diff --git a/adb/adb.c b/adb/adb.c
index 71b7a8b..cd7f16c 100644
--- a/adb/adb.c
+++ b/adb/adb.c
@@ -401,6 +401,10 @@
         return "bootloader";
     case CS_DEVICE:
         return "device";
+    case CS_RECOVERY:
+        return "recovery";
+    case CS_SIDELOAD:
+        return "sideload";
     case CS_OFFLINE:
         return "offline";
     default:
diff --git a/adb/usb_vendors.c b/adb/usb_vendors.c
index 604c461..698f8a9 100644
--- a/adb/usb_vendors.c
+++ b/adb/usb_vendors.c
@@ -141,6 +141,8 @@
 #define VENDOR_ID_XIAOMI        0x2717
 // BYD's USB Vendor ID
 #define VENDOR_ID_BYD           0x19D1
+// OUYA's USB Vendor ID
+#define VENDOR_ID_OUYA          0x2836
 
 
 /** built-in vendor list */
@@ -198,6 +200,7 @@
     VENDOR_ID_OPPO,
     VENDOR_ID_XIAOMI,
     VENDOR_ID_BYD,
+    VENDOR_ID_OUYA,
 };
 
 #define BUILT_IN_VENDOR_COUNT    (sizeof(builtInVendorIds)/sizeof(builtInVendorIds[0]))
diff --git a/debuggerd/crasher.c b/debuggerd/crasher.c
index 630d980..d88ef88 100644
--- a/debuggerd/crasher.c
+++ b/debuggerd/crasher.c
@@ -17,6 +17,8 @@
 
 #include <cutils/sockets.h>
 
+extern const char* __progname;
+
 void crash1(void);
 void crashnostack(void);
 void maybeabort(void);
@@ -47,22 +49,18 @@
     return *(int*)(&buf[0]);
 }
 
+__attribute__((noinline)) void overflow_stack(void* p) {
+    fprintf(stderr, "p = %p\n", p);
+    void* buf[1];
+    buf[0] = p;
+    overflow_stack(&buf);
+}
+
 void test_call1()
 {
     *((int*) 32) = 1;
 }
 
-void *test_thread(void *x)
-{
-    printf("crasher: thread pid=%d tid=%d\n", getpid(), gettid());
-
-    sleep(1);
-    test_call1();
-    printf("goodbye\n");
-
-    return 0;
-}
-
 void *noisy(void *x)
 {
     char c = (unsigned) x;
@@ -118,35 +116,48 @@
 
 int do_action(const char* arg)
 {
-    if(!strncmp(arg, "thread-", strlen("thread-"))) {
+    fprintf(stderr,"crasher: init pid=%d tid=%d\n", getpid(), gettid());
+
+    if (!strncmp(arg, "thread-", strlen("thread-"))) {
         return do_action_on_thread(arg + strlen("thread-"));
+    } else if (!strcmp(arg,"smash-stack")) {
+        return smash_stack(42);
+    } else if (!strcmp(arg,"stack-overflow")) {
+        overflow_stack(NULL);
+    } else if (!strcmp(arg,"nostack")) {
+        crashnostack();
+    } else if (!strcmp(arg,"ctest")) {
+        return ctest();
+    } else if (!strcmp(arg,"exit")) {
+        exit(1);
+    } else if (!strcmp(arg,"crash")) {
+        return crash(42);
+    } else if (!strcmp(arg,"abort")) {
+        maybeabort();
     }
 
-    if(!strcmp(arg,"smash-stack")) return smash_stack(42);
-    if(!strcmp(arg,"nostack")) crashnostack();
-    if(!strcmp(arg,"ctest")) return ctest();
-    if(!strcmp(arg,"exit")) exit(1);
-    if(!strcmp(arg,"crash")) return crash(42);
-    if(!strcmp(arg,"abort")) maybeabort();
-
-    pthread_t thr;
-    pthread_attr_t attr;
-    pthread_attr_init(&attr);
-    pthread_attr_setdetachstate(&attr, PTHREAD_CREATE_DETACHED);
-    pthread_create(&thr, &attr, test_thread, 0);
-    while(1) sleep(1);
+    fprintf(stderr, "%s OP\n", __progname);
+    fprintf(stderr, "where OP is:\n");
+    fprintf(stderr, "  smash-stack     overwrite a stack-guard canary\n");
+    fprintf(stderr, "  stack-overflow  recurse until the stack overflows\n");
+    fprintf(stderr, "  nostack         crash with a NULL stack pointer\n");
+    fprintf(stderr, "  ctest           (obsoleted by thread-crash?)\n");
+    fprintf(stderr, "  exit            call exit(1)\n");
+    fprintf(stderr, "  crash           cause a SIGSEGV\n");
+    fprintf(stderr, "  abort           call abort()\n");
+    fprintf(stderr, "prefix any of the above with 'thread-' to not run\n");
+    fprintf(stderr, "on the process' main thread.\n");
+    return EXIT_SUCCESS;
 }
 
 int main(int argc, char **argv)
 {
     fprintf(stderr,"crasher: built at " __TIME__ "!@\n");
-    fprintf(stderr,"crasher: init pid=%d tid=%d\n", getpid(), gettid());
 
     if(argc > 1) {
         return do_action(argv[1]);
     } else {
         crash1();
-//        *((int*) 0) = 42;
     }
     
     return 0;
diff --git a/init/devices.c b/init/devices.c
index e25034c..69f5fc8 100644
--- a/init/devices.c
+++ b/init/devices.c
@@ -127,6 +127,7 @@
     char buf[512];
     struct listnode *node;
     struct perms_ *dp;
+    char *secontext;
 
         /* upaths omit the "/sys" that paths in this list
          * contain, so we add 4 when comparing...
@@ -148,6 +149,14 @@
         INFO("fixup %s %d %d 0%o\n", buf, dp->uid, dp->gid, dp->perm);
         chown(buf, dp->uid, dp->gid);
         chmod(buf, dp->perm);
+        if (sehandle) {
+            secontext = NULL;
+            selabel_lookup(sehandle, &secontext, buf, 0);
+            if (secontext) {
+                setfilecon(buf, secontext);
+                freecon(secontext);
+           }
+        }
     }
 }
 
diff --git a/init/property_service.c b/init/property_service.c
index 61dd86f..48488be 100755
--- a/init/property_service.c
+++ b/init/property_service.c
@@ -353,7 +353,11 @@
         __futex_wake(&pa->serial, INT32_MAX);
     } else {
         pa = __system_property_area__;
-        if(pa->count == PA_COUNT_MAX) return -1;
+        if(pa->count == PA_COUNT_MAX) {
+            ERROR("Failed to set '%s'='%s',  property pool is exhausted at %d entries",
+                    name, value, PA_COUNT_MAX);
+            return -1;
+        }
 
         pi = pa_info_array + pa->count;
         pi->serial = (valuelen << 24);
diff --git a/rootdir/init.rc b/rootdir/init.rc
index 5e8970f..4b26f39 100644
--- a/rootdir/init.rc
+++ b/rootdir/init.rc
@@ -37,7 +37,7 @@
     export ANDROID_STORAGE /storage
     export ASEC_MOUNTPOINT /mnt/asec
     export LOOP_MOUNTPOINT /mnt/obb
-    export BOOTCLASSPATH /system/framework/core.jar:/system/framework/okhttp.jar:/system/framework/core-junit.jar:/system/framework/bouncycastle.jar:/system/framework/ext.jar:/system/framework/framework.jar:/system/framework/telephony-common.jar:/system/framework/mms-common.jar:/system/framework/android.policy.jar:/system/framework/services.jar:/system/framework/apache-xml.jar
+    export BOOTCLASSPATH /system/framework/core.jar:/system/framework/conscrypt.jar:/system/framework/okhttp.jar:/system/framework/core-junit.jar:/system/framework/bouncycastle.jar:/system/framework/ext.jar:/system/framework/framework.jar:/system/framework/telephony-common.jar:/system/framework/mms-common.jar:/system/framework/android.policy.jar:/system/framework/services.jar:/system/framework/apache-xml.jar
 
 # Backward compatibility
     symlink /system/etc /etc
diff --git a/toolbox/dd.c b/toolbox/dd.c
index 350f1d2..a8c12d2 100644
--- a/toolbox/dd.c
+++ b/toolbox/dd.c
@@ -590,8 +590,8 @@
 
 	/* If not a pipe or tape device, try to seek on it. */
 	if (!(in.flags & (ISPIPE|ISTAPE))) {
-		if (lseek(in.fd,
-		    (off_t)in.offset * (off_t)in.dbsz, SEEK_CUR) == -1) {
+		if (lseek64(in.fd,
+		    (off64_t)in.offset * (off64_t)in.dbsz, SEEK_CUR) == -1) {
 			fprintf(stderr, "%s: seek error: %s",
 				in.name, strerror(errno));
 			exit(1);
@@ -661,8 +661,8 @@
 	 * have specified the seek operand.
 	 */
 	if (!(out.flags & ISTAPE)) {
-		if (lseek(out.fd,
-		    (off_t)out.offset * (off_t)out.dbsz, SEEK_SET) == -1) {
+		if (lseek64(out.fd,
+		    (off64_t)out.offset * (off64_t)out.dbsz, SEEK_SET) == -1) {
 			fprintf(stderr, "%s: seek error: %s\n",
 				out.name, strerror(errno));
 			exit(1);
diff --git a/toolbox/mount.c b/toolbox/mount.c
index b7adce2..bcda2a2 100644
--- a/toolbox/mount.c
+++ b/toolbox/mount.c
@@ -19,7 +19,7 @@
 #define LOOPDEV_MAXLEN 64
 
 struct mount_opts {
-	const char str[8];
+	const char str[16];
 	unsigned long rwmask;
 	unsigned long rwset;
 	unsigned long rwnoset;
@@ -65,10 +65,11 @@
 static void add_extra_option(struct extra_opts *extra, char *s)
 {
 	int len = strlen(s);
-	int newlen = extra->used_size + len;
+	int newlen;
 
 	if (extra->str)
 	       len++;			/* +1 for ',' */
+	newlen = extra->used_size + len;
 
 	if (newlen >= extra->alloc_size) {
 		char *new;
@@ -79,7 +80,7 @@
 
 		extra->str = new;
 		extra->end = extra->str + extra->used_size;
-		extra->alloc_size = newlen;
+		extra->alloc_size = newlen + 1;
 	}
 
 	if (extra->used_size) {