diff -r 4001ab0d5785 xen/arch/x86/mm/paging.c
--- a/xen/arch/x86/mm/paging.c	Fri Jun 25 13:23:49 2010 +0100
+++ b/xen/arch/x86/mm/paging.c	Fri Jun 25 14:35:19 2010 +0100
@@ -700,23 +700,21 @@
      */
     switch ( sc->op )
     {
+
+    case XEN_DOMCTL_SHADOW_OP_ENABLE:
+        if ( !(sc->mode & XEN_DOMCTL_SHADOW_ENABLE_LOG_DIRTY) )
+            break;
+        /* Else fall through... */
     case XEN_DOMCTL_SHADOW_OP_ENABLE_LOGDIRTY:
         if ( hap_enabled(d) )
             hap_logdirty_init(d);
         return paging_log_dirty_enable(d);
 
-    case XEN_DOMCTL_SHADOW_OP_ENABLE:
-        if ( sc->mode & XEN_DOMCTL_SHADOW_ENABLE_LOG_DIRTY )
-        {
-            if ( hap_enabled(d) )
-                hap_logdirty_init(d);
-            return paging_log_dirty_enable(d);
-        }
-
     case XEN_DOMCTL_SHADOW_OP_OFF:
         if ( paging_mode_log_dirty(d) )
             if ( (rc = paging_log_dirty_disable(d)) != 0 )
                 return rc;
+        break;
 
     case XEN_DOMCTL_SHADOW_OP_CLEAN:
     case XEN_DOMCTL_SHADOW_OP_PEEK:
diff -r 4001ab0d5785 xen/arch/x86/mm/shadow/common.c
--- a/xen/arch/x86/mm/shadow/common.c	Fri Jun 25 13:23:49 2010 +0100
+++ b/xen/arch/x86/mm/shadow/common.c	Fri Jun 25 14:35:19 2010 +0100
@@ -3241,9 +3241,12 @@
         {
             int i;
             mfn_t *oos_snapshot = v->arch.paging.shadow.oos_snapshot;
-            for(i = 0; i < SHADOW_OOS_PAGES; i++)
+            for ( i = 0; i < SHADOW_OOS_PAGES; i++ )
                 if ( mfn_valid(oos_snapshot[i]) )
+                {
                     shadow_free(d, oos_snapshot[i]);
+                    oos_snapshot[i] = _mfn(INVALID_MFN);
+                }
         }
 #endif /* OOS */
     }
@@ -3395,17 +3398,23 @@
 #endif
                 make_cr3(v, pagetable_get_pfn(v->arch.guest_table));
 
+#if (SHADOW_OPTIMIZATIONS & SHOPT_OUT_OF_SYNC) 
+            {
+                int i;
+                mfn_t *oos_snapshot = v->arch.paging.shadow.oos_snapshot;
+                for ( i = 0; i < SHADOW_OOS_PAGES; i++ )
+                    if ( mfn_valid(oos_snapshot[i]) )
+                    {
+                        shadow_free(d, oos_snapshot[i]);
+                        oos_snapshot[i] = _mfn(INVALID_MFN);
+                    }
+            }
+#endif /* OOS */
         }
 
         /* Pull down the memory allocation */
         if ( sh_set_allocation(d, 0, NULL) != 0 )
-        {
-            // XXX - How can this occur?
-            //       Seems like a bug to return an error now that we've
-            //       disabled the relevant shadow mode.
-            //
-            return -ENOMEM;
-        }
+            BUG(); /* In fact, we will have BUG()ed already */
         shadow_hash_teardown(d);
         SHADOW_PRINTK("un-shadowing of domain %u done."
                        "  Shadow pages total = %u, free = %u, p2m=%u\n",