diff --git a/libburn/trunk/cdrskin/cdrskin_timestamp.h b/libburn/trunk/cdrskin/cdrskin_timestamp.h
index 979dfa27..a9a1bec1 100644
--- a/libburn/trunk/cdrskin/cdrskin_timestamp.h
+++ b/libburn/trunk/cdrskin/cdrskin_timestamp.h
@@ -1 +1 @@
-#define Cdrskin_timestamP "2007.04.10.083119"
+#define Cdrskin_timestamP "2007.04.10.144840"
diff --git a/libburn/trunk/libburn/libdax_msgs.h b/libburn/trunk/libburn/libdax_msgs.h
index 6d3d52ff..e00e881e 100644
--- a/libburn/trunk/libburn/libdax_msgs.h
+++ b/libburn/trunk/libburn/libdax_msgs.h
@@ -366,6 +366,7 @@ Range "scdbackup"          :  0x00020000 to 0x0002ffff
  0x00020139 (SORRY,HIGH)   = Write job parameters are unsuitable
  0x0002013a (FATAL,HIGH)   = No suitable media detected
  0x0002013b (FATAL,HIGH)   = Failed to fcntl-lock device
+ 0x0002013c (SORRY,HIGH)   = Malformed capabilities page 2Ah received
 
  libdax_audioxtr:
  0x00020200 (SORRY,HIGH)   = Cannot open audio source file
diff --git a/libburn/trunk/libburn/spc.c b/libburn/trunk/libburn/spc.c
index 55a5bb7b..854f6f19 100644
--- a/libburn/trunk/libburn/spc.c
+++ b/libburn/trunk/libburn/spc.c
@@ -171,6 +171,7 @@ void spc_sense_caps(struct burn_drive *d)
 	/* ts A61225 : 1 = report about post-MMC-1 speed descriptors */
 	static int speed_debug = 0;
 
+	memset(&buf, 0, sizeof(buf));
 	memcpy(c.opcode, SPC_MODE_SENSE, sizeof(SPC_MODE_SENSE));
 	c.retry = 1;
 	c.oplen = sizeof(SPC_MODE_SENSE);
@@ -180,6 +181,8 @@ void spc_sense_caps(struct burn_drive *d)
 	c.page->sectors = 0;
 	c.dir = FROM_DRIVE;
 	d->issue_command(d, &c);
+	if (c.error)
+		memset(&buf, 0, sizeof(buf));
 
 	size = c.page->data[0] * 256 + c.page->data[1];
 	m = d->mdata;
@@ -241,6 +244,18 @@ void spc_sense_caps(struct burn_drive *d)
 
 	num_write_speeds = page[30] * 256 + page[31];
 	m->max_write_speed = m->min_write_speed = m->cur_write_speed;
+
+        if (32 + 4 * num_write_speeds > page_length + 2) {
+		char msg[161];
+
+		sprintf(msg, "Malformed capabilities page 2Ah received (len=%d, #speeds=%d)", page_length, num_write_speeds);
+		libdax_msgs_submit(libdax_messenger, d->global_index,
+				0x0002013c,
+				LIBDAX_MSGS_SEV_SORRY, LIBDAX_MSGS_PRIO_HIGH,
+				msg, 0, 0);
+		return;
+	}
+
 	for (i = 0; i < num_write_speeds; i++) {
 		speed = page[32 + 4*i + 2] * 256 + page[32 + 4*i + 3];