diff --git a/kernel/main.asm b/kernel/main.asm
index 12ad3af..9f21611 100644
--- a/kernel/main.asm
+++ b/kernel/main.asm
@@ -5,16 +5,20 @@ optrom_length:
   db 0x00
   jmp optrom_init
 
+; reserved area
 times (0x1A - ($-$$)) db 0
   dw pnp
 
 align 16
 pnp:
   db "$PnP"
+.version:
   db 1 ; version 1
+.length:
   db 2 ; 2 * 16 length
   dw 0 ; offset of next header
   db 0
+.checksum:
   db 0 ; checksum (filled by fix-rom)
   dd 0 ; device identifier
   dw str_vendor ; manufacturer string
@@ -32,7 +36,6 @@ str_vendor:
 str_product:
   db "Nero DOS ", 60, 234, 62, 0
 
-align 16
 optrom_init:
   ; setup data stack below code stack
   mov bp, sp
@@ -74,26 +77,21 @@ start:
   mov ss, ax
   mov sp, ax
   mov bp, sp
-  ; data stack starts 512 bytes below code stack
-  sub bp, 0x200
 
   call announce
+  call malloc_reset
 
-  sub bp, 4
-  mov word [ss:bp], 3
-  mov word [ss:bp+2], isr_debug
-  call intr_register
-
-  sti
-
-  int 3
+  call malloc_dump
 
+  cli
 .halt:
   hlt
   jmp .halt
 
-%include "ramdisk.inc"
 %include "printf.inc"
+%include "print.asm"
+
+%include "popcnt.asm"
 
 %include "intr.asm"
 %include "debug.asm"
diff --git a/kernel/malloc.asm b/kernel/malloc.asm
index 2f70a91..d9d2191 100644
--- a/kernel/malloc.asm
+++ b/kernel/malloc.asm
@@ -1,11 +1,11 @@
 ; All these functions assume DS=0
 
-malloc_reserve_16:
+malloc_reserve:
   push bx
   call malloc_mark_allocated
   pop bx
   add bx, 0x10
-  loop malloc_reserve_16
+  loop malloc_reserve
   ret
 
 malloc_reset:
@@ -18,17 +18,17 @@ malloc_reset:
   ; reserve IVT and BDA
   xor bx, bx
   mov cx, 0x50
-  call malloc_reserve_16
+  call malloc_reserve
 
   ; reserve malloc table itself
   mov bx, 0x0600
   mov cx, 0x20
-  call malloc_reserve_16
+  call malloc_reserve
 
   ; reserve location for chainloaded boot sector
   mov bx, 0x7C00
   mov cx, 0x20
-  call malloc_reserve_16
+  call malloc_reserve
   ret
 
 ; Input:
@@ -77,3 +77,23 @@ malloc_mark_free:
   not al
   and byte [bx+di], al
   ret
+
+malloc_dump:
+  call malloc_get_table
+  mov si, di
+  mov cx, 0x200
+  xor dx, dx
+.loop:
+  lodsb
+  call print8
+  xor ah, ah
+  call popcnt
+  add dx, ax
+  loop .loop
+  mov cl, 6
+  shr dx, cl
+  push dx
+  call printf
+  db " data %UkB", 0x0A, 0x0D, 0x00
+  pop dx
+  ret
diff --git a/lib/popcnt.asm b/lib/popcnt.asm
new file mode 100644
index 0000000..52d6fb2
--- /dev/null
+++ b/lib/popcnt.asm
@@ -0,0 +1,30 @@
+popcnt:
+  push bx
+  push cx
+
+  mov bx, ax
+  and ax, 0x5555 ; 8x 01
+  and bx, 0xaaaa ; 8x 10
+  sar bx, 1
+  add ax, bx
+
+  mov bx, ax
+  and ax, 0x3333 ; 4x 0011
+  and bx, 0xcccc ; 4x 1100
+  mov cl, 2
+  sar bx, cl
+  add ax, bx
+
+  mov bx, ax
+  and ax, 0x0f0f ; 2x 00001111
+  and bx, 0xf0f0 ; 2x 11110000
+  mov cl, 4
+  sar bx, cl
+  add ax, bx
+
+  add al, ah
+  xor ah, ah
+
+  pop cx
+  pop bx
+  ret