diff --git a/dlls/ntdll/exception.c b/dlls/ntdll/exception.c
index 6ec746a..a99bf8e 100644
--- a/dlls/ntdll/exception.c
+++ b/dlls/ntdll/exception.c
@@ -95,11 +95,14 @@
     int ret;
     SERVER_START_REQ
     {
-        struct exception_event_request *req = server_alloc_req( sizeof(*req), 0 );
-        req->record  = *rec;
+        struct exception_event_request *req = server_alloc_req( sizeof(*req),
+                                                                sizeof(*rec)+sizeof(*context) );
+        CONTEXT *context_ptr = server_data_ptr(req);
+        EXCEPTION_RECORD *rec_ptr = (EXCEPTION_RECORD *)(context_ptr + 1);
         req->first   = first_chance;
-        req->context = *context;
-        if (!server_call_noerr( REQ_EXCEPTION_EVENT )) *context = req->context;
+        *rec_ptr     = *rec;
+        *context_ptr = *context;
+        if (!server_call_noerr( REQ_EXCEPTION_EVENT )) *context = *context_ptr;
         ret = req->status;
     }
     SERVER_END_REQ;
diff --git a/dlls/winsock/socket.c b/dlls/winsock/socket.c
index 41eee91..7ffb0a8 100644
--- a/dlls/winsock/socket.c
+++ b/dlls/winsock/socket.c
@@ -86,6 +86,7 @@
 #include "wine/port.h"
 #include "services.h"
 #include "server.h"
+#include "file.h"
 #include "debugtools.h"
 
 
@@ -222,11 +223,7 @@
 
 static int _get_sock_fd(SOCKET s)
 {
-    struct get_read_fd_request *req = get_req_buffer();
-    int fd;
-    
-    req->handle = s;
-    server_call_fd( REQ_GET_READ_FD, -1, &fd );
+    int fd = FILE_GetUnixHandle( s, GENERIC_READ );
     if (fd == -1)
         FIXME("handle %d is not a socket (GLE %ld)\n",s,GetLastError());
     return fd;    
@@ -235,37 +232,53 @@
 static void _enable_event(SOCKET s, unsigned int event,
 			  unsigned int sstate, unsigned int cstate)
 {
-    struct enable_socket_event_request *req = get_req_buffer();
-    
-    req->handle = s;
-    req->mask   = event;
-    req->sstate = sstate;
-    req->cstate = cstate;
-    sock_server_call( REQ_ENABLE_SOCKET_EVENT );
+    SERVER_START_REQ
+    {
+        struct enable_socket_event_request *req = server_alloc_req( sizeof(*req), 0 );
+
+        req->handle = s;
+        req->mask   = event;
+        req->sstate = sstate;
+        req->cstate = cstate;
+        sock_server_call( REQ_ENABLE_SOCKET_EVENT );
+    }
+    SERVER_END_REQ;
 }
 
 static int _is_blocking(SOCKET s)
 {
-    struct get_socket_event_request *req = get_req_buffer();
-    
-    req->handle  = s;
-    req->service = FALSE;
-    req->s_event = 0;
-    req->c_event = 0;
-    sock_server_call( REQ_GET_SOCKET_EVENT );
-    return (req->state & WS_FD_NONBLOCKING) == 0;
+    int ret;
+    SERVER_START_REQ
+    {
+        struct get_socket_event_request *req = server_alloc_req( sizeof(*req), 0 );
+
+        req->handle  = s;
+        req->service = FALSE;
+        req->s_event = 0;
+        req->c_event = 0;
+        sock_server_call( REQ_GET_SOCKET_EVENT );
+        ret = (req->state & WS_FD_NONBLOCKING) == 0;
+    }
+    SERVER_END_REQ;
+    return ret;
 }
 
 static unsigned int _get_sock_mask(SOCKET s)
 {
-    struct get_socket_event_request *req = get_req_buffer();
-    
-    req->handle  = s;
-    req->service = FALSE;
-    req->s_event = 0;
-    req->c_event = 0;
-    sock_server_call( REQ_GET_SOCKET_EVENT );
-    return req->mask;
+    unsigned int ret;
+    SERVER_START_REQ
+    {
+        struct get_socket_event_request *req = server_alloc_req( sizeof(*req), 0 );
+
+        req->handle  = s;
+        req->service = FALSE;
+        req->s_event = 0;
+        req->c_event = 0;
+        sock_server_call( REQ_GET_SOCKET_EVENT );
+        ret = req->mask;
+    }
+    SERVER_END_REQ;
+    return ret;
 }
 
 static void _sync_sock_state(SOCKET s)
@@ -277,14 +290,20 @@
 
 static int _get_sock_error(SOCKET s, unsigned int bit)
 {
-    struct get_socket_event_request *req = get_req_buffer();
-    
-    req->handle  = s;
-    req->service = FALSE;
-    req->s_event = 0;
-    req->c_event = 0;
-    sock_server_call( REQ_GET_SOCKET_EVENT );
-    return req->errors[bit];
+    int ret;
+    SERVER_START_REQ
+    {
+        struct get_socket_event_request *req = server_alloc_req( sizeof(*req),
+                                                                 FD_MAX_EVENTS*sizeof(int) );
+        req->handle  = s;
+        req->service = FALSE;
+        req->s_event = 0;
+        req->c_event = 0;
+        sock_server_call( REQ_GET_SOCKET_EVENT );
+        ret = *((int *)server_data_ptr(req) + bit);
+    }
+    SERVER_END_REQ;
+    return ret;
 }
 
 static LPWSINFO lpFirstIData = NULL;
@@ -803,12 +822,12 @@
 #ifdef HAVE_IPX
     struct ws_sockaddr_ipx*  addr2 = (struct ws_sockaddr_ipx *)addr;
 #endif
-    struct accept_socket_request *req = get_req_buffer();
 
     TRACE("(%08x): socket %04x\n", 
 				  (unsigned)pwsi, (UINT16)s ); 
     if( _check_ws(pwsi, s) )
     {
+        SOCKET as;
 	if (_is_blocking(s))
 	{
 	    /* block here */
@@ -820,13 +839,19 @@
 	    SetLastError(_get_sock_error(s, FD_ACCEPT_BIT));
 	    /* FIXME: care about the error? */
 	}
-	req->lhandle = s;
-	req->access  = GENERIC_READ|GENERIC_WRITE|SYNCHRONIZE;
-	req->inherit = TRUE;
-	sock_server_call( REQ_ACCEPT_SOCKET );
-	if( req->handle >= 0 )
+        SERVER_START_REQ
+        {
+            struct accept_socket_request *req = server_alloc_req( sizeof(*req), 0 );
+
+            req->lhandle = s;
+            req->access  = GENERIC_READ|GENERIC_WRITE|SYNCHRONIZE;
+            req->inherit = TRUE;
+            sock_server_call( REQ_ACCEPT_SOCKET );
+            as = req->handle;
+        }
+        SERVER_END_REQ;
+	if( as >= 0 )
 	{
-	    SOCKET as = req->handle;
 	    unsigned omask = _get_sock_mask( s );
 	    int fd = _get_sock_fd( as );
 	    if( getpeername(fd, addr, addrlen32) != -1 )
@@ -2152,7 +2177,7 @@
 SOCKET WINAPI WSOCK32_socket(INT af, INT type, INT protocol)
 {
   LPWSINFO      pwsi = WINSOCK_GetIData();
-  struct create_socket_request *req = get_req_buffer();
+  SOCKET ret;
 
   TRACE("(%08x): af=%d type=%d protocol=%d\n", 
 			  (unsigned)pwsi, af, type, protocol);
@@ -2195,17 +2220,22 @@
           default: SetLastError(WSAEPROTOTYPE); return INVALID_SOCKET;
         }
 
-    req->family   = af;
-    req->type     = type;
-    req->protocol = protocol;
-    req->access   = GENERIC_READ|GENERIC_WRITE|SYNCHRONIZE;
-    req->inherit  = TRUE;
-    sock_server_call( REQ_CREATE_SOCKET );
-    if ( req->handle >= 0)
+    SERVER_START_REQ
     {
-	TRACE("\tcreated %04x\n", req->handle);
-
-	return req->handle;
+        struct create_socket_request *req = server_alloc_req( sizeof(*req), 0 );
+        req->family   = af;
+        req->type     = type;
+        req->protocol = protocol;
+        req->access   = GENERIC_READ|GENERIC_WRITE|SYNCHRONIZE;
+        req->inherit  = TRUE;
+        sock_server_call( REQ_CREATE_SOCKET );
+        ret = req->handle;
+    }
+    SERVER_END_REQ;
+    if ( ret >= 0)
+    {
+        TRACE("\tcreated %04x\n", ret );
+        return ret;
     }
 
     if (GetLastError() == WSAEACCES) /* raw socket denied */
@@ -2518,20 +2548,25 @@
 int WINAPI WSAEnumNetworkEvents(SOCKET s, WSAEVENT hEvent, LPWSANETWORKEVENTS lpEvent)
 {
     LPWSINFO      pwsi = WINSOCK_GetIData();
-    struct get_socket_event_request *req = get_req_buffer();
 
     TRACE("(%08x): %08x, hEvent %08x, lpEvent %08x\n",
 			  (unsigned)pwsi, s, hEvent, (unsigned)lpEvent );
     if( _check_ws(pwsi, s) )
     {
-	req->handle  = s;
-	req->service = TRUE;
-	req->s_event = 0;
-	req->c_event = hEvent;
-	sock_server_call( REQ_GET_SOCKET_EVENT );
-	lpEvent->lNetworkEvents = req->pmask;
-	memcpy(lpEvent->iErrorCode, req->errors, sizeof(lpEvent->iErrorCode));
-	return 0;
+        SERVER_START_REQ
+        {
+            struct get_socket_event_request *req = server_alloc_req( sizeof(*req),
+                                                                     sizeof(lpEvent->iErrorCode) );
+            req->handle  = s;
+            req->service = TRUE;
+            req->s_event = 0;
+            req->c_event = hEvent;
+            sock_server_call( REQ_GET_SOCKET_EVENT );
+            lpEvent->lNetworkEvents = req->pmask;
+            memcpy(lpEvent->iErrorCode, server_data_ptr(req), server_data_size(req) );
+        }
+        SERVER_END_REQ;
+        return 0;
     }
     else SetLastError(WSAEINVAL);
     return SOCKET_ERROR; 
@@ -2543,17 +2578,21 @@
 int WINAPI WSAEventSelect(SOCKET s, WSAEVENT hEvent, LONG lEvent)
 {
     LPWSINFO      pwsi = WINSOCK_GetIData();
-    struct set_socket_event_request *req = get_req_buffer();
 
     TRACE("(%08x): %08x, hEvent %08x, event %08x\n",
 			  (unsigned)pwsi, s, hEvent, (unsigned)lEvent );
     if( _check_ws(pwsi, s) )
     {
-	req->handle = s;
-	req->mask   = lEvent;
-	req->event  = hEvent;
-	sock_server_call( REQ_SET_SOCKET_EVENT );
-	return 0;
+        SERVER_START_REQ
+        {
+            struct set_socket_event_request *req = server_alloc_req( sizeof(*req), 0 );
+            req->handle = s;
+            req->mask   = lEvent;
+            req->event  = hEvent;
+            sock_server_call( REQ_SET_SOCKET_EVENT );
+        }
+        SERVER_END_REQ;
+        return 0;
     }
     else SetLastError(WSAEINVAL);
     return SOCKET_ERROR; 
@@ -2567,23 +2606,30 @@
 {
     ws_select_info *info = (ws_select_info*)ptr;
     LPWSINFO      pwsi = info->pwsi;
-    struct get_socket_event_request *req = get_req_buffer();
     unsigned int i, pmask, orphan = FALSE;
+    int errors[FD_MAX_EVENTS];
 
     TRACE("socket %08x, event %08x\n", info->sock, info->event);
     SetLastError(0);
-    req->handle  = info->sock;
-    req->service = TRUE;
-    req->s_event = info->event; /* <== avoid race conditions */
-    req->c_event = info->event;
-    sock_server_call( REQ_GET_SOCKET_EVENT );
+    SERVER_START_REQ
+    {
+        struct get_socket_event_request *req = server_alloc_req( sizeof(*req), sizeof(errors) );
+        req->handle  = info->sock;
+        req->service = TRUE;
+        req->s_event = info->event; /* <== avoid race conditions */
+        req->c_event = info->event;
+        sock_server_call( REQ_GET_SOCKET_EVENT );
+        pmask = req->pmask;
+        memcpy( errors, server_data_ptr(req), server_data_size(req) );
+    }
+    SERVER_END_REQ;
     if ( (GetLastError() == WSAENOTSOCK) || (GetLastError() == WSAEINVAL) )
     {
 	/* orphaned event (socket closed or something) */
 	pmask = WS_FD_SERVEVENT;
 	orphan = TRUE;
-    } else
-	pmask = req->pmask;
+    }
+
     /* check for accepted sockets that needs to inherit WSAAsyncSelect */
     if (pmask & WS_FD_SERVEVENT) {
 	int q;
@@ -2602,9 +2648,9 @@
     /* dispatch network events */
     for (i=0; i<FD_MAX_EVENTS; i++)
 	if (pmask & (1<<i)) {
-	    TRACE("post: event bit %d, error %d\n", i, req->errors[i]);
+	    TRACE("post: event bit %d, error %d\n", i, errors[i]);
 	    PostMessageA(info->hWnd, info->uMsg, info->sock,
-			 WSAMAKESELECTREPLY(1<<i, req->errors[i]));
+			 WSAMAKESELECTREPLY(1<<i, errors[i]));
 	}
     /* cleanup */
     if (orphan)
diff --git a/files/dos_fs.c b/files/dos_fs.c
index a11dab2..f4f099a 100644
--- a/files/dos_fs.c
+++ b/files/dos_fs.c
@@ -621,16 +621,21 @@
  */
 const DOS_DEVICE *DOSFS_GetDeviceByHandle( HFILE hFile )
 {
-    struct get_file_info_request *req = get_req_buffer();
-
-    req->handle = hFile;
-    if (!server_call( REQ_GET_FILE_INFO ) && (req->type == FILE_TYPE_UNKNOWN))
+    const DOS_DEVICE *ret = NULL;
+    SERVER_START_REQ
     {
-        if ((req->attr >= 0) &&
-            (req->attr < sizeof(DOSFS_Devices)/sizeof(DOSFS_Devices[0])))
-            return &DOSFS_Devices[req->attr];
+        struct get_file_info_request *req = server_alloc_req( sizeof(*req), 0 );
+
+        req->handle = hFile;
+        if (!server_call( REQ_GET_FILE_INFO ) && (req->type == FILE_TYPE_UNKNOWN))
+        {
+            if ((req->attr >= 0) &&
+                (req->attr < sizeof(DOSFS_Devices)/sizeof(DOSFS_Devices[0])))
+                ret = &DOSFS_Devices[req->attr];
+        }
     }
-    return NULL;
+    SERVER_END_REQ;
+    return ret;
 }
 
 
diff --git a/files/file.c b/files/file.c
index c619724..38cd03b 100644
--- a/files/file.c
+++ b/files/file.c
@@ -319,6 +319,31 @@
 
 
 /***********************************************************************
+ *           FILE_GetUnixHandle
+ *
+ * Retrieve the Unix handle corresponding to a file handle.
+ */
+int FILE_GetUnixHandle( HANDLE handle, DWORD access )
+{
+    int unix_handle = -1;
+    if (access == GENERIC_READ)
+    {
+        struct get_read_fd_request *req = get_req_buffer();
+        req->handle = handle;
+        server_call_fd( REQ_GET_READ_FD, -1, &unix_handle );
+    }
+    else if (access == GENERIC_WRITE)
+    {
+        struct get_write_fd_request *req = get_req_buffer();
+        req->handle = handle;
+        server_call_fd( REQ_GET_WRITE_FD, -1, &unix_handle );
+    }
+    else ERR( "bad access %08lx\n", access );
+    return unix_handle;
+}
+
+
+/***********************************************************************
  *           FILE_CreateFile
  *
  * Implementation of CreateFile. Takes a Unix path name.
@@ -328,21 +353,35 @@
                         DWORD attributes, HANDLE template, BOOL fail_read_only )
 {
     DWORD err;
-    struct create_file_request *req = get_req_buffer();
+    HANDLE ret;
+    size_t len = strlen(filename);
+
+    if (len > REQUEST_MAX_VAR_SIZE)
+    {
+        FIXME("filename '%s' too long\n", filename );
+        SetLastError( ERROR_INVALID_PARAMETER );
+        return -1;
+    }
 
  restart:
-    req->access  = access;
-    req->inherit = (sa && (sa->nLength>=sizeof(*sa)) && sa->bInheritHandle);
-    req->sharing = sharing;
-    req->create  = creation;
-    req->attrs   = attributes;
-    lstrcpynA( req->name, filename, server_remaining(req->name) );
-    SetLastError(0);
-    err = server_call( REQ_CREATE_FILE );
+    SERVER_START_REQ
+    {
+        struct create_file_request *req = server_alloc_req( sizeof(*req), len );
+        req->access  = access;
+        req->inherit = (sa && (sa->nLength>=sizeof(*sa)) && sa->bInheritHandle);
+        req->sharing = sharing;
+        req->create  = creation;
+        req->attrs   = attributes;
+        memcpy( server_data_ptr(req), filename, len );
+        SetLastError(0);
+        err = server_call( REQ_CREATE_FILE );
+        ret = req->handle;
+    }
+    SERVER_END_REQ;
 
     /* If write access failed, retry without GENERIC_WRITE */
 
-    if ((req->handle == -1) && !fail_read_only && (access & GENERIC_WRITE)) 
+    if ((ret == -1) && !fail_read_only && (access & GENERIC_WRITE)) 
     {
 	if ((err == STATUS_MEDIA_WRITE_PROTECTED) || (err == STATUS_ACCESS_DENIED))
         {
@@ -353,11 +392,11 @@
         }
     }
 
-    if (req->handle == -1)
+    if (ret == -1)
 	WARN("Unable to create file '%s' (GLE %ld)\n", filename,
 	     GetLastError());
 
-    return req->handle;
+    return ret;
 }
 
 
@@ -1140,7 +1179,6 @@
 BOOL WINAPI ReadFile( HANDLE hFile, LPVOID buffer, DWORD bytesToRead,
                         LPDWORD bytesRead, LPOVERLAPPED overlapped )
 {
-    struct get_read_fd_request *req = get_req_buffer();
     int unix_handle, result;
 
     TRACE("%d %p %ld\n", hFile, buffer, bytesToRead );
@@ -1153,8 +1191,7 @@
       return FALSE;
     }
 
-    req->handle = hFile;
-    server_call_fd( REQ_GET_READ_FD, -1, &unix_handle );
+    unix_handle = FILE_GetUnixHandle( hFile, GENERIC_READ );
     if (unix_handle == -1) return FALSE;
     while ((result = read( unix_handle, buffer, bytesToRead )) == -1)
     {
@@ -1176,7 +1213,6 @@
 BOOL WINAPI WriteFile( HANDLE hFile, LPCVOID buffer, DWORD bytesToWrite,
                          LPDWORD bytesWritten, LPOVERLAPPED overlapped )
 {
-    struct get_write_fd_request *req = get_req_buffer();
     int unix_handle, result;
 
     TRACE("%d %p %ld\n", hFile, buffer, bytesToWrite );
@@ -1189,8 +1225,7 @@
       return FALSE;
     }
 
-    req->handle = hFile;
-    server_call_fd( REQ_GET_WRITE_FD, -1, &unix_handle );
+    unix_handle = FILE_GetUnixHandle( hFile, GENERIC_WRITE );
     if (unix_handle == -1) return FALSE;
     while ((result = write( unix_handle, buffer, bytesToWrite )) == -1)
     {
diff --git a/include/file.h b/include/file.h
index 9cca731..6303c74 100644
--- a/include/file.h
+++ b/include/file.h
@@ -33,6 +33,7 @@
 /* files/file.c */
 extern void FILE_SetDosError(void);
 extern HFILE FILE_DupUnixHandle( int fd, DWORD access );
+extern int FILE_GetUnixHandle( HANDLE handle, DWORD access );
 extern BOOL FILE_Stat( LPCSTR unixName, BY_HANDLE_FILE_INFORMATION *info );
 extern HFILE16 FILE_Dup2( HFILE16 hFile1, HFILE16 hFile2 );
 extern HANDLE FILE_CreateFile( LPCSTR filename, DWORD access, DWORD sharing,
diff --git a/include/server.h b/include/server.h
index 777f396..04046f8 100644
--- a/include/server.h
+++ b/include/server.h
@@ -41,6 +41,9 @@
     int pad[16]; /* the max request size is 16 ints */
 };
 
+/* max size of the variable part of a request */
+#define REQUEST_MAX_VAR_SIZE  1024
+
 /* a path name for server requests (Unicode) */
 typedef WCHAR path_t[MAX_PATH+1];
 
@@ -131,7 +134,7 @@
     IN  int          hstderr;      /* handle for stderr */
     IN  int          cmd_show;     /* main window show mode */
     IN  int          alloc_fd;     /* create the fd pair right now? */
-    IN  char         filename[1];  /* file name of main exe */
+    IN  VARARG(filename,string);   /* file name of main exe */
 };
 
 
@@ -183,7 +186,7 @@
     OUT int          hstdout;      /* handle for stdout */
     OUT int          hstderr;      /* handle for stderr */
     OUT int          cmd_show;     /* main window show mode */
-    OUT char         filename[1];  /* file name of main exe */
+    OUT VARARG(filename,string);   /* file name of main exe */
 };
 
 
@@ -529,7 +532,7 @@
     IN  int          create;        /* file create action */
     IN  unsigned int attrs;         /* file attributes for creation */
     OUT int          handle;        /* handle to the file */
-    IN  char         name[1];       /* file name */
+    IN  VARARG(filename,string);    /* file name */
 };
 
 
@@ -694,7 +697,7 @@
     OUT unsigned int mask;          /* event mask */
     OUT unsigned int pmask;         /* pending events */
     OUT unsigned int state;         /* status bits */
-    OUT int          errors[1];     /* event errors */
+    OUT VARARG(errors,ints);        /* event errors */
 };
 
 
@@ -774,7 +777,7 @@
     IN  int          mask;          /* setting mask (see below) */
     IN  int          cursor_size;   /* size of cursor (percentage filled) */
     IN  int          cursor_visible;/* cursor visibility flag */
-    IN  char         title[1];      /* console title */
+    IN  VARARG(title,string);       /* console title */
 };
 #define SET_CONSOLE_INFO_CURSOR 0x01
 #define SET_CONSOLE_INFO_TITLE  0x02
@@ -787,7 +790,7 @@
     OUT int          cursor_size;   /* size of cursor (percentage filled) */
     OUT int          cursor_visible;/* cursor visibility flag */
     OUT int          pid;           /* pid of xterm (hack) */
-    OUT char         title[1];      /* console title */
+    OUT VARARG(title,string);       /* console title */
 };
 
 
@@ -796,9 +799,8 @@
 {
     REQUEST_HEADER;                 /* request header */
     IN  int          handle;        /* handle to the console input */
-    IN  int          count;         /* number of input records */
     OUT int          written;       /* number of records written */
- /* INPUT_RECORD records[0]; */     /* input records */
+    IN  VARARG(rec,input_records);  /* input records */
 };
 
 /* Fetch input records from a console input queue */
@@ -806,10 +808,9 @@
 {
     REQUEST_HEADER;                 /* request header */
     IN  int          handle;        /* handle to the console input */
-    IN  int          count;         /* max number of records to retrieve */
     IN  int          flush;         /* flush the retrieved records from the queue? */
     OUT int          read;          /* number of records read */
- /* INPUT_RECORD records[0]; */     /* input records */
+    OUT VARARG(rec,input_records);  /* input records */
 };
 
 
@@ -947,10 +948,10 @@
 struct exception_event_request
 {
     REQUEST_HEADER;                /* request header */
-    IN  EXCEPTION_RECORD record;   /* exception record */
     IN  int              first;    /* first chance exception? */
-    IN  CONTEXT          context;  /* thread context */
     OUT int              status;   /* event continuation status */
+    IN  VARARG(record,exc_event);  /* thread context followed by exception record */
+    OUT VARARG(context,context);   /* modified thread context */
 };
 
 
@@ -1213,7 +1214,7 @@
     REQUEST_HEADER;                /* request header */
     IN  int          handle;       /* thread handle */
     IN  unsigned int flags;        /* context flags */
-    OUT CONTEXT      context;      /* thread context */
+    OUT VARARG(context,context);   /* thread context */
 };
 
 
@@ -1223,7 +1224,7 @@
     REQUEST_HEADER;                /* request header */
     IN  int          handle;       /* thread handle */
     IN  unsigned int flags;        /* context flags */
-    IN  CONTEXT      context;      /* thread context */
+    IN  VARARG(context,context);   /* thread context */
 };
 
 
@@ -1540,7 +1541,7 @@
     struct wait_input_idle_request wait_input_idle;
 };
 
-#define SERVER_PROTOCOL_VERSION 19
+#define SERVER_PROTOCOL_VERSION 20
 
 /* ### make_requests end ### */
 /* Everything above this line is generated automatically by tools/make_requests */
diff --git a/loader/dos/module.c b/loader/dos/module.c
index 7892d46..f75d85a 100644
--- a/loader/dos/module.c
+++ b/loader/dos/module.c
@@ -33,10 +33,9 @@
 #include "dosexe.h"
 #include "dosmod.h"
 #include "options.h"
-#include "server.h"
 #include "vga.h"
 
-DEFAULT_DEBUG_CHANNEL(module)
+DEFAULT_DEBUG_CHANNEL(module);
 
 #ifdef MZ_SUPPORTED
 
@@ -378,8 +377,6 @@
   int write_fd[2],x_fd;
   pid_t child;
   char *fname,*farg,arg[16],fproc[64],path[256],*fpath;
-  struct get_read_fd_request *r_req = get_req_buffer();
-  struct get_write_fd_request *w_req = get_req_buffer();
 
   if (!lpDosTask) return FALSE;
   /* create pipes */
@@ -390,10 +387,8 @@
     return FALSE;
   }
 
-  r_req->handle = lpDosTask->hReadPipe;
-  server_call_fd( REQ_GET_READ_FD, -1, &lpDosTask->read_pipe );
-  w_req->handle = lpDosTask->hXPipe;
-  server_call_fd( REQ_GET_WRITE_FD, -1, &x_fd );
+  lpDosTask->read_pipe = FILE_GetUnixHandle( lpDosTask->hReadPipe, GENERIC_READ );
+  x_fd = FILE_GetUnixHandle( lpDosTask->hXPipe, GENERIC_WRITE );
 
   TRACE("win32 pipe: read=%d, write=%d, unix pipe: read=%d, write=%d\n",
 	       lpDosTask->hReadPipe,lpDosTask->hXPipe,lpDosTask->read_pipe,x_fd);
diff --git a/memory/virtual.c b/memory/virtual.c
index 8eda710..eb345a7 100644
--- a/memory/virtual.c
+++ b/memory/virtual.c
@@ -471,10 +471,7 @@
 
     if (shared_size)
     {
-        struct get_read_fd_request *req = get_req_buffer();
-        req->handle = shared_file;
-        server_call_fd( REQ_GET_READ_FD, -1, &shared_fd );
-        if (shared_fd == -1) goto error;
+        if ((shared_fd = FILE_GetUnixHandle( shared_file, GENERIC_READ )) == -1) goto error;
         CloseHandle( shared_file );  /* we no longer need it */
         shared_file = INVALID_HANDLE_VALUE; 
     }
diff --git a/misc/comm.c b/misc/comm.c
index f93aef8..33a8f50 100644
--- a/misc/comm.c
+++ b/misc/comm.c
@@ -1620,13 +1620,9 @@
  *  Returns a file descriptor for reading.
  *  Make sure to close the handle afterwards!
  */
-static int COMM_GetReadFd( HANDLE handle)
+inline static int COMM_GetReadFd( HANDLE handle)
 {
-    int fd;
-    struct get_read_fd_request *req = get_req_buffer();
-    req->handle = handle;
-    server_call_fd( REQ_GET_READ_FD, -1, &fd );
-    return fd;
+    return FILE_GetUnixHandle( handle, GENERIC_READ );
 }
 
 /*****************************************************************************
@@ -1634,13 +1630,9 @@
  *  Returns a file descriptor for writing.
  *  Make sure to close the handle afterwards!
  */
-static int COMM_GetWriteFd( HANDLE handle)
+inline static int COMM_GetWriteFd( HANDLE handle)
 {
-    int fd = -1;
-    struct get_write_fd_request *req = get_req_buffer();
-    req->handle = handle;
-    server_call_fd( REQ_GET_WRITE_FD, -1, &fd );
-    return fd;
+    return FILE_GetUnixHandle( handle, GENERIC_WRITE );
 }
 
 /* FIXME: having these global for win32 for now */
diff --git a/scheduler/client.c b/scheduler/client.c
index 03d4afe..4fb8318 100644
--- a/scheduler/client.c
+++ b/scheduler/client.c
@@ -133,6 +133,7 @@
     size_t size = sizeof(*req) + var_size;
 
     assert( fixed_size <= sizeof(*req) );
+    assert( var_size <= REQUEST_MAX_VAR_SIZE );
 
     if ((char *)req + size > (char *)NtCurrentTeb()->buffer_info)
         server_protocol_error( "buffer overflow %d bytes\n",
diff --git a/scheduler/process.c b/scheduler/process.c
index a82486d..1c4bb0a 100644
--- a/scheduler/process.c
+++ b/scheduler/process.c
@@ -39,7 +39,7 @@
 PDB current_process;
 
 static char **main_exe_argv;
-static char *main_exe_name;
+static char main_exe_name[MAX_PATH];
 static HFILE main_exe_file = -1;
 
 
@@ -185,15 +185,18 @@
     /* Retrieve startup info from the server */
     SERVER_START_REQ
     {
-        struct init_process_request *req = server_alloc_req( sizeof(*req), 0 );
+        struct init_process_request *req = server_alloc_req( sizeof(*req),
+                                                             sizeof(main_exe_name)-1 );
 
         req->ldt_copy  = ldt_copy;
         req->ldt_flags = ldt_flags_copy;
         req->ppid      = getppid();
         if ((ret = !server_call( REQ_INIT_PROCESS )))
         {
-            main_exe_file               = req->exe_file;
-            if (req->filename[0]) main_exe_name = strdup( req->filename );
+            size_t len = server_data_size( req );
+            memcpy( main_exe_name, server_data_ptr(req), len );
+            main_exe_name[len] = 0;
+            main_exe_file = req->exe_file;
             current_startupinfo.dwFlags     = req->start_flags;
             current_startupinfo.wShowWindow = req->cmd_show;
             current_envdb.hStdin   = current_startupinfo.hStdInput  = req->hstdin;
@@ -367,17 +370,16 @@
  *           PROCESS_Start
  *
  * Startup routine of a new Win32 process once the main module has been loaded.
- * The filename is free'd by this routine.
  */
-static void PROCESS_Start( HMODULE main_module, HFILE hFile, LPSTR filename ) WINE_NORETURN;
-static void PROCESS_Start( HMODULE main_module, HFILE hFile, LPSTR filename )
+static void PROCESS_Start( HMODULE main_module, HFILE hFile, LPCSTR filename ) WINE_NORETURN;
+static void PROCESS_Start( HMODULE main_module, HFILE hFile, LPCSTR filename )
 {
     if (!filename)
     {
         /* if no explicit filename, use argv[0] */
-        if (!(filename = malloc( MAX_PATH ))) ExitProcess(1);
-        if (!GetLongPathNameA( full_argv0, filename, MAX_PATH ))
-            lstrcpynA( filename, full_argv0, MAX_PATH );
+        filename = main_exe_name;
+        if (!GetLongPathNameA( full_argv0, main_exe_name, sizeof(main_exe_name) ))
+            lstrcpynA( main_exe_name, full_argv0, sizeof(main_exe_name) );
     }
 
     /* load main module */
@@ -387,7 +389,6 @@
     /* Create 32-bit MODREF */
     if (!PE_CreateModule( main_module, filename, 0, hFile, FALSE ))
         goto error;
-    free( filename );
 
     /* allocate main thread stack */
     if (!THREAD_InitStack( NtCurrentTeb(),
@@ -416,23 +417,17 @@
 
     main_exe_argv = ++argv;  /* remove argv[0] (wine itself) */
 
-    if (!main_exe_name)
+    if (!main_exe_name[0])
     {
-        char buffer[MAX_PATH];
         if (!argv[0]) OPTIONS_Usage();
 
         /* open the exe file */
-        if (!SearchPathA( NULL, argv[0], ".exe", sizeof(buffer), buffer, NULL ) &&
-            !SearchPathA( NULL, argv[0], NULL, sizeof(buffer), buffer, NULL ))
+        if (!SearchPathA( NULL, argv[0], ".exe", sizeof(main_exe_name), main_exe_name, NULL ) &&
+            !SearchPathA( NULL, argv[0], NULL, sizeof(main_exe_name), main_exe_name, NULL ))
         {
             MESSAGE( "%s: cannot find '%s'\n", argv0, argv[0] );
             goto error;
         }
-        if (!(main_exe_name = strdup(buffer)))
-        {
-            MESSAGE( "%s: out of memory\n", argv0 );
-            ExitProcess(1);
-        }
     }
 
     if (main_exe_file == INVALID_HANDLE_VALUE)
@@ -723,54 +718,64 @@
     const char *unixdir = NULL;
     DOS_FULL_NAME full_name;
     HANDLE load_done_evt = -1;
-    struct new_process_request *req = get_req_buffer();
 
     info->hThread = info->hProcess = INVALID_HANDLE_VALUE;
-    
-    /* create the process on the server side */
 
-    req->inherit_all  = inherit;
-    req->create_flags = flags;
-    req->start_flags  = startup->dwFlags;
-    req->exe_file     = hFile;
-    if (startup->dwFlags & STARTF_USESTDHANDLES)
+    if (lpCurrentDirectory)
     {
-        req->hstdin  = startup->hStdInput;
-        req->hstdout = startup->hStdOutput;
-        req->hstderr = startup->hStdError;
+        if (DOSFS_GetFullName( lpCurrentDirectory, TRUE, &full_name ))
+            unixdir = full_name.long_name;
     }
     else
     {
-        req->hstdin  = GetStdHandle( STD_INPUT_HANDLE );
-        req->hstdout = GetStdHandle( STD_OUTPUT_HANDLE );
-        req->hstderr = GetStdHandle( STD_ERROR_HANDLE );
-    }
-    req->cmd_show = startup->wShowWindow;
-    req->alloc_fd = 0;
-
-    if (lpCurrentDirectory) {
-        if (DOSFS_GetFullName( lpCurrentDirectory, TRUE, &full_name ))
-	    unixdir = full_name.long_name;
-    } else {
-	CHAR	buf[260];
-	if (GetCurrentDirectoryA(sizeof(buf),buf)) {
-	    if (DOSFS_GetFullName( buf, TRUE, &full_name ))
-		unixdir = full_name.long_name;
-	}
+        char buf[MAX_PATH];
+        if (GetCurrentDirectoryA(sizeof(buf),buf))
+        {
+            if (DOSFS_GetFullName( buf, TRUE, &full_name ))
+                unixdir = full_name.long_name;
+        }
     }
 
-    if (hFile == -1)  /* unix process */
+    /* create the process on the server side */
+
+    SERVER_START_REQ
     {
-        unixfilename = filename;
-        if (DOSFS_GetFullName( filename, TRUE, &full_name )) unixfilename = full_name.long_name;
-        req->filename[0] = 0;
+        size_t len = (hFile == -1) ? 0 : MAX_PATH;
+        struct new_process_request *req = server_alloc_req( sizeof(*req), len );
+        req->inherit_all  = inherit;
+        req->create_flags = flags;
+        req->start_flags  = startup->dwFlags;
+        req->exe_file     = hFile;
+        if (startup->dwFlags & STARTF_USESTDHANDLES)
+        {
+            req->hstdin  = startup->hStdInput;
+            req->hstdout = startup->hStdOutput;
+            req->hstderr = startup->hStdError;
+        }
+        else
+        {
+            req->hstdin  = GetStdHandle( STD_INPUT_HANDLE );
+            req->hstdout = GetStdHandle( STD_OUTPUT_HANDLE );
+            req->hstderr = GetStdHandle( STD_ERROR_HANDLE );
+        }
+        req->cmd_show = startup->wShowWindow;
+        req->alloc_fd = 0;
+
+        if (hFile == -1)  /* unix process */
+        {
+            unixfilename = filename;
+            if (DOSFS_GetFullName( filename, TRUE, &full_name ))
+                unixfilename = full_name.long_name;
+        }
+        else  /* new wine process */
+        {
+            if (!GetLongPathNameA( filename, server_data_ptr(req), MAX_PATH ))
+                lstrcpynA( server_data_ptr(req), filename, MAX_PATH );
+        }
+        ret = !server_call( REQ_NEW_PROCESS );
     }
-    else  /* new wine process */
-    {
-        if (!GetLongPathNameA( filename, req->filename, server_remaining(req->filename) ))
-            lstrcpynA( req->filename, filename, server_remaining(req->filename) );
-    }
-    if (server_call( REQ_NEW_PROCESS )) return FALSE;
+    SERVER_END_REQ;
+    if (!ret) return FALSE;
 
     /* fork and execute */
 
diff --git a/scheduler/thread.c b/scheduler/thread.c
index 293b3d8..debf4fa 100644
--- a/scheduler/thread.c
+++ b/scheduler/thread.c
@@ -502,10 +502,11 @@
     BOOL ret;
     SERVER_START_REQ
     {
-        struct set_thread_context_request *req = server_alloc_req( sizeof(*req), 0 );
+        struct set_thread_context_request *req = server_alloc_req( sizeof(*req),
+                                                                   sizeof(*context) );
         req->handle = handle;
         req->flags = context->ContextFlags;
-        memcpy( &req->context, context, sizeof(*context) );
+        memcpy( server_data_ptr(req), context, sizeof(*context) );
         ret = !server_call( REQ_SET_THREAD_CONTEXT );
     }
     SERVER_END_REQ;
@@ -526,12 +527,13 @@
     BOOL ret;
     SERVER_START_REQ
     {
-        struct get_thread_context_request *req = server_alloc_req( sizeof(*req), 0 );
+        struct get_thread_context_request *req = server_alloc_req( sizeof(*req),
+                                                                   sizeof(*context) );
         req->handle = handle;
         req->flags = context->ContextFlags;
-        memcpy( &req->context, context, sizeof(*context) );
+        memcpy( server_data_ptr(req), context, sizeof(*context) );
         if ((ret = !server_call( REQ_GET_THREAD_CONTEXT )))
-            memcpy( context, &req->context, sizeof(*context) );
+            memcpy( context, server_data_ptr(req), sizeof(*context) );
     }
     SERVER_END_REQ;
     return ret;
diff --git a/server/console.c b/server/console.c
index 5c6fad8..e8526a2 100644
--- a/server/console.c
+++ b/server/console.c
@@ -300,16 +300,25 @@
 }
 
 /* retrieve a pointer to the console input records */
-static int read_console_input( int handle, int count, INPUT_RECORD *rec, int max, int flush )
+static int read_console_input( int handle, int count, INPUT_RECORD *rec, int flush )
 {
     struct console_input *console;
 
     if (!(console = (struct console_input *)get_handle_obj( current->process, handle,
                                                             GENERIC_READ, &console_input_ops )))
         return -1;
-    if ((count < 0) || (count > console->recnum)) count = console->recnum;
-    if (count > max) count = max;
-    memcpy( rec, console->records, count * sizeof(INPUT_RECORD) );
+
+    if (!count)
+    {
+        /* special case: do not retrieve anything, but return
+         * the total number of records available */
+        count = console->recnum;
+    }
+    else
+    {
+        if (count > console->recnum) count = console->recnum;
+        memcpy( rec, console->records, count * sizeof(INPUT_RECORD) );
+    }
     if (flush)
     {
         int i;
@@ -440,24 +449,30 @@
 /* set info about a console (output only) */
 DECL_HANDLER(set_console_info)
 {
-    size_t len = get_req_strlen( req, req->title );
-    set_console_info( req->handle, req, req->title, len );
+    set_console_info( req->handle, req, get_req_data(req), get_req_data_size(req) );
 }
 
 /* get info about a console (output only) */
 DECL_HANDLER(get_console_info)
 {
     struct screen_buffer *console;
-    req->title[0] = 0;
+    size_t len = 0;
+
     if ((console = (struct screen_buffer *)get_handle_obj( current->process, req->handle,
                                                            GENERIC_READ, &screen_buffer_ops )))
     {
         req->cursor_size    = console->cursor_size;
         req->cursor_visible = console->cursor_visible;
         req->pid            = console->pid;
-        if (console->title) strcpy( req->title, console->title );
+        if (console->title)
+        {
+            len = strlen( console->title );
+            if (len > get_req_data_size(req)) len = get_req_data_size(req);
+            memcpy( get_req_data(req), console->title, len );
+        }
         release_object( console );
     }
+    set_req_data_size( req, len );
 }
 
 /* set a console fd */
@@ -498,17 +513,16 @@
 /* add input records to a console input queue */
 DECL_HANDLER(write_console_input)
 {
-    int max = get_req_size( req, req + 1, sizeof(INPUT_RECORD) );
-    int count = req->count;
-
-    if (count > max) count = max;
-    req->written = write_console_input( req->handle, count, (INPUT_RECORD *)(req + 1) );
+    req->written = write_console_input( req->handle, get_req_data_size(req) / sizeof(INPUT_RECORD),
+                                        get_req_data(req) );
 }
 
 /* fetch input records from a console input queue */
 DECL_HANDLER(read_console_input)
 {
-    int max = get_req_size( req, req + 1, sizeof(INPUT_RECORD) );
-    req->read = read_console_input( req->handle, req->count, (INPUT_RECORD *)(req + 1),
-                                    max, req->flush );
+    size_t size = get_req_data_size(req) / sizeof(INPUT_RECORD);
+    int res = read_console_input( req->handle, size, get_req_data(req), req->flush );
+    /* if size was 0 we didn't fetch anything */
+    if (size) set_req_data_size( req, res * sizeof(INPUT_RECORD) );
+    req->read = res;
 }
diff --git a/server/context_i386.c b/server/context_i386.c
index 52ee132..0782e90 100644
--- a/server/context_i386.c
+++ b/server/context_i386.c
@@ -477,16 +477,21 @@
     struct thread *thread;
     int flags = req->flags & ~CONTEXT_i386;  /* get rid of CPU id */
 
+    if (get_req_data_size(req) < sizeof(CONTEXT))
+    {
+        set_error( STATUS_INVALID_PARAMETER );
+        return;
+    }
     if ((thread = get_thread_from_handle( req->handle, THREAD_GET_CONTEXT )))
     {
         if (thread->context)  /* thread is inside an exception event */
         {
-            copy_context( &req->context, thread->context, flags );
+            copy_context( get_req_data(req), thread->context, flags );
             flags &= CONTEXT_DEBUG_REGISTERS;
         }
         if (flags && suspend_for_ptrace( thread ))
         {
-            get_thread_context( thread, flags, &req->context );
+            get_thread_context( thread, flags, get_req_data(req) );
             resume_thread( thread );
         }
         release_object( thread );
@@ -500,16 +505,21 @@
     struct thread *thread;
     int flags = req->flags & ~CONTEXT_i386;  /* get rid of CPU id */
 
+    if (get_req_data_size(req) < sizeof(CONTEXT))
+    {
+        set_error( STATUS_INVALID_PARAMETER );
+        return;
+    }
     if ((thread = get_thread_from_handle( req->handle, THREAD_SET_CONTEXT )))
     {
         if (thread->context)  /* thread is inside an exception event */
         {
-            copy_context( thread->context, &req->context, flags );
+            copy_context( thread->context, get_req_data(req), flags );
             flags &= CONTEXT_DEBUG_REGISTERS;
         }
         if (flags && suspend_for_ptrace( thread ))
         {
-            set_thread_context( thread, flags, &req->context );
+            set_thread_context( thread, flags, get_req_data(req) );
             resume_thread( thread );
         }
         release_object( thread );
diff --git a/server/context_sparc.c b/server/context_sparc.c
index 2335120..0a63c12 100644
--- a/server/context_sparc.c
+++ b/server/context_sparc.c
@@ -159,16 +159,21 @@
     struct thread *thread;
     int flags = req->flags & ~CONTEXT_SPARC;  /* get rid of CPU id */
 
+    if (get_req_data_size(req) < sizeof(CONTEXT))
+    {
+        set_error( STATUS_INVALID_PARAMETER );
+        return;
+    }
     if ((thread = get_thread_from_handle( req->handle, THREAD_GET_CONTEXT )))
     {
         if (thread->context)  /* thread is inside an exception event */
         {
-            copy_context( &req->context, thread->context, flags );
+            copy_context( get_req_data(req), thread->context, flags );
             flags = 0;
         }
         if (flags && suspend_for_ptrace( thread ))
         {
-            get_thread_context( thread, flags, &req->context );
+            get_thread_context( thread, flags, get_req_data(req) );
             resume_thread( thread );
         }
         release_object( thread );
@@ -182,16 +187,21 @@
     struct thread *thread;
     int flags = req->flags & ~CONTEXT_SPARC;  /* get rid of CPU id */
 
+    if (get_req_data_size(req) < sizeof(CONTEXT))
+    {
+        set_error( STATUS_INVALID_PARAMETER );
+        return;
+    }
     if ((thread = get_thread_from_handle( req->handle, THREAD_SET_CONTEXT )))
     {
         if (thread->context)  /* thread is inside an exception event */
         {
-            copy_context( thread->context, &req->context, flags );
+            copy_context( thread->context, get_req_data(req), flags );
             flags = 0;
         }
         if (flags && suspend_for_ptrace( thread ))
         {
-            set_thread_context( thread, flags, &req->context );
+            set_thread_context( thread, flags, get_req_data(req) );
             resume_thread( thread );
         }
         release_object( thread );
diff --git a/server/debugger.c b/server/debugger.c
index 371e304..946d659 100644
--- a/server/debugger.c
+++ b/server/debugger.c
@@ -593,13 +593,20 @@
     {
         struct debug_event_exception data;
         struct debug_event *event;
+        CONTEXT *context = get_req_data( req );
+        EXCEPTION_RECORD *rec = (EXCEPTION_RECORD *)(context + 1);
 
-        data.record = req->record;
+        if (get_req_data_size( req ) < sizeof(*rec) + sizeof(*context))
+        {
+            set_error( STATUS_INVALID_PARAMETER );
+            return;
+        }
+        data.record = *rec;
         data.first  = req->first;
         if ((event = queue_debug_event( current, EXCEPTION_DEBUG_EVENT, &data )))
         {
             struct object *obj = &event->obj;
-            current->context = &req->context;
+            current->context = context;
             sleep_on( 1, &obj, 0, -1, build_exception_event_reply );
             release_object( event );
         }
diff --git a/server/file.c b/server/file.c
index f12e4f4..61a3dd3 100644
--- a/server/file.c
+++ b/server/file.c
@@ -450,11 +450,10 @@
 /* create a file */
 DECL_HANDLER(create_file)
 {
-    size_t len = get_req_strlen( req, req->name );
     struct file *file;
 
     req->handle = -1;
-    if ((file = create_file( req->name, len, req->access,
+    if ((file = create_file( get_req_data(req), get_req_data_size(req), req->access,
                              req->sharing, req->create, req->attrs )))
     {
         req->handle = alloc_handle( current->process, file, req->access, req->inherit );
diff --git a/server/process.c b/server/process.c
index 9af7637..4376d3d 100644
--- a/server/process.c
+++ b/server/process.c
@@ -259,9 +259,12 @@
 
     if (info)
     {
+        size_t size = strlen(info->filename);
+        if (size > get_req_data_size(req)) size = get_req_data_size(req);
         req->start_flags = info->start_flags;
         req->cmd_show    = info->cmd_show;
-        strcpy( req->filename, info->filename );
+        memcpy( get_req_data(req), info->filename, size );
+        set_req_data_size( req, size );
         info->process = (struct process *)grab_object( process );
         info->thread  = (struct thread *)grab_object( current );
         wake_up( &info->obj, 0 );
@@ -270,7 +273,7 @@
     {
         req->start_flags  = STARTF_USESTDHANDLES;
         req->cmd_show     = 0;
-        req->filename[0]  = 0;
+        set_req_data_size( req, 0 );
     }
  error:
 }
@@ -711,7 +714,7 @@
 /* create a new process */
 DECL_HANDLER(new_process)
 {
-    size_t len = get_req_strlen( req, req->filename );
+    size_t len = get_req_data_size( req );
     struct startup_info *info;
     int sock[2];
 
@@ -742,11 +745,12 @@
         return;
     }
 
-    if (!(info->filename = memdup( req->filename, len+1 )))
+    if (!(info->filename = mem_alloc( len + 1 )))
     {
         release_object( info );
         return;
     }
+    memcpy( info->filename, get_req_data(req), len );
     info->filename[len] = 0;
 
     if (req->alloc_fd)
diff --git a/server/sock.c b/server/sock.c
index 1efdbfd..043b044 100644
--- a/server/sock.c
+++ b/server/sock.c
@@ -486,6 +486,7 @@
 DECL_HANDLER(get_socket_event)
 {
     struct sock *sock;
+    size_t size;
 
     sock=(struct sock*)get_handle_obj(current->process,req->handle,GENERIC_READ|GENERIC_WRITE|SYNCHRONIZE,&sock_ops);
     if (!sock)
@@ -499,8 +500,10 @@
     req->mask    = sock->mask;
     req->pmask   = sock->pmask;
     req->state   = sock->state;
-    memcpy(req->errors, sock->errors, sizeof(sock->errors));
-    clear_error();
+    size = min( get_req_data_size(req), sizeof(sock->errors) );
+    memcpy( get_req_data(req), sock->errors, size );
+    set_req_data_size( req, size );
+
     if (req->service)
     {
         if (req->s_event)
diff --git a/server/trace.c b/server/trace.c
index c6b5e91..89b0998 100644
--- a/server/trace.c
+++ b/server/trace.c
@@ -10,23 +10,14 @@
 #include <sys/uio.h>
 #include "winsock2.h"
 #include "winnt.h"
+#include "winbase.h"
+#include "wincon.h"
 #include "request.h"
 #include "unicode.h"
 
 
 /* utility functions */
 
-static void dump_ints( const int *ptr, int len )
-{
-    fputc( '{', stderr );
-    while (len > 0)
-    {
-        fprintf( stderr, "%d", *ptr++ );
-        if (--len) fputc( ',', stderr );
-    }
-    fputc( '}', stderr );
-}
-
 static void dump_uints( const int *ptr, int len )
 {
     fputc( '{', stderr );
@@ -68,25 +59,7 @@
     dump_unicode_string( req, *path );
 }
 
-static void dump_context( const void *req, const CONTEXT *context )
-{
-#ifdef __i386__
-    fprintf( stderr, "{flags=%08lx,eax=%08lx,ebx=%08lx,ecx=%08lx,edx=%08lx,esi=%08lx,edi=%08lx,"
-             "ebp=%08lx,eip=%08lx,esp=%08lx,eflags=%08lx,cs=%04lx,ds=%04lx,es=%04lx,"
-             "fs=%04lx,gs=%04lx,dr0=%08lx,dr1=%08lx,dr2=%08lx,dr3=%08lx,dr6=%08lx,dr7=%08lx,",
-             context->ContextFlags, context->Eax, context->Ebx, context->Ecx, context->Edx,
-             context->Esi, context->Edi, context->Ebp, context->Eip, context->Esp, context->EFlags,
-             context->SegCs, context->SegDs, context->SegEs, context->SegFs, context->SegGs,
-             context->Dr0, context->Dr1, context->Dr2, context->Dr3, context->Dr6, context->Dr7 );
-    fprintf( stderr, "float=" );
-    dump_uints( (int *)&context->FloatSave, sizeof(context->FloatSave) / sizeof(int) );
-    fprintf( stderr, "}" );
-#else
-    dump_uints( (int *)context, sizeof(*context) / sizeof(int) );
-#endif
-}
-
-static void dump_exc_record( const void *req, const EXCEPTION_RECORD *rec )
+static void dump_exc_record( const EXCEPTION_RECORD *rec )
 {
     int i;
     fprintf( stderr, "{code=%lx,flags=%lx,rec=%p,addr=%p,params={",
@@ -128,6 +101,11 @@
     fputc( '}', stderr );
 }
 
+static void dump_varargs_string( const void *ptr, size_t len )
+{
+    fprintf( stderr, "\"%.*s\"", (int)len, (char *)ptr );
+}
+
 static void dump_varargs_unicode_str( const void *ptr, size_t len )
 {
     fprintf( stderr, "L\"" );
@@ -135,15 +113,48 @@
     fputc( '\"', stderr );
 }
 
+static void dump_varargs_context( const void *ptr, size_t len )
+{
+    const CONTEXT *context = ptr;
+#ifdef __i386__
+    fprintf( stderr, "{flags=%08lx,eax=%08lx,ebx=%08lx,ecx=%08lx,edx=%08lx,esi=%08lx,edi=%08lx,"
+             "ebp=%08lx,eip=%08lx,esp=%08lx,eflags=%08lx,cs=%04lx,ds=%04lx,es=%04lx,"
+             "fs=%04lx,gs=%04lx,dr0=%08lx,dr1=%08lx,dr2=%08lx,dr3=%08lx,dr6=%08lx,dr7=%08lx,",
+             context->ContextFlags, context->Eax, context->Ebx, context->Ecx, context->Edx,
+             context->Esi, context->Edi, context->Ebp, context->Eip, context->Esp, context->EFlags,
+             context->SegCs, context->SegDs, context->SegEs, context->SegFs, context->SegGs,
+             context->Dr0, context->Dr1, context->Dr2, context->Dr3, context->Dr6, context->Dr7 );
+    fprintf( stderr, "float=" );
+    dump_uints( (int *)&context->FloatSave, sizeof(context->FloatSave) / sizeof(int) );
+    fprintf( stderr, "}" );
+#else
+    dump_uints( (int *)context, sizeof(*context) / sizeof(int) );
+#endif
+}
+
+static void dump_varargs_exc_event( const void *ptr, size_t len )
+{
+    fprintf( stderr, "{context=" );
+    dump_varargs_context( ptr, sizeof(CONTEXT) );
+    fprintf( stderr, ",rec=" );
+    dump_exc_record( (EXCEPTION_RECORD *)((CONTEXT *)ptr + 1) );
+    fputc( '}', stderr );
+}
+
 static void dump_varargs_debug_event( const void *ptr, size_t len )
 {
     const debug_event_t *event = ptr;
 
+    if (!len)
+    {
+        fprintf( stderr, "{}" );
+        return;
+    }
     switch(event->code)
     {
     case EXCEPTION_DEBUG_EVENT:
         fprintf( stderr, "{exception," );
-        dump_exc_record( ptr, &event->info.exception.record );
+        dump_exc_record( &event->info.exception.record );
         fprintf( stderr, ",first=%d}", event->info.exception.first );
         break;
     case CREATE_THREAD_DEBUG_EVENT:
@@ -193,13 +204,23 @@
     }
 }
 
-/* dumping for functions for requests that have a variable part */
-
-static void dump_varargs_get_socket_event_reply( const struct get_socket_event_request *req )
+static void dump_varargs_input_records( const void *ptr, size_t len )
 {
-    dump_ints( req->errors, FD_MAX_EVENTS );
+    const INPUT_RECORD *rec = ptr;
+    len /= sizeof(*rec);
+
+    fputc( '{', stderr );
+    while (len > 0)
+    {
+        fprintf( stderr, "{%04x,...}", rec->EventType );
+        rec++;
+        if (--len) fputc( ',', stderr );
+    }
+    fputc( '}', stderr );
 }
 
+/* dumping for functions for requests that have a variable part */
+
 static void dump_varargs_read_process_memory_reply( const struct read_process_memory_request *req )
 {
     int count = min( req->len, get_req_size( req, req->data, sizeof(int) ));
@@ -247,7 +268,7 @@
     fprintf( stderr, " cmd_show=%d,", req->cmd_show );
     fprintf( stderr, " alloc_fd=%d,", req->alloc_fd );
     fprintf( stderr, " filename=" );
-    dump_string( req, req->filename );
+    dump_varargs_string( get_req_data(req), get_req_data_size(req) );
 }
 
 static void dump_wait_process_request( const struct wait_process_request *req )
@@ -300,7 +321,7 @@
     fprintf( stderr, " hstderr=%d,", req->hstderr );
     fprintf( stderr, " cmd_show=%d,", req->cmd_show );
     fprintf( stderr, " filename=" );
-    dump_string( req, req->filename );
+    dump_varargs_string( get_req_data(req), get_req_data_size(req) );
 }
 
 static void dump_init_process_done_request( const struct init_process_done_request *req )
@@ -627,8 +648,8 @@
     fprintf( stderr, " sharing=%08x,", req->sharing );
     fprintf( stderr, " create=%d,", req->create );
     fprintf( stderr, " attrs=%08x,", req->attrs );
-    fprintf( stderr, " name=" );
-    dump_string( req, req->name );
+    fprintf( stderr, " filename=" );
+    dump_varargs_string( get_req_data(req), get_req_data_size(req) );
 }
 
 static void dump_create_file_reply( const struct create_file_request *req )
@@ -782,7 +803,7 @@
     fprintf( stderr, " pmask=%08x,", req->pmask );
     fprintf( stderr, " state=%08x,", req->state );
     fprintf( stderr, " errors=" );
-    dump_varargs_get_socket_event_reply( req );
+    dump_varargs_ints( get_req_data(req), get_req_data_size(req) );
 }
 
 static void dump_enable_socket_event_request( const struct enable_socket_event_request *req )
@@ -851,7 +872,7 @@
     fprintf( stderr, " cursor_size=%d,", req->cursor_size );
     fprintf( stderr, " cursor_visible=%d,", req->cursor_visible );
     fprintf( stderr, " title=" );
-    dump_string( req, req->title );
+    dump_varargs_string( get_req_data(req), get_req_data_size(req) );
 }
 
 static void dump_get_console_info_request( const struct get_console_info_request *req )
@@ -865,13 +886,14 @@
     fprintf( stderr, " cursor_visible=%d,", req->cursor_visible );
     fprintf( stderr, " pid=%d,", req->pid );
     fprintf( stderr, " title=" );
-    dump_string( req, req->title );
+    dump_varargs_string( get_req_data(req), get_req_data_size(req) );
 }
 
 static void dump_write_console_input_request( const struct write_console_input_request *req )
 {
     fprintf( stderr, " handle=%d,", req->handle );
-    fprintf( stderr, " count=%d", req->count );
+    fprintf( stderr, " rec=" );
+    dump_varargs_input_records( get_req_data(req), get_req_data_size(req) );
 }
 
 static void dump_write_console_input_reply( const struct write_console_input_request *req )
@@ -882,13 +904,14 @@
 static void dump_read_console_input_request( const struct read_console_input_request *req )
 {
     fprintf( stderr, " handle=%d,", req->handle );
-    fprintf( stderr, " count=%d,", req->count );
     fprintf( stderr, " flush=%d", req->flush );
 }
 
 static void dump_read_console_input_reply( const struct read_console_input_request *req )
 {
-    fprintf( stderr, " read=%d", req->read );
+    fprintf( stderr, " read=%d,", req->read );
+    fprintf( stderr, " rec=" );
+    dump_varargs_input_records( get_req_data(req), get_req_data_size(req) );
 }
 
 static void dump_create_change_notification_request( const struct create_change_notification_request *req )
@@ -1027,17 +1050,16 @@
 
 static void dump_exception_event_request( const struct exception_event_request *req )
 {
-    fprintf( stderr, " record=" );
-    dump_exc_record( req, &req->record );
-    fprintf( stderr, "," );
     fprintf( stderr, " first=%d,", req->first );
-    fprintf( stderr, " context=" );
-    dump_context( req, &req->context );
+    fprintf( stderr, " record=" );
+    dump_varargs_exc_event( get_req_data(req), get_req_data_size(req) );
 }
 
 static void dump_exception_event_reply( const struct exception_event_request *req )
 {
-    fprintf( stderr, " status=%d", req->status );
+    fprintf( stderr, " status=%d,", req->status );
+    fprintf( stderr, " context=" );
+    dump_varargs_context( get_req_data(req), get_req_data_size(req) );
 }
 
 static void dump_output_debug_string_request( const struct output_debug_string_request *req )
@@ -1297,7 +1319,7 @@
 static void dump_get_thread_context_reply( const struct get_thread_context_request *req )
 {
     fprintf( stderr, " context=" );
-    dump_context( req, &req->context );
+    dump_varargs_context( get_req_data(req), get_req_data_size(req) );
 }
 
 static void dump_set_thread_context_request( const struct set_thread_context_request *req )
@@ -1305,7 +1327,7 @@
     fprintf( stderr, " handle=%d,", req->handle );
     fprintf( stderr, " flags=%08x,", req->flags );
     fprintf( stderr, " context=" );
-    dump_context( req, &req->context );
+    dump_varargs_context( get_req_data(req), get_req_data_size(req) );
 }
 
 static void dump_get_selector_entry_request( const struct get_selector_entry_request *req )
diff --git a/tools/make_requests b/tools/make_requests
index 7dcad4e..a0f07b1 100755
--- a/tools/make_requests
+++ b/tools/make_requests
@@ -15,11 +15,8 @@
     "void*"         => "%p",
     "time_t"        => "%ld",
     "path_t"        => "&dump_path_t",
-    "debug_event_t" => "&dump_debug_event_t",
-    "CONTEXT"       => "&dump_context",
-    "EXCEPTION_RECORD" => "&dump_exc_record",
-    "char[1]"          => "&dump_string",
-    "WCHAR[1]"         => "&dump_unicode_string"
+    "char[1]"       => "&dump_string",
+    "WCHAR[1]"      => "&dump_unicode_string"
 );
 
 my @requests = ();
diff --git a/win32/console.c b/win32/console.c
index 03728ae..2d6f45e 100644
--- a/win32/console.c
+++ b/win32/console.c
@@ -65,10 +65,15 @@
  */
 static int CONSOLE_GetPid( HANDLE handle )
 {
-    struct get_console_info_request *req = get_req_buffer();
-    req->handle = handle;
-    if (server_call( REQ_GET_CONSOLE_INFO )) return 0;
-    return req->pid;
+    int ret = 0;
+    SERVER_START_REQ
+    {
+        struct get_console_info_request *req = server_alloc_req( sizeof(*req), 0 );
+        req->handle = handle;
+        if (!server_call( REQ_GET_CONSOLE_INFO )) ret = req->pid;
+    }
+    SERVER_END_REQ;
+    return ret;
 }
 
 /****************************************************************************
@@ -295,6 +300,36 @@
     HeapFree(GetProcessHeap(),0,buf);
 }
 
+
+/******************************************************************************
+ * read_console_input
+ *
+ * Helper function for ReadConsole, ReadConsoleInput and PeekConsoleInput
+ */
+static BOOL read_console_input( HANDLE handle, LPINPUT_RECORD buffer, DWORD count,
+                                LPDWORD read, BOOL flush )
+{
+    BOOL ret;
+
+    count = min( count, REQUEST_MAX_VAR_SIZE/sizeof(INPUT_RECORD) );
+
+    SERVER_START_REQ
+    {
+        struct read_console_input_request *req = server_alloc_req( sizeof(*req),
+                                                                   count*sizeof(INPUT_RECORD) );
+        req->handle = handle;
+        req->flush = flush;
+        if ((ret = !server_call( REQ_READ_CONSOLE_INPUT )))
+        {
+            if (count) memcpy( buffer, server_data_ptr(req), server_data_size(req) );
+            if (read) *read = req->read;
+        }
+    }
+    SERVER_END_REQ;
+    return ret;
+}
+
+
 /******************************************************************************
  * SetConsoleCtrlHandler [KERNEL32.459]  Adds function to calling process list
  *
@@ -475,7 +510,14 @@
  */
 BOOL WINAPI FreeConsole(VOID)
 {
-    return !server_call( REQ_FREE_CONSOLE );
+    BOOL ret;
+    SERVER_START_REQ
+    {
+        struct free_console_request *req = server_alloc_req( sizeof(*req), 0 );
+        ret = !server_call( REQ_FREE_CONSOLE );
+    }
+    SERVER_END_REQ;
+    return ret;
 }
 
 
@@ -487,13 +529,18 @@
 HANDLE CONSOLE_OpenHandle( BOOL output, DWORD access, LPSECURITY_ATTRIBUTES sa )
 {
     int ret = -1;
-    struct open_console_request *req = get_req_buffer();
 
-    req->output  = output;
-    req->access  = access;
-    req->inherit = (sa && (sa->nLength>=sizeof(*sa)) && sa->bInheritHandle);
-    SetLastError(0);
-    if (!server_call( REQ_OPEN_CONSOLE )) ret = req->handle;
+    SERVER_START_REQ
+    {
+        struct open_console_request *req = server_alloc_req( sizeof(*req), 0 );
+
+        req->output  = output;
+        req->access  = access;
+        req->inherit = (sa && (sa->nLength>=sizeof(*sa)) && sa->bInheritHandle);
+        SetLastError(0);
+        if (!server_call( REQ_OPEN_CONSOLE )) ret = req->handle;
+    }
+    SERVER_END_REQ;
     return ret;
 }
 
@@ -514,7 +561,6 @@
  */
 static BOOL CONSOLE_make_complex(HANDLE handle)
 {
-        struct set_console_fd_request *req = get_req_buffer();
 	struct termios term;
 	char buf[256];
 	char c = '\0';
@@ -563,10 +609,15 @@
             CloseHandle( pty_handle );
             return FALSE;
 	}
-        req->handle = handle;
-        req->file_handle = pty_handle;
-        req->pid = xpid;
-        server_call( REQ_SET_CONSOLE_FD );
+        SERVER_START_REQ
+        {
+            struct set_console_fd_request *req = server_alloc_req( sizeof(*req), 0 );
+            req->handle = handle;
+            req->file_handle = pty_handle;
+            req->pid = xpid;
+            server_call( REQ_SET_CONSOLE_FD );
+        }
+        SERVER_END_REQ;
         CloseHandle( pty_handle );
 
 	/* enable mouseclicks */
@@ -591,18 +642,26 @@
  */
 BOOL WINAPI AllocConsole(VOID)
 {
-    struct alloc_console_request *req = get_req_buffer();
+    BOOL ret;
     HANDLE hStderr;
     int handle_in, handle_out;
 
     TRACE("()\n");
-    req->access  = GENERIC_READ | GENERIC_WRITE | SYNCHRONIZE;
-    req->inherit = FALSE;
-    if (server_call( REQ_ALLOC_CONSOLE )) return FALSE;
-    handle_in = req->handle_in;
-    handle_out = req->handle_out;
 
-    if (!DuplicateHandle( GetCurrentProcess(), req->handle_out, GetCurrentProcess(), &hStderr,
+    SERVER_START_REQ
+    {
+        struct alloc_console_request *req = server_alloc_req( sizeof(*req), 0 );
+
+        req->access  = GENERIC_READ | GENERIC_WRITE | SYNCHRONIZE;
+        req->inherit = FALSE;
+        ret = !server_call( REQ_ALLOC_CONSOLE );
+        handle_in = req->handle_in;
+        handle_out = req->handle_out;
+    }
+    SERVER_END_REQ;
+    if (!ret) return FALSE;
+
+    if (!DuplicateHandle( GetCurrentProcess(), handle_out, GetCurrentProcess(), &hStderr,
                           0, TRUE, DUPLICATE_SAME_ACCESS ))
     {
         CloseHandle( handle_in );
@@ -708,19 +767,26 @@
  */
 DWORD WINAPI GetConsoleTitleA(LPSTR title,DWORD size)
 {
-    struct get_console_info_request *req = get_req_buffer();
     DWORD ret = 0;
     HANDLE hcon;
 
     if ((hcon = CreateFileA( "CONOUT$", GENERIC_READ, 0, NULL,
                                OPEN_EXISTING, 0, 0 )) == INVALID_HANDLE_VALUE)
         return 0;
-    req->handle = hcon;
-    if (!server_call( REQ_GET_CONSOLE_INFO ))
+    SERVER_START_REQ
     {
-        lstrcpynA( title, req->title, size );
-        ret = strlen(req->title);
+        struct get_console_info_request *req = server_alloc_req( sizeof(*req),
+                                                                 REQUEST_MAX_VAR_SIZE );
+        req->handle = hcon;
+        if (!server_call( REQ_GET_CONSOLE_INFO ))
+        {
+            ret = server_data_size(req);
+            size = min( size-1, ret );
+            memcpy( title, server_data_ptr(req), size );
+            title[size] = 0;
+        }
     }
+    SERVER_END_REQ;
     CloseHandle( hcon );
     return ret;
 }
@@ -940,7 +1006,6 @@
 {
     int		charsread = 0;
     LPSTR	xbuf = (LPSTR)lpBuffer;
-    LPINPUT_RECORD	ir;
 
     TRACE("(%d,%p,%ld,%p,%p)\n",
 	    hConsoleInput,lpBuffer,nNumberOfCharsToRead,
@@ -952,19 +1017,14 @@
     /* FIXME: should we read at least 1 char? The SDK does not say */
     while (charsread<nNumberOfCharsToRead)
     {
-        struct read_console_input_request *req = get_req_buffer();
-        req->handle = hConsoleInput;
-        req->count = 1;
-        req->flush = 1;
-        if (server_call( REQ_READ_CONSOLE_INPUT )) return FALSE;
-        if (!req->read) break;
-	ir = (LPINPUT_RECORD)(req+1);
-    	if (!ir->Event.KeyEvent.bKeyDown)
-		continue;
-    	if (ir->EventType != KEY_EVENT)
-		continue;
-	*xbuf++ = ir->Event.KeyEvent.uChar.AsciiChar; 
-	charsread++;
+        INPUT_RECORD ir;
+        DWORD count;
+        if (!read_console_input( hConsoleInput, &ir, 1, &count, TRUE )) return FALSE;
+        if (!count) break;
+        if (ir.EventType != KEY_EVENT) continue;
+        if (!ir.Event.KeyEvent.bKeyDown) continue;
+        *xbuf++ = ir.Event.KeyEvent.uChar.AsciiChar;
+        charsread++;
     }
     if (lpNumberOfCharsRead)
     	*lpNumberOfCharsRead = charsread;
@@ -1013,22 +1073,25 @@
 BOOL WINAPI ReadConsoleInputA(HANDLE hConsoleInput, LPINPUT_RECORD lpBuffer,
                               DWORD nLength, LPDWORD lpNumberOfEventsRead)
 {
-    struct read_console_input_request *req = get_req_buffer();
+    if (!nLength)
+    {
+        if (lpNumberOfEventsRead) *lpNumberOfEventsRead = 0;
+        return TRUE;
+    }
 
     /* loop until we get at least one event */
     for (;;)
     {
-        req->handle = hConsoleInput;
-        req->count = nLength;
-        req->flush = 1;
-        if (server_call( REQ_READ_CONSOLE_INPUT )) return FALSE;
-        if (req->read)
+        DWORD count;
+        BOOL ret = read_console_input( hConsoleInput, lpBuffer, nLength, &count, TRUE );
+
+        if (!ret) return FALSE;
+        if (count)
         {
-            memcpy( lpBuffer, req + 1, req->read * sizeof(*lpBuffer) );
-            if (lpNumberOfEventsRead) *lpNumberOfEventsRead = req->read;
+            if (lpNumberOfEventsRead) *lpNumberOfEventsRead = count;
             return TRUE;
         }
-	CONSOLE_get_input(hConsoleInput,TRUE);
+        CONSOLE_get_input(hConsoleInput,TRUE);
         /*WaitForSingleObject( hConsoleInput, INFINITE32 );*/
     }
 }
@@ -1050,11 +1113,7 @@
  */
 BOOL WINAPI FlushConsoleInputBuffer( HANDLE handle )
 {
-    struct read_console_input_request *req = get_req_buffer();
-    req->handle = handle;
-    req->count = -1;  /* get all records */
-    req->flush = 1;
-    return !server_call( REQ_READ_CONSOLE_INPUT );
+    return read_console_input( handle, NULL, 0, NULL, TRUE );
 }
 
 
@@ -1065,20 +1124,15 @@
  *
  * Does not need a complex console.
  */
-BOOL WINAPI PeekConsoleInputA( HANDLE handle, LPINPUT_RECORD buffer,
-                                   DWORD count, LPDWORD read )
+BOOL WINAPI PeekConsoleInputA( HANDLE handle, LPINPUT_RECORD buffer, DWORD count, LPDWORD read )
 {
-    struct read_console_input_request *req = get_req_buffer();
-
     CONSOLE_get_input(handle,FALSE);
-
-    req->handle = handle;
-    req->count = count;
-    req->flush = 0;
-    if (server_call( REQ_READ_CONSOLE_INPUT )) return FALSE;
-    if (req->read) memcpy( buffer, req + 1, req->read * sizeof(*buffer) );
-    if (read) *read = req->read;
-    return TRUE;
+    if (!count)
+    {
+        if (read) *read = 0;
+        return TRUE;
+    }
+    return read_console_input( handle, buffer, count, read, FALSE );
 }
 
 
@@ -1102,22 +1156,28 @@
 BOOL WINAPI WriteConsoleInputA( HANDLE handle, INPUT_RECORD *buffer,
                                 DWORD count, LPDWORD written )
 {
-    struct write_console_input_request *req = get_req_buffer();
-    const DWORD max = server_remaining( req + 1 ) / sizeof(INPUT_RECORD);
+    BOOL ret = TRUE;
 
     if (written) *written = 0;
-    while (count)
+    while (count && ret)
     {
-        DWORD len = count < max ? count : max;
-        req->count = len;
-        req->handle = handle;
-        memcpy( req + 1, buffer, len * sizeof(*buffer) );
-        if (server_call( REQ_WRITE_CONSOLE_INPUT )) return FALSE;
-        if (written) *written += req->written;
-        count -= len;
-        buffer += len;
+        DWORD len = min( count, REQUEST_MAX_VAR_SIZE/sizeof(INPUT_RECORD) );
+        SERVER_START_REQ
+        {
+            struct write_console_input_request *req = server_alloc_req( sizeof(*req),
+                                                                        len*sizeof(INPUT_RECORD) );
+            req->handle = handle;
+            memcpy( server_data_ptr(req), buffer, len * sizeof(INPUT_RECORD) );
+            if ((ret = !server_call( REQ_WRITE_CONSOLE_INPUT )))
+            {
+                if (written) *written += req->written;
+                count -= len;
+                buffer += len;
+            }
+        }
+        SERVER_END_REQ;
     }
-    return TRUE;
+    return ret;
 }
 
 /******************************************************************************
@@ -1145,18 +1205,27 @@
  */
 BOOL WINAPI SetConsoleTitleA(LPCSTR title)
 {
-    struct set_console_info_request *req = get_req_buffer();
+    size_t len = strlen(title);
     HANDLE hcon;
     DWORD written;
+    BOOL ret;
 
     if ((hcon = CreateFileA( "CONOUT$", GENERIC_READ|GENERIC_WRITE, 0, NULL,
                                OPEN_EXISTING, 0, 0 )) == INVALID_HANDLE_VALUE)
         return FALSE;
-    req->handle = hcon;
-    req->mask = SET_CONSOLE_INFO_TITLE;
-    lstrcpynA( req->title, title, server_remaining(req->title) );
-    if (server_call( REQ_SET_CONSOLE_INFO )) goto error;
-    if (CONSOLE_GetPid( hcon ))
+
+    len = min( len, REQUEST_MAX_VAR_SIZE );
+    SERVER_START_REQ
+    {
+        struct set_console_info_request *req = server_alloc_req( sizeof(*req), len );
+        req->handle = hcon;
+        req->mask = SET_CONSOLE_INFO_TITLE;
+        memcpy( server_data_ptr(req), title, len );
+        ret = !server_call( REQ_SET_CONSOLE_INFO );
+    }
+    SERVER_END_REQ;
+
+    if (ret && CONSOLE_GetPid( hcon ))
     {
         /* only set title for complex console (own xterm) */
         WriteFile( hcon, "\033]2;", 4, &written, NULL );
@@ -1164,10 +1233,7 @@
         WriteFile( hcon, "\a", 1, &written, NULL );
     }
     CloseHandle( hcon );
-    return TRUE;
- error:
-    CloseHandle( hcon );
-    return FALSE;
+    return ret;
 }
 
 
@@ -1231,16 +1297,7 @@
  */
 BOOL WINAPI GetNumberOfConsoleInputEvents(HANDLE hcon,LPDWORD nrofevents)
 {
-    struct read_console_input_request *req = get_req_buffer();
-
-    CONSOLE_get_input(hcon,FALSE);
-
-    req->handle = hcon;
-    req->count = -1;
-    req->flush = 0;
-    if (server_call( REQ_READ_CONSOLE_INPUT )) return FALSE;
-    if (nrofevents) *nrofevents = req->read;
-    return TRUE;
+    return read_console_input( hcon, NULL, 0, nrofevents, FALSE );
 }
 
 /***********************************************************************
@@ -1266,15 +1323,21 @@
  */
 BOOL WINAPI GetConsoleCursorInfo( HANDLE hcon, LPCONSOLE_CURSOR_INFO cinfo )
 {
-    struct get_console_info_request *req = get_req_buffer();
-    req->handle = hcon;
-    if (server_call( REQ_GET_CONSOLE_INFO )) return FALSE;
-    if (cinfo)
+    BOOL ret;
+
+    SERVER_START_REQ
     {
-        cinfo->dwSize = req->cursor_size;
-        cinfo->bVisible = req->cursor_visible;
+        struct get_console_info_request *req = server_alloc_req( sizeof(*req), 0 );
+        req->handle = hcon;
+        ret = !server_call( REQ_GET_CONSOLE_INFO );
+        if (ret && cinfo)
+        {
+            cinfo->dwSize = req->cursor_size;
+            cinfo->bVisible = req->cursor_visible;
+        }
     }
-    return TRUE;
+    SERVER_END_REQ;
+    return ret;
 }
 
 
@@ -1289,19 +1352,25 @@
     HANDLE hcon,                /* [in] Handle to console screen buffer */
     LPCONSOLE_CURSOR_INFO cinfo)  /* [in] Address of cursor information */
 {
-    struct set_console_info_request *req = get_req_buffer();
     char	buf[8];
     DWORD	xlen;
+    BOOL ret;
 
     CONSOLE_make_complex(hcon);
     sprintf(buf,"\033[?25%c",cinfo->bVisible?'h':'l');
     WriteFile(hcon,buf,strlen(buf),&xlen,NULL);
 
-    req->handle         = hcon;
-    req->cursor_size    = cinfo->dwSize;
-    req->cursor_visible = cinfo->bVisible;
-    req->mask           = SET_CONSOLE_INFO_CURSOR;
-    return !server_call( REQ_SET_CONSOLE_INFO );
+    SERVER_START_REQ
+    {
+        struct set_console_info_request *req = server_alloc_req( sizeof(*req), 0 );
+        req->handle         = hcon;
+        req->cursor_size    = cinfo->dwSize;
+        req->cursor_visible = cinfo->bVisible;
+        req->mask           = SET_CONSOLE_INFO_CURSOR;
+        ret = !server_call( REQ_SET_CONSOLE_INFO );
+    }
+    SERVER_END_REQ;
+    return ret;
 }
 
 
diff --git a/win32/except.c b/win32/except.c
index df12c22..82f3f44 100644
--- a/win32/except.c
+++ b/win32/except.c
@@ -68,30 +68,40 @@
  */
 DWORD WINAPI UnhandledExceptionFilter(PEXCEPTION_POINTERS epointers)
 {
-    struct exception_event_request *req = get_req_buffer();
     PDB*		pdb = PROCESS_Current();
     char 		format[256];
     char 		buffer[256];
     HKEY		hDbgConf;
     DWORD		bAuto = FALSE;
     DWORD		ret = EXCEPTION_EXECUTE_HANDLER;
+    int status;
 
     /* send a last chance event to the debugger */
-    req->record  = *epointers->ExceptionRecord;
-    req->first   = 0;
-    req->context = *epointers->ContextRecord;
-    if (!server_call_noerr( REQ_EXCEPTION_EVENT )) *epointers->ContextRecord = req->context;
-    switch (req->status)
+    SERVER_START_REQ
+    {
+        struct exception_event_request *req = server_alloc_req( sizeof(*req),
+                                                  sizeof(EXCEPTION_RECORD)+sizeof(CONTEXT) );
+        CONTEXT *context_ptr = server_data_ptr(req);
+        EXCEPTION_RECORD *rec_ptr = (EXCEPTION_RECORD *)(context_ptr + 1);
+        req->first   = 0;
+        *rec_ptr     = *epointers->ExceptionRecord;
+        *context_ptr = *epointers->ContextRecord;
+        if (!server_call_noerr( REQ_EXCEPTION_EVENT )) *epointers->ContextRecord = *context_ptr;
+        status = req->status;
+    }
+    SERVER_END_REQ;
+
+    switch (status)
     {
     case DBG_CONTINUE: 
-       return EXCEPTION_CONTINUE_EXECUTION;
+        return EXCEPTION_CONTINUE_EXECUTION;
     case DBG_EXCEPTION_NOT_HANDLED: 
-       TerminateProcess( GetCurrentProcess(), epointers->ExceptionRecord->ExceptionCode );
-       break; /* not reached */
+        TerminateProcess( GetCurrentProcess(), epointers->ExceptionRecord->ExceptionCode );
+        break; /* not reached */
     case 0: /* no debugger is present */
-       break;
+        break;
     default: 	
-       FIXME("Unsupported yet debug continue value %d (please report)\n", req->status);
+        FIXME("Unsupported yet debug continue value %d (please report)\n", status);
     }
 
     if (pdb->top_filter)