diff --git a/qemu-fix-load-linux.patch b/qemu-fix-load-linux.patch
new file mode 100644
index 0000000..b0d4436
--- /dev/null
+++ b/qemu-fix-load-linux.patch
@@ -0,0 +1,45 @@
+From 7a53bcbef278b4191d5cb497ef2b81509a00f670 Mon Sep 17 00:00:00 2001
+From: Mark McLoughlin <markmc@redhat.com>
+Date: Wed, 13 May 2009 12:59:47 +0100
+Subject: [PATCH 1/1] Fix load_linux reset handling fix
+
+This fix on the stable branch:
+
+  commit 2da1e398641d9fccf683645c808dee0d088f84cf
+  Author: Glauber Costa <glommer@redhat.com>
+  Date:   Fri May 8 02:22:13 2009 -0300
+
+    reset state for load_linux
+
+Caused -kernel to break.
+
+The problem is that we're passing the ROM's ram_addr_t to
+load_linux() rather than its target_phys_addr_t. We also
+need to register the memory before trying to write to
+it.
+
+Signed-off-by: Mark McLoughlin <markmc@redhat.com>
+---
+ hw/pc.c |    4 ++--
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/hw/pc.c b/hw/pc.c
+index 062c306..e69a1f7 100644
+--- a/hw/pc.c
++++ b/hw/pc.c
+@@ -954,10 +954,10 @@ vga_bios_error:
+         offset = option_rom_start;
+         if (linux_boot) {
+             option_rom_offset = qemu_ram_alloc(TARGET_PAGE_SIZE);
+-            load_linux(option_rom_offset,
+-                       kernel_filename, initrd_filename, kernel_cmdline);
+             cpu_register_physical_memory(option_rom_start, TARGET_PAGE_SIZE,
+                                          option_rom_offset);
++            load_linux(option_rom_start,
++                       kernel_filename, initrd_filename, kernel_cmdline);
+             offset += TARGET_PAGE_SIZE;
+         }
+ 
+-- 
+1.6.2.2
+
diff --git a/qemu-roms-more-room.patch b/qemu-roms-more-room.patch
index b4c0ec1..d8c5984 100644
--- a/qemu-roms-more-room.patch
+++ b/qemu-roms-more-room.patch
@@ -97,7 +97,7 @@ diff -urp qemu-kvm-0.10.4.orig/hw/pc.c qemu-kvm-0.10.4/hw/pc.c
 +            cpu_register_physical_memory(option_rom_start, TARGET_PAGE_SIZE,
                                           option_rom_offset);
 -            offset = TARGET_PAGE_SIZE;
-+            offset = +TARGET_PAGE_SIZE;
++            offset += TARGET_PAGE_SIZE;
          }
  
          for (i = 0; i < nb_option_roms; i++) {
diff --git a/qemu.spec b/qemu.spec
index c8a7e77..0096df1 100644
--- a/qemu.spec
+++ b/qemu.spec
@@ -1,7 +1,7 @@
 Summary: QEMU is a FAST! processor emulator
 Name: qemu
 Version: 0.10.4
-Release: 1%{?dist}
+Release: 2%{?dist}
 # Epoch because we pushed a qemu-1.0 package
 Epoch: 2
 License: GPLv2+ and LGPLv2+ and BSD
@@ -28,6 +28,7 @@ Patch12: qemu-roms-more-room.patch
 Patch13: qemu-roms-more-room-fix-vga-align.patch
 Patch14: qemu-bios-bigger-roms.patch
 Patch15: qemu-kvm-fix-kerneldir-includes.patch
+Patch16: qemu-fix-load-linux.patch
 
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 BuildRequires: SDL-devel zlib-devel which texi2html gnutls-devel cyrus-sasl-devel
@@ -223,6 +224,7 @@ such as kvmtrace and kvm_stat.
 %patch13 -p1
 %patch14 -p1
 %patch15 -p1
+%patch16 -p1
 
 %build
 # systems like rhel build system does not have a recent enough linker so
@@ -465,6 +467,9 @@ fi
 %{_mandir}/man1/qemu-img.1*
 
 %changelog
+* Wed May 13 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.10.4-2
+- Fix -kernel bustage in upstream 0.10.4
+
 * Tue May 12 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.10.4-1
 - Update to 0.10.4
 - Fix yet more qcow2 corruption (#498405)