--- a/usr/src/uts/common/fs/zfs/dbuf.c	Thu Mar 22 11:17:55 2007 -0700
+++ b/usr/src/uts/common/fs/zfs/dbuf.c	Thu Mar 22 11:43:05 2007 -0700
@@ -514,6 +514,7 @@
 
 	dbuf_add_ref(db, NULL);
 	/* ZIO_FLAG_CANFAIL callers have to check the parent zio's error */
+	ASSERT3U(db->db_dnode->dn_type, <, DMU_OT_NUMTYPES);
 	(void) arc_read(zio, db->db_dnode->dn_objset->os_spa, bp,
 	    db->db_level > 0 ? byteswap_uint64_array :
 	    dmu_ot[db->db_dnode->dn_type].ot_byteswap,

--- a/usr/src/uts/common/fs/zfs/dmu_objset.c	Thu Mar 22 11:17:55 2007 -0700
+++ b/usr/src/uts/common/fs/zfs/dmu_objset.c	Thu Mar 22 11:43:05 2007 -0700
@@ -772,6 +772,15 @@
 	/* XXX the write_done callback should really give us the tx... */
 	os->os_synctx = tx;
 
+	if (os->os_dsl_dataset == NULL) {
+		/*
+		 * This is the MOS.  If we have upgraded,
+		 * spa_max_replication() could change, so reset
+		 * os_copies here.
+		 */
+		os->os_copies = spa_max_replication(os->os_spa);
+	}
+
 	/*
 	 * Create the root block IO
 	 */

--- a/usr/src/uts/common/fs/zfs/dnode.c	Thu Mar 22 11:17:55 2007 -0700
+++ b/usr/src/uts/common/fs/zfs/dnode.c	Thu Mar 22 11:43:05 2007 -0700
@@ -206,6 +206,7 @@
 		 */
 		int off = (dnp->dn_nblkptr-1) * sizeof (blkptr_t);
 		size_t len = DN_MAX_BONUSLEN - off;
+		ASSERT3U(dnp->dn_bonustype, <, DMU_OT_NUMTYPES);
 		dmu_ot[dnp->dn_bonustype].ot_byteswap(dnp->dn_bonus + off, len);
 	}
 }

--- a/usr/src/uts/common/fs/zfs/zio.c	Thu Mar 22 11:17:55 2007 -0700
+++ b/usr/src/uts/common/fs/zfs/zio.c	Thu Mar 22 11:43:05 2007 -0700
@@ -1004,10 +1004,8 @@
 		BP_SET_COMPRESS(bp, compress);
 		zio->io_pipeline = ZIO_REWRITE_PIPELINE;
 	} else {
-		if (bp->blk_birth == zio->io_txg) {
-			ASSERT3U(BP_GET_LSIZE(bp), ==, lsize);
-			bzero(bp, sizeof (blkptr_t));
-		}
+		if (bp->blk_birth == zio->io_txg)
+			BP_ZERO(bp);
 		if (csize == 0) {
 			BP_ZERO(bp);
 			zio->io_pipeline = ZIO_WAIT_FOR_CHILDREN_PIPELINE;