diff --git a/kernel/vm.c b/kernel/vm.c
index b2bfe2c..51165b7 100644
--- a/kernel/vm.c
+++ b/kernel/vm.c
@@ -359,7 +359,7 @@ copyout(pagetable_t pagetable, uint64 dstva, char *src, uint64 len)
   uint64 n, va0, pa0;
 
   while(len > 0){
-    va0 = (uint)PGROUNDDOWN(dstva);
+    va0 = PGROUNDDOWN(dstva);
     pa0 = walkaddr(pagetable, va0);
     if(pa0 == 0)
       return -1;
@@ -384,7 +384,7 @@ copyin(pagetable_t pagetable, char *dst, uint64 srcva, uint64 len)
   uint64 n, va0, pa0;
 
   while(len > 0){
-    va0 = (uint)PGROUNDDOWN(srcva);
+    va0 = PGROUNDDOWN(srcva);
     pa0 = walkaddr(pagetable, va0);
     if(pa0 == 0)
       return -1;
diff --git a/user/usertests.c b/user/usertests.c
index 7da62d1..22b01a2 100644
--- a/user/usertests.c
+++ b/user/usertests.c
@@ -1908,15 +1908,18 @@ stacktest(char *s)
     exit(xstatus);
 }
 
-// copyinstr() used to cast the virtual page address to uint,
-// which (with certain wild system call arguments) could
-// result in a kernel page fault.
+// copyin(), copyout(), and copyinstr() used to cast the virtual page
+// address to uint, which (with certain wild system call arguments)
+// resulted in a kernel page faults.
 void
 pgbug(char *s)
 {
   char *argv[1];
   argv[0] = 0;
   exec((char*)0xeaeb0b5b00002f5e, argv);
+
+  pipe((int*)0xeaeb0b5b00002f5e);
+
   exit(0);
 }