--- /dev/null
+From 6c51a336f31c63167beb48bf0512cd13feac70a2 Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Mon, 6 Jun 2011 05:36:06 +0000
+Subject: [PATCH 1/4] xaa: Free the scratch pixmap header before freeing the contents
+
+Some DDX may be sensitive to the ordering and could conceivably continue
+to use the memory freed before FreeScratchPixmapHeader is called.
+
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+---
+ hw/xfree86/xaa/xaaOffscreen.c | 5 ++---
+ 1 files changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/hw/xfree86/xaa/xaaOffscreen.c b/hw/xfree86/xaa/xaaOffscreen.c
+index cd0d9a9..8fa5d6d 100644
+--- a/hw/xfree86/xaa/xaaOffscreen.c
++++ b/hw/xfree86/xaa/xaaOffscreen.c
+@@ -90,12 +90,11 @@ XAAMoveInOffscreenPixmaps(ScreenPtr pScreen)
+ (*pGC->ops->CopyArea)((DrawablePtr)tmpPix, (DrawablePtr)pPix, pGC,
+ 0, 0, pPix->drawable.width, pPix->drawable.height, 0, 0);
+
+- free(data);
+- tmpPix->devPrivate.ptr = NULL;
+-
+ FreeScratchGC(pGC);
+ FreeScratchPixmapHeader(tmpPix);
+
++ free(data);
++
+ pPriv->offscreenArea = area;
+ pLink->area = NULL;
+ pLink = pLink->next;
+--
+1.7.3.4
+