diff --git a/src/arch/x86_64/paging/mod.rs b/src/arch/x86_64/paging/mod.rs
index 357f47e8e33a5a8bfa5d6bfc8815a73928968401..d523dd0a78a115fe4b7c44f47b5ae78b1511f7df 100644
--- a/src/arch/x86_64/paging/mod.rs
+++ b/src/arch/x86_64/paging/mod.rs
@@ -1,6 +1,8 @@
 //! # Paging
 //! Some code was borrowed from [Phil Opp's Blog](http://os.phil-opp.com/modifying-page-tables.html)
 
+use core::fmt::Debug;
+
 use x86::msr;
 
 pub use rmm::{
@@ -65,7 +67,7 @@ pub unsafe fn init() {
 }
 
 /// Page
-#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
+#[derive(Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
 pub struct Page {
     number: usize,
 }
@@ -102,6 +104,11 @@ impl Page {
         self.number - other.number
     }
 }
+impl Debug for Page {
+    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        write!(f, "[page at {:p}]", self.start_address().data() as *const u8)
+    }
+}
 
 pub struct PageIter {
     start: Page,
diff --git a/src/context/memory.rs b/src/context/memory.rs
index 7f6410b9c9af57d6dbcc3317c2f4b8ffa3d4a015..a9a224118a0905fa750beccf1349fda688a2953f 100644
--- a/src/context/memory.rs
+++ b/src/context/memory.rs
@@ -269,7 +269,7 @@ impl PageSpan {
         self.intersects(Self::new(page, 1))
     }
     pub fn slice(&self, inner_span: PageSpan) -> (Option<PageSpan>, PageSpan, Option<PageSpan>) {
-        todo!()
+        (self.before(inner_span), inner_span, self.after(inner_span))
     }
     pub fn pages(self) -> impl Iterator<Item = Page> {
         (0..self.count).map(move |i| self.base.next_by(i))
@@ -349,12 +349,11 @@ impl UserGrants {
         self
             .inner
             .range(start_span.base..)
-            .take_while(move |(base, info)| !PageSpan::new(**base, info.page_count).intersects(span))
+            .take_while(move |(base, info)| PageSpan::new(**base, info.page_count).intersects(span))
             .map(|(base, info)| (*base, info))
     }
     /// Return a free region with the specified size
     // TODO: Alignment (x86_64: 4 KiB, 2 MiB, or 1 GiB).
-    // TODO: size => page_count
     pub fn find_free(&self, min: usize, page_count: usize) -> Option<PageSpan> {
         // Get first available hole, but do reserve the page starting from zero as most compiled
         // languages cannot handle null pointers safely even if they point to valid memory. If an
@@ -728,8 +727,6 @@ impl Grant {
 
         Some((before_grant, self, after_grant))
     }
-    pub fn rebase(mut self) {
-    }
 }
 impl GrantInfo {
     pub fn flags(&self) -> PageFlags<RmmA> {
@@ -742,7 +739,7 @@ impl GrantInfo {
         self.page_count
     }
     pub fn can_have_flags(&self, flags: MapFlags) -> bool {
-        self.owned || ((self.flags.has_write() && !flags.contains(MapFlags::PROT_WRITE)) && (self.flags.has_execute() && !flags.contains(MapFlags::PROT_EXEC)))
+        self.owned || ((self.flags.has_write() || !flags.contains(MapFlags::PROT_WRITE)) && (self.flags.has_execute() || !flags.contains(MapFlags::PROT_EXEC)))
     }
 
     pub fn can_be_merged_if_adjacent(&self, with: &Self) -> bool {
diff --git a/src/scheme/memory.rs b/src/scheme/memory.rs
index 56caf972691f00f4b7b8dbbc3aa69ebc82711608..c071add5eba9c98b490ee18ccf77d61b5ad28a18 100644
--- a/src/scheme/memory.rs
+++ b/src/scheme/memory.rs
@@ -5,8 +5,9 @@ use rmm::PhysicalAddress;
 use spin::RwLock;
 use syscall::MapFlags;
 
-use crate::context::memory::{AddrSpace, Grant};
+use crate::context::memory::{AddrSpace, Grant, PageSpan};
 use crate::memory::{free_frames, used_frames, PAGE_SIZE, Frame};
+use crate::paging::VirtualAddress;
 
 use crate::paging::entry::EntryFlags;
 use crate::syscall::data::{Map, StatVfs};
@@ -55,12 +56,12 @@ impl MemoryScheme {
     }
 
     pub fn fmap_anonymous(addr_space: &Arc<RwLock<AddrSpace>>, map: &Map) -> Result<usize> {
-        let (requested_page, page_count) = crate::syscall::usercopy::validate_region(map.address, map.size)?;
-        let page_count = NonZeroUsize::new(page_count).ok_or(Error::new(EINVAL))?;
+        let span = PageSpan::validate_nonempty(VirtualAddress::new(map.address), map.size).ok_or(Error::new(EINVAL))?;
+        let page_count = NonZeroUsize::new(span.count).ok_or(Error::new(EINVAL))?;
 
         let page = addr_space
             .write()
-            .mmap((map.address != 0).then_some(requested_page), page_count, map.flags, |page, flags, mapper, flusher| {
+            .mmap((map.address != 0).then_some(span.base), page_count, map.flags, |page, flags, mapper, flusher| {
                 Ok(Grant::zeroed(page, page_count.get(), flags, mapper, flusher)?)
             })?;
 
diff --git a/src/scheme/sys/context.rs b/src/scheme/sys/context.rs
index 9909f7a8788a19841410b1f1b7348c90dae0da26..c3b235ec85245cad241f4a8c602c5a1e09d9baa6 100644
--- a/src/scheme/sys/context.rs
+++ b/src/scheme/sys/context.rs
@@ -85,7 +85,7 @@ pub fn resource() -> Result<Vec<u8>> {
                 memory += kstack.len();
             }
             if let Ok(addr_space) = context.addr_space() {
-                for (base, info) in addr_space.read().grants.iter() {
+                for (_base, info) in addr_space.read().grants.iter() {
                     if info.is_owned() {
                         memory += info.page_count() * PAGE_SIZE;
                     }
diff --git a/src/syscall/process.rs b/src/syscall/process.rs
index 02dd36c4f7c70eaf59912f2993f3a8460bd46818..c228fcb2f2761c74264e554d01cb50c452dabca8 100644
--- a/src/syscall/process.rs
+++ b/src/syscall/process.rs
@@ -13,7 +13,7 @@ use crate::Bootstrap;
 use crate::context;
 use crate::interrupt;
 use crate::paging::mapper::{InactiveFlusher, PageFlushAll};
-use crate::paging::{Page, PageFlags, VirtualAddress, PAGE_SIZE};
+use crate::paging::{Page, PageFlags, VirtualAddress};
 use crate::ptrace;
 use crate::start::usermode;
 use crate::syscall::data::SigAction;