diff --git a/ChangeLog b/ChangeLog
index 6b0464e..1f4f25d 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,12 @@
+2010-11-03  NIIBE Yutaka  <gniibe@fsij.org>
+
+	Bug fixes.
+	* src/ac.c (verify_admin_0): Initialize pwsb earlier.
+	* src/openpgp-do.c (copy_do_1): Access do_data[0] (was: do_data[1]).
+
 2010-11-02  NIIBE Yutaka  <gniibe@fsij.org>
 
+	DfuSe support.
 	* tool/dfuse.py (DFU_STM32.download): Put '#' for each 4-KiB.
 	Added 0-length write to finish download.
 	Take intel_hex object as argument.
diff --git a/src/ac.c b/src/ac.c
index b3acabb..8049842 100644
--- a/src/ac.c
+++ b/src/ac.c
@@ -187,6 +187,7 @@ verify_admin_0 (const uint8_t *pw, int buf_len, int pw_len_known)
       const uint8_t *salt;
       uint8_t pwsb[SIZE_PW_STATUS_BYTES];
 
+      memcpy (pwsb, pw_status_bytes, SIZE_PW_STATUS_BYTES);
       pw_len = pw3_keystring[0];
       if ((pw_len_known >= 0 && pw_len_known != pw_len) || pw_len < buf_len)
 	goto failure;
@@ -194,7 +195,6 @@ verify_admin_0 (const uint8_t *pw, int buf_len, int pw_len_known)
       salt = &pw3_keystring[1];
       count = decode_iterate_count (pw3_keystring[1+8]);
       calc_md (count, salt, pw, pw_len, md);
-      memcpy (pwsb, pw_status_bytes, SIZE_PW_STATUS_BYTES);
 
       if (memcmp (md, &pw3_keystring[1+8+1], KEYSTRING_MD_SIZE) != 0)
 	{
@@ -219,7 +219,7 @@ verify_admin_0 (const uint8_t *pw, int buf_len, int pw_len_known)
 	/* It is failure, but we don't try to lock for the case of empty PW3 */
 	return -1;
 
-      pw_len = 8;
+      pw_len = strlen (OPENPGP_CARD_INITIAL_PW3);
     }
 
   return pw_len;
diff --git a/src/flash.c b/src/flash.c
index e7af9ee..270115e 100644
--- a/src/flash.c
+++ b/src/flash.c
@@ -260,9 +260,9 @@ flash_do_write (uint8_t nr, const uint8_t *data, int len)
 }
 
 void
-flash_do_release (const uint8_t *data_p)
+flash_do_release (const uint8_t *do_data)
 {
-  (void)data_p;
+  (void)do_data;
 }
 
 uint8_t *
diff --git a/src/openpgp-do.c b/src/openpgp-do.c
index 4d57019..204c228 100644
--- a/src/openpgp-do.c
+++ b/src/openpgp-do.c
@@ -944,7 +944,7 @@ copy_do_1 (uint16_t tag, const uint8_t *do_data)
 
       if (do_data[0] < 127)
 	len = do_data[0] + 1;
-      else if (do_data[1] == 0x81)
+      else if (do_data[0] == 0x81)
 	len = do_data[1] + 2;
       else				/* 0x82 */
 	len = ((do_data[1] << 8) | do_data[2]) + 3;
@@ -956,7 +956,7 @@ copy_do_1 (uint16_t tag, const uint8_t *do_data)
 	  len = do_data[0];
 	  do_data++;
 	}
-      else if (do_data[1] == 0x81)
+      else if (do_data[0] == 0x81)
 	{
 	  len = do_data[1];
 	  do_data += 2;