diff --git a/src/cpu_common/cpu.c b/src/cpu_common/cpu.c
index 0c643f9d9..8e88e9f4b 100644
--- a/src/cpu_common/cpu.c
+++ b/src/cpu_common/cpu.c
@@ -3149,6 +3149,10 @@ void cpu_WRMSR()
                         case 0x10:
 				tsc = EAX | ((uint64_t)EDX << 32);
 				break;
+                        case 0x8B:
+				cpu_log("WRMSR: Invalid MSR: 0x8B/n"); /*Needed for Vista to correctly break on Pentium*/
+				x86gpf(NULL, 0);
+				break;
                 }
                 break;
 #if defined(DEV_BRANCH) && defined(USE_CYRIX_6X86)
diff --git a/src/io.c b/src/io.c
index fe356cfbf..5aaedc8d6 100644
--- a/src/io.c
+++ b/src/io.c
@@ -154,13 +154,14 @@ io_removehandler(uint16_t base, int size,
 	void *priv)
 {
     int c;
-    io_t *p;
+    io_t *p, *q;
 
     for (c = 0; c < size; c++) {
 	p = io[base + c];
 	if (!p)
 		continue;
 	while(p) {
+		q = p->next;
 		if ((p->inb == inb) && (p->inw == inw) &&
 		    (p->inl == inl) && (p->outb == outb) &&
 		    (p->outw == outw) && (p->outl == outl) &&
@@ -177,7 +178,7 @@ io_removehandler(uint16_t base, int size,
 			p = NULL;
 			break;
 		}
-		p = p->next;
+		p = q;
 	}
     }
 }
@@ -251,7 +252,7 @@ io_removehandler_interleaved(uint16_t base, int size,
 	void *priv)
 {
     int c;
-    io_t *p;
+    io_t *p, *q;
 
     size <<= 2;
     for (c = 0; c < size; c += 2) {
@@ -259,6 +260,7 @@ io_removehandler_interleaved(uint16_t base, int size,
 	if (!p)
 		return;
 	while(p) {
+		q = p->next;
 		if ((p->inb == inb) && (p->inw == inw) &&
 		    (p->inl == inl) && (p->outb == outb) &&
 		    (p->outw == outw) && (p->outl == outl) &&
@@ -270,7 +272,7 @@ io_removehandler_interleaved(uint16_t base, int size,
 			free(p);
 			break;
 		}
-		p = p->next;
+		p = q;
 	}
     }
 }
diff --git a/src/mem.c b/src/mem.c
index ddd6a2316..4fa0d435b 100644
--- a/src/mem.c
+++ b/src/mem.c
@@ -1678,9 +1678,9 @@ void
 mem_write_ramb_page(uint32_t addr, uint8_t val, page_t *p)
 {
 #ifdef USE_DYNAREC
-    if (val != p->mem[addr & 0xfff] || codegen_in_recompile) {
+    if ((p == NULL) || (p->mem == NULL) || (val != p->mem[addr & 0xfff]) || codegen_in_recompile) {
 #else
-    if (val != p->mem[addr & 0xfff]) {
+    if ((p == NULL) || (p->mem == NULL) || (val != p->mem[addr & 0xfff])) {
 #endif
 	uint64_t mask = (uint64_t)1 << ((addr >> PAGE_MASK_SHIFT) & PAGE_MASK_MASK);
 	p->dirty_mask[(addr >> PAGE_MASK_INDEX_SHIFT) & PAGE_MASK_INDEX_MASK] |= mask;
@@ -1693,9 +1693,9 @@ void
 mem_write_ramw_page(uint32_t addr, uint16_t val, page_t *p)
 {
 #ifdef USE_DYNAREC
-    if (val != *(uint16_t *)&p->mem[addr & 0xfff] || codegen_in_recompile) {
+    if ((p == NULL) || (p->mem == NULL) || (val != *(uint16_t *)&p->mem[addr & 0xfff]) || codegen_in_recompile) {
 #else
-    if (val != *(uint16_t *)&p->mem[addr & 0xfff]) {
+    if ((p == NULL) || (p->mem == NULL) || (val != *(uint16_t *)&p->mem[addr & 0xfff])) {
 #endif
 	uint64_t mask = (uint64_t)1 << ((addr >> PAGE_MASK_SHIFT) & PAGE_MASK_MASK);
 	if ((addr & 0xf) == 0xf)
@@ -1710,9 +1710,9 @@ void
 mem_write_raml_page(uint32_t addr, uint32_t val, page_t *p)
 {
 #ifdef USE_DYNAREC
-    if (val != *(uint32_t *)&p->mem[addr & 0xfff] || codegen_in_recompile) {
+    if ((p == NULL) || (p->mem == NULL) || (val != *(uint32_t *)&p->mem[addr & 0xfff]) || codegen_in_recompile) {
 #else
-    if (val != *(uint32_t *)&p->mem[addr & 0xfff]) {
+    if ((p == NULL) || (p->mem == NULL) || (val != *(uint32_t *)&p->mem[addr & 0xfff])) {
 #endif
 	uint64_t mask = (uint64_t)1 << ((addr >> PAGE_MASK_SHIFT) & PAGE_MASK_MASK);
 	if ((addr & 0xf) >= 0xd)
diff --git a/src/network/network.c b/src/network/network.c
index cd6f00df8..a32f232c1 100644
--- a/src/network/network.c
+++ b/src/network/network.c
@@ -350,6 +350,7 @@ network_attach(void *dev, uint8_t *mac, NETRXCB rx, NETWAITCB wait, NETSETLINKST
 
     first_pkt[0] = first_pkt[1] = NULL;
     last_pkt[0] = last_pkt[1] = NULL;
+    memset(&network_rx_queue_timer, 0x00, sizeof(pc_timer_t));
     timer_add(&network_rx_queue_timer, network_rx_queue, NULL, 0);
     /* 10 mbps. */
     timer_on_auto(&network_rx_queue_timer, 0.762939453125 * 2.0);
diff --git a/src/timer.c b/src/timer.c
index e7967e652..9d88c67e0 100644
--- a/src/timer.c
+++ b/src/timer.c
@@ -110,8 +110,10 @@ timer_remove_head(void)
     if (timer_head) {
 	timer = timer_head;
 	timer_head = timer->next;
-	if (timer_head)
+	if (timer_head) {
 		timer_head->prev = NULL;
+		timer->next->prev = NULL;
+	}
 	timer->next = timer->prev = NULL;
 	timer->flags &= ~TIMER_ENABLED;
     }
@@ -151,6 +153,17 @@ timer_process(void)
 void
 timer_close(void)
 {
+    pc_timer_t *t = timer_head, *r;
+
+    /* Set all timers' prev and next to NULL so it is assured that
+       timers that are not in malloc'd structs don't keep pointing
+       to timers that may be in malloc'd structs. */
+    while (t != NULL) {
+	r = t;
+	r->prev = r->next = NULL;
+	t = r->next;
+    }
+
     timer_head = NULL;
 
     timer_inited = 0;