diff --git a/reactos/drivers/dd/blue/blue.c b/reactos/drivers/dd/blue/blue.c
index 0c624211945..092cee40e74 100644
--- a/reactos/drivers/dd/blue/blue.c
+++ b/reactos/drivers/dd/blue/blue.c
@@ -1,4 +1,4 @@
-/* $Id: blue.c,v 1.46 2004/05/15 22:45:50 hbirr Exp $
+/* $Id: blue.c,v 1.47 2004/07/20 11:06:47 navaraf Exp $
  *
  * COPYRIGHT:            See COPYING in the top level directory
  * PROJECT:              ReactOS kernel
@@ -493,7 +493,7 @@ ScrIoControl(PDEVICE_OBJECT DeviceObject,
           offset = (pCoord->Y * DeviceExtension->Columns * 2) +
                    (pCoord->X * 2) + 1;
 
-          for (dwCount = 0; dwCount < (stk->Parameters.DeviceIoControl.InputBufferLength - sizeof( COORD )); dwCount++, pAttr++)
+          for (dwCount = 0; dwCount < (stk->Parameters.DeviceIoControl.OutputBufferLength - sizeof( COORD )); dwCount++, pAttr++)
             {
               vidmem[offset + (dwCount * 2)] = *pAttr;
             }
diff --git a/reactos/ntoskrnl/io/buildirp.c b/reactos/ntoskrnl/io/buildirp.c
index e99da3a20fa..4ee36f2ee29 100644
--- a/reactos/ntoskrnl/io/buildirp.c
+++ b/reactos/ntoskrnl/io/buildirp.c
@@ -1,4 +1,4 @@
-/* $Id: buildirp.c,v 1.40 2004/06/19 08:53:35 vizzini Exp $
+/* $Id: buildirp.c,v 1.41 2004/07/20 11:06:47 navaraf Exp $
  *
  * COPYRIGHT:       See COPYING in the top level directory
  * PROJECT:         ReactOS kernel
@@ -277,36 +277,33 @@ IoBuildDeviceIoControlRequest(ULONG IoControlCode,
       case METHOD_IN_DIRECT:
 	DPRINT("Using METHOD_IN_DIRECT!\n");
 	
-	/* build output buffer (control buffer) */
-	if (OutputBuffer && OutputBufferLength)
+	/* build input buffer (control buffer) */
+	if (InputBuffer && InputBufferLength)
 	  {
-	     Irp->AssociatedIrp.SystemBuffer = (PVOID)
-               ExAllocatePoolWithTag(NonPagedPool,OutputBufferLength, 
+            Irp->AssociatedIrp.SystemBuffer = (PVOID)
+               ExAllocatePoolWithTag(NonPagedPool,InputBufferLength, 
 				     TAG_SYS_BUF);
-
-	     if (Irp->AssociatedIrp.SystemBuffer == NULL)
+	     
+	     if (Irp->AssociatedIrp.SystemBuffer==NULL)
 	       {
 		  IoFreeIrp(Irp);
 		  return(NULL);
 	       }
-
-	     RtlZeroMemory(Irp->AssociatedIrp.SystemBuffer, OutputBufferLength);
-	     Irp->UserBuffer = OutputBuffer;
+	     
+            RtlCopyMemory(Irp->AssociatedIrp.SystemBuffer,
+			  InputBuffer,
+			  InputBufferLength);
 	  }
 	
-         /* build input buffer (data transfer buffer) */
-	if (InputBuffer && InputBufferLength)
+	/* build output buffer (data transfer buffer) */
+         if (OutputBuffer && OutputBufferLength)
 	  {
-	     Irp->MdlAddress = IoAllocateMdl(InputBuffer,
-					     InputBufferLength,
+	     Irp->MdlAddress = IoAllocateMdl(OutputBuffer,
+					     OutputBufferLength,
 					     FALSE,
 					     FALSE,
-					     Irp);
-	     if(Irp->MdlAddress == NULL) {
-		IoFreeIrp(Irp);
-		return(NULL);
-	     }
-	     MmProbeAndLockPages (Irp->MdlAddress,UserMode,IoReadAccess);
+					    Irp);
+	     MmProbeAndLockPages(Irp->MdlAddress,UserMode,IoReadAccess);
 	  }
 	break;
 	
diff --git a/reactos/ntoskrnl/io/cleanup.c b/reactos/ntoskrnl/io/cleanup.c
index f9bb8995346..8a5b49e6199 100644
--- a/reactos/ntoskrnl/io/cleanup.c
+++ b/reactos/ntoskrnl/io/cleanup.c
@@ -73,23 +73,7 @@ VOID IoDeviceControlCompletion(PDEVICE_OBJECT DeviceObject,
 	
       case METHOD_IN_DIRECT:
 	DPRINT ("Using METHOD_IN_DIRECT!\n");
-
-	/* copy output buffer back and free it */
-        if (Irp->AssociatedIrp.SystemBuffer)
-	  {
-	     if (OutputBufferLength)
-	       {
-		  RtlCopyMemory(Irp->UserBuffer,
-				Irp->AssociatedIrp.SystemBuffer,
-				OutputBufferLength);
-	       }
-	    ExFreePool (Irp->AssociatedIrp.SystemBuffer);
-	  }
-	
-	/* free input buffer (data transfer buffer) */
-	if (Irp->MdlAddress)
-	  IoFreeMdl (Irp->MdlAddress);
-	break;
+	/* use the same code as for METHOD_OUT_DIRECT */
 	
       case METHOD_OUT_DIRECT:
 	DPRINT ("Using METHOD_OUT_DIRECT!\n");
diff --git a/reactos/subsys/csrss/win32csr/tuiconsole.c b/reactos/subsys/csrss/win32csr/tuiconsole.c
index ac7bc99dc3d..bdf65b5bad2 100644
--- a/reactos/subsys/csrss/win32csr/tuiconsole.c
+++ b/reactos/subsys/csrss/win32csr/tuiconsole.c
@@ -1,4 +1,4 @@
-/* $Id: tuiconsole.c,v 1.1 2004/01/11 17:31:16 gvg Exp $
+/* $Id: tuiconsole.c,v 1.2 2004/07/20 11:06:47 navaraf Exp $
  *
  * COPYRIGHT:       See COPYING in the top level directory
  * PROJECT:         ReactOS system libraries
@@ -113,7 +113,7 @@ TuiDrawRegion(PCSRSS_CONSOLE Console, RECT *Region)
   TuiCopyRect((char *) (ConsoleDraw + 1), Buff, Region);
   
   if (! DeviceIoControl(ConsoleDeviceHandle, IOCTL_CONSOLE_DRAW,
-                        ConsoleDraw, ConsoleDrawSize, NULL, 0, &BytesReturned, NULL))
+                        NULL, 0, ConsoleDraw, ConsoleDrawSize, &BytesReturned, NULL))
     {
       DPRINT1("Failed to draw console\n");
       HeapFree(Win32CsrApiHeap, 0, ConsoleDraw);
@@ -307,7 +307,7 @@ TuiSwapConsole(int Next)
       /* redraw the console to clear off old title */
       ConioDrawConsole(ActiveConsole);
       if (! DeviceIoControl(ConsoleDeviceHandle, IOCTL_CONSOLE_WRITE_OUTPUT_CHARACTER,
-                            Buffer, sizeof(COORD) + Title.Length, NULL, 0,
+                            NULL, 0, Buffer, sizeof(COORD) + Title.Length,
                             &BytesReturned, NULL))
         {
           DPRINT1( "Error writing to console\n" );