index 0000000..b1c380f
--- /dev/null
+++ b/hw/atapi-pt.c
-@@ -0,0 +1,964 @@
+@@ -0,0 +1,970 @@
+#define DEBUG_IDE_ATAPI_PT
+
+#define MSF_TO_FRAMES(M, S, F) (((M) * CD_SECS + (S)) * CD_FRAMES + (F))
+ cmd->din_xferp = (__u64)s->io_buffer;
+ s->atapi_pt.cmd_sent = ide_atapi_pt_standard_reply;
+ s->atapi_pt.reply_size_len = 2;
++ s->atapi_pt.reply_size_init = 2;
+ ATAPI_PT_SEND_PACKET;
+ return;
+
+ int blocksize = 0, nbblocks;
+
+ switch (s->io_buffer[0]) {
-+ case GPCMD_READ_10: blocksize = CD_FRAMESIZE; break;
-+ case GPCMD_READ_12: blocksize = CD_FRAMESIZE_RAW0; break;
++ case GPCMD_READ_10:
++ blocksize = CD_FRAMESIZE;
++ nbblocks = ube16_to_cpu(s->io_buffer + 7);
++ break;
++ case GPCMD_READ_12:
++ blocksize = CD_FRAMESIZE_RAW0;
++ nbblocks = ube32_to_cpu(s->io_buffer + 6);
++ break;
+ default: assert(0);
+ }
-+ nbblocks = ube16_to_cpu(s->io_buffer + 7);
+ cmd->din_xfer_len = nbblocks * blocksize;
+ cmd->din_xferp = (__u64)s->io_buffer;
+ s->atapi_pt.cmd_sent = ide_atapi_pt_standard_reply;