diff --git a/src/add-ons/kernel/file_systems/bfs/bfs_control.h b/src/add-ons/kernel/file_systems/bfs/bfs_control.h
index f0c6b57f57..48451c3976 100644
--- a/src/add-ons/kernel/file_systems/bfs/bfs_control.h
+++ b/src/add-ons/kernel/file_systems/bfs/bfs_control.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2001-2007, Axel Dörfler, axeld@pinc-software.de
+ * Copyright 2001-2008, Axel Dörfler, axeld@pinc-software.de
  * This file may be used under the terms of the MIT License.
  */
 #ifndef BFS_CONTROL_H
@@ -8,7 +8,11 @@
 //! additional functionality exported via ioctl()
 
 
-#include "system_dependencies.h"
+#ifdef BFS_SHELL
+#	include "system_dependencies.h"
+#else
+#	include <SupportDefs.h>
+#endif
 
 
 /* ioctl to check the version of BFS used - parameter is a uint32 *
@@ -18,6 +22,12 @@
 
 #define BFS_IOCTL_UPDATE_BOOT_BLOCK	14204
 
+struct update_boot_block {
+	uint32			offset;
+	const uint8*	data;
+	uint32			length;
+};
+
 /* ioctls to use the "chkbfs" feature from the outside
  * all calls use a struct check_result as single parameter
  */
diff --git a/src/add-ons/kernel/file_systems/bfs/kernel_interface.cpp b/src/add-ons/kernel/file_systems/bfs/kernel_interface.cpp
index 13d2b95f6a..b7fe147c12 100644
--- a/src/add-ons/kernel/file_systems/bfs/kernel_interface.cpp
+++ b/src/add-ons/kernel/file_systems/bfs/kernel_interface.cpp
@@ -624,9 +624,16 @@ bfs_ioctl(fs_volume* _volume, fs_vnode* _node, void* _cookie, ulong cmd,
 		{
 			// let's makebootable (or anyone else) update the boot block
 			// while BFS is mounted
-			if (user_memcpy(&volume->SuperBlock().pad_to_block,
-					(uint8*)buffer + offsetof(disk_super_block, pad_to_block),
-					sizeof(volume->SuperBlock().pad_to_block)) < B_OK)
+			update_boot_block update;
+			if (bufferLength != sizeof(update_boot_block))
+				return B_BAD_VALUE;
+			if (user_memcpy(&update, buffer, sizeof(update_boot_block)) != B_OK)
+				return B_BAD_ADDRESS;
+			if (update.offset < offsetof(disk_super_block, pad_to_block)
+				|| update.length + update.offset > 512)
+				return B_BAD_VALUE;
+			if (user_memcpy((uint8*)&volume->SuperBlock() + update.offset,
+					update.data, update.length) != B_OK)
 				return B_BAD_ADDRESS;
 
 			return volume->WriteSuperBlock();