diff --git a/ChangeLog b/ChangeLog
index 8b429663..f649b728 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -303,6 +303,14 @@ Hint: branch 0.1a will get a merge from here, and then get the
 	(except Football related ones) will then go to 0.1b.
 	Finally, when 0.1a is stable, I will close this branch.
 
+mars0.1stable65
+	* Major fix, only observed during KASAN debugging:
+	  Use-after-free which appears to splat only at Football
+	  during final deletion of resources. Never observed at production.
+	  Update if you are very cautious.
+	* A few minor fixes, not relevant for production.
+	* Minor doc improvements.
+
 mars0.1stable64
 	* Major regression: split-brain detection did not display
 	  correctly.
diff --git a/docu/mars-manual.lyx b/docu/mars-manual.lyx
index 7fb5d476..636e49e9 100644
--- a/docu/mars-manual.lyx
+++ b/docu/mars-manual.lyx
@@ -3265,7 +3265,30 @@ When all shards are residing in the same datacenter, there exists a SPOF
 
 \end_inset
 
- from each other by definition.
+ from each other by definition (cf paragraph 
+\begin_inset CommandInset ref
+LatexCommand vref
+reference "par:Definition-of-Sharding"
+
+\end_inset
+
+ for disambiguation of terms 
+\begin_inset Quotes eld
+\end_inset
+
+sharding
+\begin_inset Quotes erd
+\end_inset
+
+ and 
+\begin_inset Quotes eld
+\end_inset
+
+shared-nothing
+\begin_inset Quotes erd
+\end_inset
+
+).
 \end_layout
 
 \begin_layout Standard
@@ -4764,6 +4787,42 @@ exceptional(!)
 regularly
 \emph default
 , but only in clear cases of emergency!
+\begin_inset Newline newline
+\end_inset
+
+Notice: in this model, a shard typically consists of one storage node plus
+ 
+\begin_inset Formula $k+1$
+\end_inset
+
+ or 
+\begin_inset Formula $k+2$
+\end_inset
+
+ compute servers, introducing some additional failure redundancy 
+\emph on
+within
+\emph default
+ such a shard, while retaining the 
+\begin_inset Quotes eld
+\end_inset
+
+no single point of contention
+\begin_inset Quotes erd
+\end_inset
+
+ property 
+\emph on
+between
+\emph default
+ the shards (according to the definition 
+\begin_inset CommandInset ref
+LatexCommand vref
+reference "par:Definition-of-Sharding"
+
+\end_inset
+
+).
 \end_layout
 
 \begin_layout Description
@@ -6616,12 +6675,23 @@ both
 \series bold
 shard
 \series default
-) must have an incident at the same time.
+ in section 
+\begin_inset CommandInset ref
+LatexCommand vref
+reference "par:Definition-of-Sharding"
+
+\end_inset
+
+) must have an incident 
+\emph on
+at the same time
+\emph default
+.
 \end_layout
 
 \begin_layout Standard
-In contrast, big clusters are spreading their objects over a huge number
- of nodes 
+In contrast, big clusters are conceptually spreading their objects over
+ a huge number of nodes 
 \begin_inset Formula $O(n)$
 \end_inset
 
diff --git a/kernel/mars_bio.c b/kernel/mars_bio.c
index 0f9c95c1..cf77c265 100644
--- a/kernel/mars_bio.c
+++ b/kernel/mars_bio.c
@@ -173,8 +173,9 @@ int make_bio(struct bio_brick *brick, void *data, int len, loff_t pos, struct bi
 		MARS_ERR("odd sector offset %d\n", sector_offset);
 		goto out;
 	}
-	if (unlikely(sector_offset != data_offset)) {
-		MARS_ERR("bad alignment: sector_offset %d != data_offet %d\n", sector_offset, data_offset);
+	if (unlikely(sector_offset != 0)) {
+		MARS_ERR("bad alignment: sector_offset %d != 0\n",
+			 sector_offset);
 		goto out;
 	}
 	if (unlikely(rest_len & ((1 << 9) - 1))) {
diff --git a/kernel/mars_server.c b/kernel/mars_server.c
index abf3671e..5694596d 100644
--- a/kernel/mars_server.c
+++ b/kernel/mars_server.c
@@ -260,7 +260,7 @@ int server_io(struct server_brick *brick, struct mars_socket *sock, struct mars_
 	SETUP_CALLBACK(mref, server_endio, mref_a);
 
 	amount = 0;
-	if (!mref->ref_cs_mode < 2)
+	if (mref->ref_cs_mode < 2)
 		amount = (mref->ref_len - 1) / 1024 + 1;
 	mars_limit_sleep(&server_limiter, amount);
 	
diff --git a/kernel/sy_old/sy_generic.c b/kernel/sy_old/sy_generic.c
index e781a62f..8a7c82c3 100644
--- a/kernel/sy_old/sy_generic.c
+++ b/kernel/sy_old/sy_generic.c
@@ -1426,6 +1426,7 @@ int mars_dent_work(struct mars_global *global,
 	struct say_channel *say_channel = NULL;
 	struct list_head *tmp;
 	struct list_head *next;
+	struct list_head *prev;
 	int rounds = 0;
 	int status;
 	int total_status = 0;
@@ -1536,10 +1537,12 @@ restart:
 	bind_to_dent(NULL, &say_channel);
 
 	/* Remove all dents marked for removal.
+	 * Needs to be done in reverse order because later d_parent pointers may
+	 * reference earlier list members.
 	 */
 	down_write(&global->dent_mutex);
 	MARS_IO("removal pass\n");
-	for (tmp = global->dent_anchor.next, next = tmp->next; tmp != &global->dent_anchor; tmp = next, next = next->next) {
+	for (tmp = global->dent_anchor.prev, prev = tmp->prev; tmp != &global->dent_anchor; tmp = prev, prev = prev->prev) {
 		struct mars_dent *dent = container_of(tmp, struct mars_dent, dent_link);
 		if (!dent->d_killme)
 			continue;
@@ -1719,6 +1722,10 @@ EXPORT_SYMBOL_GPL(mars_free_dent);
 void mars_free_dent_all(struct mars_global *global, struct list_head *anchor)
 {
 	LIST_HEAD(tmp_list);
+
+	/* Needs to be done in reverse order because later d_parent pointers may
+	 * reference earlier list members.
+	 */
 	if (global)
 		down_write(&global->dent_mutex);
 	list_replace_init(anchor, &tmp_list);