bound, as_area_pager_info_t *pager_info)
+    uintptr_t bound, uspace_ptr_as_area_pager_info_t pager_info)
 {
 	uintptr_t virt = base;
@@ -2098,5 +2098,5 @@
 	mem_backend_data_t backend_data;
 
-	if (pager_info == AS_AREA_UNPAGED)
+	if (!pager_info)
 		backend = &anon_backend;
 	else {
@@ -2125,7 +2125,11 @@
 }
 
-sys_errno_t sys_as_area_get_info(uintptr_t address, as_area_info_t *dest)
+sys_errno_t sys_as_area_get_info(uintptr_t address, uspace_ptr_as_area_info_t dest)
 {
 	as_area_t *area;
+	as_area_info_t info;
+
+	/* Prevent leaking stack bytes via structure padding. */
+	memset(&info, 0, sizeof(info));
 
 	mutex_lock(&AS->lock);
@@ -2136,10 +2140,12 @@
 	}
 
-	dest->start_addr = area->base;
-	dest->size = P2SZ(area->pages);
-	dest->flags = area->flags;
+	info.start_addr = area->base;
+	info.size = P2SZ(area->pages);
+	info.flags = area->flags;
 
 	mutex_unlock(&area->lock);
 	mutex_unlock(&AS->lock);
+
+	copy_to_uspace(dest, &info, sizeof(info));
 	return EOK;
 }