diff --git a/core/emu.c b/core/emu.c
index 62d04595..462fbb6f 100644
--- a/core/emu.c
+++ b/core/emu.c
@@ -12,13 +12,14 @@
 #include <stdint.h>
 #include <stdlib.h>
 #include <stdio.h>
+#include <string.h>
 #include <ctype.h>
 
 #ifdef __EMSCRIPTEN__
 #include <emscripten.h>
 #endif
 
-#define IMAGE_VERSION 0xCECE001B
+#define IMAGE_VERSION 0xCECE001C
 
 void EMSCRIPTEN_KEEPALIVE emu_exit(void) {
     cpu_set_signal(CPU_SIGNAL_EXIT);
@@ -43,7 +44,7 @@ bool emu_save(emu_data_t type, const char *path) {
                 success = fwrite(&version, sizeof version, 1, file) == 1 && asic_save(file);
                 break;
             case EMU_DATA_ROM:
-                success = fwrite(mem.flash.block, 1, SIZE_FLASH, file) == SIZE_FLASH;
+                success = fwrite(mem.flash.block, 1, mem.flash.size, file) == mem.flash.size;
                 break;
             case EMU_DATA_RAM:
                 success = fwrite(mem.ram.block, 1, SIZE_RAM, file) == SIZE_RAM;
@@ -115,8 +116,8 @@ emu_state_t emu_load(emu_data_t type, const char *path) {
 
         if (fseek(file, 0L, SEEK_END) < 0) goto rerr;
         size = (size_t)ftell(file);
-        if (size > SIZE_FLASH) {
-            gui_console_err_printf("[CEmu] Invalid ROM size (%u bytes | max %u bytes)\n", (unsigned int)size, SIZE_FLASH);
+        if (size > SIZE_FLASH_MAX) {
+            gui_console_err_printf("[CEmu] Invalid ROM size (%u bytes | max %u bytes)\n", (unsigned int)size, SIZE_FLASH_MAX);
             goto rerr;
         }
         rewind(file);
@@ -124,6 +125,26 @@ emu_state_t emu_load(emu_data_t type, const char *path) {
         asic_free();
         asic_init();
 
+        /* Allocate FLASH memory */
+        if (size < SIZE_FLASH_MIN) {
+            mem.flash.size = SIZE_FLASH_MIN;
+        } else {
+            /* Round up to next power of 2 */
+            uint32_t rounded = size - 1;
+            rounded |= rounded >> 1;
+            rounded |= rounded >> 2;
+            rounded |= rounded >> 4;
+            rounded |= rounded >> 8;
+            rounded |= rounded >> 16;
+            mem.flash.size = rounded + 1;
+        }
+        mem.flash.block = malloc(mem.flash.size);
+        if (mem.flash.block == NULL) {
+            gui_console_err_printf("[CEmu] Error allocating memory for ROM\n");
+            goto rerr;
+        }
+        memset(mem.flash.block, 0xFF, mem.flash.size);
+
         if (fread(mem.flash.block, size, 1, file) != 1) {
             gui_console_err_printf("[CEmu] Error reading ROM image\n");
             goto rerr;
@@ -134,7 +155,7 @@ emu_state_t emu_load(emu_data_t type, const char *path) {
             outer = mem.flash.block;
 
             /* Outer 0x800(0) field. */
-            if (cert_field_get(outer + offset, SIZE_FLASH - offset, &field_type, &outer, &outer_field_size)) break;
+            if (cert_field_get(outer + offset, mem.flash.size - offset, &field_type, &outer, &outer_field_size)) break;
             if (field_type != 0x800F) continue;
 
             /* Inner 0x801(0) field: calculator model */
diff --git a/core/flash.c b/core/flash.c
index 5e50376a..be5f8842 100644
--- a/core/flash.c
+++ b/core/flash.c
@@ -39,7 +39,7 @@ static void flash_set_mask(void) {
                    | flash.maskReg[1] << 8
                    | flash.maskReg[2] << 16
                    | flash.maskReg[3] << 24;
-    flash.mask = ~value & (SIZE_FLASH - 1);
+    flash.mask = ~value & (mem.flash.size - 1);
 }
 
 void flash_flush_cache(void) {
@@ -108,9 +108,9 @@ static void flash_finish_command(void) {
 }
 
 static void flash_erase(uint32_t size) {
-    assert(!(size & (size - 1)));
+    assert(!(size & (size - 1)) && size <= mem.flash.size);
     if (flash.commandStatus[1] & 1 << 1) {
-        memset(&mem.flash.block[flash.commandAddress & (SIZE_FLASH - 1) & -size], 0xFF, size);
+        memset(&mem.flash.block[flash.commandAddress & (mem.flash.size - size)], 0xFF, size);
     }
     flash_finish_command();
 }
@@ -150,7 +150,7 @@ static void flash_execute_command(void) {
             flash_erase(64 << 10);
             break;
         case 0xC7: case 0x60: // Chip Erase
-            flash_erase(SIZE_FLASH);
+            flash_erase(mem.flash.size);
             break;
     }
     if (!flash.commandLength && flash.commandStatus[0] & 3 << 1) {
@@ -201,8 +201,14 @@ static uint8_t flash_read_command(bool peek) {
                     flash.commandAddress = 0;
                 }
                 addr = 0;
+            } else if (addr == 2) {
+                value = 0x16;
+                while ((1 << value) < mem.flash.size) {
+                    value++;
+                }
+            } else {
+                value = 0xEF40 >> (1 - addr) * 8;
             }
-            value = 0xEF4016 >> (2 - addr) * 8;
             if (!peek) {
                 flash.commandAddress++;
             }
@@ -213,7 +219,7 @@ static uint8_t flash_read_command(bool peek) {
 static void flash_write_command(uint8_t byte) {
     switch (flash.command[0xF]) {
         case 0x32: // Quad Input Page Program
-            mem.flash.block[flash.commandAddress & (SIZE_FLASH - 1)] &= byte;
+            mem.flash.block[flash.commandAddress & (mem.flash.size - 1)] &= byte;
             flash.commandAddress = (flash.commandAddress & ~0xFF) | ((flash.commandAddress + 1) & 0xFF);
             break;
     }
diff --git a/core/interrupt.c b/core/interrupt.c
index cdc333b4..77e1726c 100644
--- a/core/interrupt.c
+++ b/core/interrupt.c
@@ -123,19 +123,19 @@ eZ80portrange_t init_intrpt(void) {
 }
 
 bool intrpt_save(FILE *image) {
-    bool ret = false;
+    bool ret = true;
     size_t request;
     for (request = 0; request < sizeof(intrpt) / sizeof(*intrpt); request++) {
-        ret |= fwrite(&intrpt[request], sizeof(intrpt[request]), 1, image) == 1;
+        ret &= fwrite(&intrpt[request], sizeof(intrpt[request]), 1, image) == 1;
     }
     return ret;
 }
 
 bool intrpt_restore(FILE *image) {
-    bool ret = false;
+    bool ret = true;
     size_t request;
     for (request = 0; request < sizeof(intrpt) / sizeof(*intrpt); request++) {
-        ret |= fread(&intrpt[request], sizeof(intrpt[request]), 1, image) == 1;
+        ret &= fread(&intrpt[request], sizeof(intrpt[request]), 1, image) == 1;
     }
     return ret;
 }
diff --git a/core/lcd.c b/core/lcd.c
index 88c14af9..f26de73f 100644
--- a/core/lcd.c
+++ b/core/lcd.c
@@ -592,7 +592,7 @@ void emu_set_lcd_ptrs(uint32_t **dat, uint32_t **dat_end, int width, int height,
     }
 
     if (addr < 0xD00000) {
-        mem_end = mem.flash.block + SIZE_FLASH;
+        mem_end = mem.flash.block + mem.flash.size;
         data_start = mem.flash.block + addr;
     } else if (addr < 0xE00000) {
         mem_end = mem.ram.block + SIZE_RAM;
diff --git a/core/mem.c b/core/mem.c
index c9bae272..1119d877 100644
--- a/core/mem.c
+++ b/core/mem.c
@@ -26,18 +26,12 @@ static uint8_t mem_read_flash_serial(uint32_t);
 void mem_init(void) {
     unsigned int i;
 
-    /* Allocate FLASH memory */
-    mem.flash.block = (uint8_t*)malloc(SIZE_FLASH);
-    memset(mem.flash.block, 0xFF, SIZE_FLASH);
-
     for (i = 0; i < NUM_8K_SECTORS; i++) {
-        mem.flash.sector8k[i].ptr = mem.flash.block + i * SIZE_FLASH_SECTOR_8K;
         mem.flash.sector8k[i].ipb = 0;
         mem.flash.sector8k[i].dpb = 1;
     }
 
-    for (i = 0; i < NUM_SECTORS; i++) {
-        mem.flash.sector[i].ptr = mem.flash.block + i * SIZE_FLASH_SECTOR_64K;
+    for (i = 0; i < NUM_SECTORS_MAX; i++) {
         mem.flash.sector[i].ipb = 1;
         mem.flash.sector[i].dpb = 1;
     }
@@ -77,7 +71,7 @@ static uint32_t addr_block(uint32_t *addr, int32_t size, void **block, uint32_t
     if (*addr < 0xD00000) {
         *addr &= asic.serFlash ? flash.mask : flash.mappedBytes - 1;
         *block = mem.flash.block;
-        *block_size = SIZE_FLASH;
+        *block_size = mem.flash.size;
     } else if (*addr < 0xE00000) {
         *addr &= 0x07FFFF;
         *block = mem.ram.block;
@@ -184,6 +178,11 @@ void mem_dma_write(const void *buf, uint32_t addr, int32_t size) {
     }
 }
 
+static uint32_t flash_num_sectors(void) {
+    uint32_t num_sectors = mem.flash.size / SIZE_FLASH_SECTOR_64K;
+    return num_sectors >= NUM_SECTORS_MAX ? NUM_SECTORS_MAX : num_sectors;
+}
+
 static void flash_reset_write_index(uint32_t addr, uint8_t byte) {
     (void)addr;
     (void)byte;
@@ -208,21 +207,21 @@ static void flash_write(uint32_t addr, uint8_t byte) {
 }
 
 static void flash_erase(uint32_t addr, uint8_t byte) {
-    unsigned int i;
     (void)addr;
     (void)byte;
 
     mem.flash.command = FLASH_CHIP_ERASE;
 
-    for (i = 0; i < NUM_8K_SECTORS; i++) {
+    for (uint32_t i = 0; i < NUM_8K_SECTORS; i++) {
         if ((mem.flash.sector8k[i].ipb & mem.flash.sector8k[i].dpb) == 1) {
-            memset(mem.flash.sector8k[i].ptr, 0xFF, SIZE_FLASH_SECTOR_8K);
+            memset(&mem.flash.block[i * SIZE_FLASH_SECTOR_8K], 0xFF, SIZE_FLASH_SECTOR_8K);
         }
     }
 
-    for (i = 0; i < NUM_SECTORS; i++) {
+    uint32_t num_sectors = flash_num_sectors();
+    for (uint32_t i = 1; i < num_sectors; i++) {
         if ((mem.flash.sector[i].ipb & mem.flash.sector[i].dpb) == 1) {
-            memset(mem.flash.sector[i].ptr, 0xFF, SIZE_FLASH_SECTOR_64K);
+            memset(&mem.flash.block[i * SIZE_FLASH_SECTOR_64K], 0xFF, SIZE_FLASH_SECTOR_64K);
         }
     }
 
@@ -235,15 +234,15 @@ static void flash_erase_sector(uint32_t addr, uint8_t byte) {
 
     mem.flash.command = FLASH_SECTOR_ERASE;
 
-    if (addr < 0x10000) {
+    if (addr < SIZE_FLASH_SECTOR_8K * NUM_8K_SECTORS) {
         selected = addr / SIZE_FLASH_SECTOR_8K;
         if ((mem.flash.sector8k[selected].ipb & mem.flash.sector8k[selected].dpb) == 1) {
-            memset(mem.flash.sector8k[selected].ptr, 0xff, SIZE_FLASH_SECTOR_8K);
+            memset(&mem.flash.block[selected * SIZE_FLASH_SECTOR_8K], 0xFF, SIZE_FLASH_SECTOR_8K);
         }
     } else {
         selected = addr / SIZE_FLASH_SECTOR_64K;
         if ((mem.flash.sector[selected].ipb & mem.flash.sector[selected].dpb) == 1) {
-            memset(mem.flash.sector[selected].ptr, 0xff, SIZE_FLASH_SECTOR_64K);
+            memset(&mem.flash.block[selected * SIZE_FLASH_SECTOR_64K], 0xFF, SIZE_FLASH_SECTOR_64K);
         }
     }
 }
@@ -284,17 +283,17 @@ static void flash_enter_dpb(uint32_t addr, uint8_t byte) {
 }
 
 static void flash_erase_ipb(uint32_t addr, uint8_t byte) {
-    int i;
     (void)addr;
     (void)byte;
 
     if( mem.flash.command == FLASH_IPB_MODE )
     {
-        for (i = 0; i < NUM_8K_SECTORS; i++) {
+        for (uint32_t i = 0; i < NUM_8K_SECTORS; i++) {
             mem.flash.sector8k[i].ipb = 1;
         }
 
-        for (i = 0; i < NUM_SECTORS; i++) {
+        uint32_t num_sectors = flash_num_sectors();
+        for (uint32_t i = 1; i < num_sectors; i++) {
             mem.flash.sector[i].ipb = 1;
         }
 
@@ -485,9 +484,10 @@ static uint8_t mem_read_flash_parallel(uint32_t addr) {
         }
         cpu.cycles += flash.waitStates;
 
+        addr &= mem.flash.size - 1;
         switch(mem.flash.command) {
             case FLASH_NO_COMMAND:
-                value = mem.flash.block[addr & (SIZE_FLASH - 1)];
+                value = mem.flash.block[addr];
                 break;
             case FLASH_SECTOR_ERASE:
                 value = 0x80;
@@ -502,7 +502,7 @@ static uint8_t mem_read_flash_parallel(uint32_t addr) {
                 mem.flash.command = FLASH_NO_COMMAND;
                 break;
             case FLASH_READ_SECTOR_PROTECTION:
-                if (addr < 0x10000) {
+                if (addr < SIZE_FLASH_SECTOR_8K * NUM_8K_SECTORS) {
                     selected = addr / SIZE_FLASH_SECTOR_8K;
                     value = !(mem.flash.sector8k[selected].ipb & mem.flash.sector8k[selected].dpb);
                 } else {
@@ -511,19 +511,51 @@ static uint8_t mem_read_flash_parallel(uint32_t addr) {
                 }
                 break;
             case FLASH_READ_CFI:
-                if (addr >= 0x20 && addr <= 0x2A) {
-                    static const uint8_t id[7] = { 0x51, 0x52, 0x59, 0x02, 0x00, 0x40, 0x00 };
-                    value = id[(addr - 0x20) / 2];
-                } else if (addr >= 0x36 && addr <= 0x50) {
-                    static const uint8_t id[] = {
+                addr &= 0xFF;
+                if (addr >= 0x20 && addr < 0xB0) {
+                    /* W29GL032CB7S */
+                    static const uint8_t id_4mb[] = {
+                        /* Identification */
+                        0x51, 0x52, 0x59, 0x02, 0x00, 0x40, 0x00, 0x00,
+                        0x00, 0x00, 0x00,
+                        /* System Interface Data */
                         0x27, 0x36, 0x00, 0x00, 0x03, 0x04, 0x08, 0x0E,
-                        0x03, 0x05, 0x03, 0x03, 0x16, 0x02, 0x00, 0x05,
-                        0x00, 0x01, 0x08, 0x00, 0x00, 0x3F, 0x00, 0x00,
-                        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                        0x00, 0x00, 0x50, 0x52, 0x49, 0x31, 0x33, 0x0C,
-                        0x02, 0x01, 0x00, 0x08, 0x00, 0x00, 0x02, 0x95,
-                        0xA5, 0x02, 0x01 };
-                    value = id[(addr - 0x36) / 2];
+                        0x03, 0x05, 0x03, 0x03,
+                        /* Device Geometry */
+                        0x16, 0x02, 0x00, 0x05, 0x00, 0x02, 0x07, 0x00,
+                        0x20, 0x00, 0x3E, 0x00, 0x00, 0x01, 0x00, 0x00,
+                        0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                        /* Empty gap */
+                        0x00, 0x00, 0x00,
+                        /* Vendor-Specific */
+                        0x50, 0x52, 0x49, 0x31, 0x33, 0x0C, 0x02, 0x01,
+                        0x00, 0x08, 0x00, 0x00, 0x02, 0x95, 0xA5, 0x02,
+                        0x01,
+                        /* Undocumented */
+                        0x01, 0x08, 0x0F, 0x09, 0x05, 0x05, 0x00 };
+                    /* W29GL064CB7S */
+                    static const uint8_t id_8mb[] = {
+                        /* Identification */
+                        0x51, 0x52, 0x59, 0x02, 0x00, 0x40, 0x00, 0x00,
+                        0x00, 0x00, 0x00,
+                        /* System Interface Data */
+                        0x27, 0x36, 0x00, 0x00, 0x03, 0x04, 0x08, 0x0E,
+                        0x03, 0x05, 0x03, 0x03,
+                        /* Device Geometry */
+                        0x17, 0x02, 0x00, 0x05, 0x00, 0x02, 0x07, 0x00,
+                        0x20, 0x00, 0x7E, 0x00, 0x00, 0x01, 0x00, 0x00,
+                        0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                        /* Empty gap */
+                        0x00, 0x00, 0x00,
+                        /* Vendor-Specific */
+                        0x50, 0x52, 0x49, 0x31, 0x33, 0x0C, 0x02, 0x01,
+                        0x00, 0x08, 0x00, 0x00, 0x02, 0x95, 0xA5, 0x02,
+                        0x01,
+                        /* Undocumented (unverified) */
+                        0x01, 0x08, 0x0F, 0x09, 0x05, 0x05, 0x00 };
+                    value = (mem.flash.size == SIZE_FLASH_MIN ? id_4mb : id_8mb)[(addr - 0x20) / 2];
+                } else {
+                    value = 0xFF;
                 }
                 break;
             case FLASH_DEEP_POWER_DOWN:
@@ -597,6 +629,7 @@ static void mem_write_flash(uint32_t addr, uint8_t byte) {
     flash_write_t *w;
     flash_write_pattern_t *pattern;
 
+    addr &= mem.flash.size - 1;
     if (mem.flash.command != FLASH_NO_COMMAND) {
         if ((mem.flash.command != FLASH_DEEP_POWER_DOWN && byte == 0xF0) ||
             (mem.flash.command == FLASH_DEEP_POWER_DOWN && byte == 0xAB)) {
@@ -918,37 +951,38 @@ bool mem_save(FILE *image) {
     assert(mem.ram.block);
 
     return fwrite(&mem, sizeof(mem), 1, image) == 1 &&
-           fwrite(mem.flash.block, SIZE_FLASH, 1, image) == 1 &&
+           fwrite(mem.flash.block, mem.flash.size, 1, image) == 1 &&
            fwrite(mem.ram.block, SIZE_RAM, 1, image) == 1;
 }
 
 bool mem_restore(FILE *image) {
-    bool ret = false;
+    bool ret = true;
     unsigned int i;
     uint8_t *tmp_flash_ptr;
     uint8_t *tmp_ram_ptr;
 
-    assert(mem.flash.block);
     assert(mem.ram.block);
-
-    tmp_flash_ptr = mem.flash.block;
     tmp_ram_ptr = mem.ram.block;
 
-    ret |= fread(&mem, sizeof(mem), 1, image) == 1;
+    free(mem.flash.block);
 
-    mem.flash.block = tmp_flash_ptr;
-    mem.ram.block = tmp_ram_ptr;
+    ret &= fread(&mem, sizeof(mem), 1, image) == 1;
 
-    ret |= fread(mem.flash.block, SIZE_FLASH, 1, image) == 1 &&
-           fread(mem.ram.block, SIZE_RAM, 1, image) == 1;
+    mem.ram.block = tmp_ram_ptr;
+    mem.flash.block = NULL;
 
-    for (i = 0; i < 8; i++) {
-        mem.flash.sector[i].ptr = &mem.flash.block[i*SIZE_FLASH_SECTOR_8K];
+    if (mem.flash.size < SIZE_FLASH_MIN || mem.flash.size > SIZE_FLASH_MAX ||
+        (mem.flash.size & (mem.flash.size - 1))) {
+        return false;
     }
-    for (i = 0; i < 64; i++) {
-        mem.flash.sector[i].ptr = &mem.flash.block[i*SIZE_FLASH_SECTOR_64K];
+    mem.flash.block = malloc(mem.flash.size);
+    if (mem.flash.block == NULL) {
+        return false;
     }
 
+    ret &= fread(mem.flash.block, mem.flash.size, 1, image) == 1;
+    ret &= fread(mem.ram.block, SIZE_RAM, 1, image) == 1;
+
     mem_read_flash = asic.serFlash ? mem_read_flash_serial : mem_read_flash_parallel;
 
     return ret;
diff --git a/core/mem.h b/core/mem.h
index c8825862..5627186a 100644
--- a/core/mem.h
+++ b/core/mem.h
@@ -10,10 +10,12 @@ extern "C" {
 #include <stdbool.h>
 
 #define SIZE_RAM              0x65800
-#define SIZE_FLASH            0x400000
+#define SIZE_FLASH_MIN        0x400000
+#define SIZE_FLASH_MAX_PAR    0x800000
+#define SIZE_FLASH_MAX        0x2000000
 #define SIZE_FLASH_SECTOR_8K  0x2000
 #define SIZE_FLASH_SECTOR_64K 0x10000
-#define NUM_SECTORS 64
+#define NUM_SECTORS_MAX (SIZE_FLASH_MAX_PAR / SIZE_FLASH_SECTOR_64K)
 #define NUM_8K_SECTORS 8
 
 enum flash_commands {
@@ -38,15 +40,15 @@ typedef struct {
 typedef struct {
     uint8_t dpb : 1;
     uint8_t ipb : 1;
-    uint8_t *ptr;
 } flash_sector_state_t;
 
 typedef struct {
     uint8_t write;
     uint8_t read;
-    flash_sector_state_t sector8k[8];
-    flash_sector_state_t sector[64];
+    flash_sector_state_t sector8k[NUM_8K_SECTORS];
+    flash_sector_state_t sector[NUM_SECTORS_MAX];
     uint8_t *block;
+    uint32_t size;
 
     /* internal */
     uint8_t command;
diff --git a/core/vat.c b/core/vat.c
index b7e56c6d..c20241e2 100644
--- a/core/vat.c
+++ b/core/vat.c
@@ -318,7 +318,7 @@ bool vat_search_next(calc_var_t *var) {
     } else {
         var->namelen = 3;
     }
-    var->archived = var->address > 0xC0000 && var->address < 0x400000;
+    var->archived = var->address > 0xC0000 && var->address < 0xC00000;
     if (var->archived) {
         var->address += 9 + var->named + var->namelen;
     } else if (var->address < 0xD1A881 || var->address >= 0xD40000) {
diff --git a/gui/qt/debugger/hexwidget.cpp b/gui/qt/debugger/hexwidget.cpp
index 69084e0c..47892782 100644
--- a/gui/qt/debugger/hexwidget.cpp
+++ b/gui/qt/debugger/hexwidget.cpp
@@ -70,7 +70,7 @@ void HexWidget::scroll(int value) {
         }
     }
     if (value >= verticalScrollBar()->maximum()) {
-        int addr = m_maxOffset + m_base + 1;
+        int addr = m_base + m_size;
         QByteArray data;
         for (int i = 0; i < m_bytesPerLine && (addr + i) < 0x1000000; i++) {
             data.append(mem_peek_byte(addr + i));
@@ -118,10 +118,10 @@ int HexWidget::indexOf(const QByteArray &ba) {
 
 int HexWidget::indexNotOf(const QByteArray &ba) {
     int res = -1;
-    QByteArray buffer{m_data.mid(m_cursorOffset, m_maxOffset)};
+    QByteArray buffer{m_data.mid(m_cursorOffset / 2)};
     std::size_t found = buffer.toStdString().find_first_not_of(ba.toStdString());
     if (found != std::string::npos) {
-        setOffset(res = static_cast<int>(found));
+        setOffset(res = static_cast<int>(m_cursorOffset / 2 + found));
     }
     return res;
 }
@@ -144,8 +144,8 @@ void HexWidget::setHighlight(const int address) {
 }
 
 void HexWidget::setCursorOffset(int offset, bool selection, bool clearHighlight) {
-    if (offset > m_size * 2) {
-        offset = m_size * 2;
+    if (offset >= m_size * 2) {
+        offset = m_size * 2 - 1;
     }
     if (offset < 0) {
         offset = 0;
@@ -213,7 +213,6 @@ void HexWidget::showCursor() {
 
 void HexWidget::adjust() {
     m_size = m_data.size();
-    m_maxOffset = m_size - 1;
 
     m_charWidth = fontMetrics().horizontalAdvance(QLatin1Char('D'));
     m_charHeight = fontMetrics().height();
@@ -234,20 +233,20 @@ void HexWidget::adjust() {
     horizontalScrollBar()->setRange(0, xWidth - viewport()->width());
     horizontalScrollBar()->setPageStep(viewport()->width());
 
-    int rows = m_size / m_bytesPerLine;
+    int rows = (m_size + m_bytesPerLine - 1) / m_bytesPerLine;
     int visibleHeight = viewport()->height() - m_gap;
     if (horizontalScrollBar()->isVisible()) {
         visibleHeight -= horizontalScrollBar()->height();
     }
     m_visibleRows = visibleHeight / m_charHeight;
-    verticalScrollBar()->setRange(0, rows - m_visibleRows);
+    verticalScrollBar()->setRange(0, rows - m_visibleRows - 1);
     verticalScrollBar()->setPageStep(m_visibleRows);
 
     int lines = verticalScrollBar()->value();
     m_lineStart = lines * m_bytesPerLine;
     m_lineEnd = m_lineStart + m_visibleRows * m_bytesPerLine - 1;
     if (m_lineEnd >= m_size) {
-        m_lineEnd = m_maxOffset;
+        m_lineEnd = m_size - 1;
     }
 
     int x, y = (((m_cursorOffset / 2) - m_lineStart) / m_bytesPerLine + 1) * m_charHeight;
@@ -363,9 +362,7 @@ void HexWidget::paintEvent(QPaintEvent *event) {
         if (addr + m_base > 0xffffff) { break; }
         painter.setPen(cText);
         painter.drawText(xAddr, y, int2hex(m_base + lineAddr, 6));
-        for (int col = 0; col < m_bytesPerLine && addr < m_maxOffset; col++) {
-            addr = lineAddr + col;
-
+        for (int col = 0; col < m_bytesPerLine && addr < m_size; col++, addr++) {
             painter.setPen(cText);
             uint8_t data = static_cast<uint8_t>(m_data[addr]);
             uint8_t flags = debug.addr[addr + m_base];
diff --git a/gui/qt/debugger/hexwidget.h b/gui/qt/debugger/hexwidget.h
index bf79a4a5..af9205d5 100644
--- a/gui/qt/debugger/hexwidget.h
+++ b/gui/qt/debugger/hexwidget.h
@@ -91,7 +91,6 @@ private slots:
     QByteArray m_data;
     QByteArray m_modified;
     int m_size;
-    int m_maxOffset;
 
     QRect m_cursor;
     int m_cursorOffset = 0;
diff --git a/gui/qt/memorywidget.cpp b/gui/qt/memorywidget.cpp
index f6f43e3a..a9cc4d1b 100644
--- a/gui/qt/memorywidget.cpp
+++ b/gui/qt/memorywidget.cpp
@@ -46,7 +46,7 @@ void MainWindow::flashUpdate() const {
         return;
     }
 
-    ui->flashEdit->setData({reinterpret_cast<const char *>(mem.flash.block), 0x400000});
+    ui->flashEdit->setData({reinterpret_cast<const char *>(mem.flash.block), qMin(mem.flash.size, UINT32_C(0xC00000))});
 }
 
 void MainWindow::ramUpdate() const {
@@ -71,7 +71,7 @@ void MainWindow::memUpdateEdit(HexWidget *edit, bool force) {
         int base = edit->getBase();
         int addr = off + base;
         int start = addr - 0x1000;
-        int end = addr + 0x1000;
+        int end = addr + 0x1000 - 1;
         off = 0x1000;
 
         if (start < 0) {
@@ -83,7 +83,7 @@ void MainWindow::memUpdateEdit(HexWidget *edit, bool force) {
         }
         data.resize(end - start + 1);
 
-        for (int j = 0, i = start; i < end; j++, i++) {
+        for (int j = 0, i = start; i <= end; j++, i++) {
             data[j] = static_cast<char>(mem_peek_byte(static_cast<uint32_t>(i)));
         }
 
@@ -248,7 +248,7 @@ void MainWindow::memSync(HexWidget *edit) {
 
 void MainWindow::flashSyncPressed() {
     if (ui->flashEdit->modifiedCount()) {
-        memcpy(mem.flash.block, ui->flashEdit->data(), 0x400000);
+        memcpy(mem.flash.block, ui->flashEdit->data(), qMin(mem.flash.size, (uint32_t)ui->flashEdit->getSize()));
     }
     memSync(ui->flashEdit);
 }