diff --git a/exosphere/src/cpu_context.c b/exosphere/src/cpu_context.c
index e78ac7a6f..9fdee9722 100644
--- a/exosphere/src/cpu_context.c
+++ b/exosphere/src/cpu_context.c
@@ -58,8 +58,6 @@ void core_jump_to_lower_el(void) {
     __sev();
 
     /* Nintendo jumps to EL1, we jump to EL2. Both are supported with all current packages2. */
-    /* TODO: Remove this panic() when we're ready to test Kernel handoff. */
-    panic(0x7A700001); 
     __jump_to_lower_el(arg, ep, 2);
 }
 
diff --git a/exosphere/src/start.s b/exosphere/src/start.s
index 13536c1e0..441433681 100644
--- a/exosphere/src/start.s
+++ b/exosphere/src/start.s
@@ -214,7 +214,7 @@ __jump_to_lower_el:
     msr  elr_el3, x1
 
     mov  w1, #(0b1111 << 6 | 1) /* DAIF set and SP = SP_ELx*/
-    orr  w1, w2, w2, lsl#2
+    orr  w1, w1, w2, lsl#2
     msr  spsr_el3, x1
 
     bl __set_exception_entry_stack_pointer
diff --git a/exosphere/src/warmboot_init.c b/exosphere/src/warmboot_init.c
index d3bd83a19..b5eb125da 100644
--- a/exosphere/src/warmboot_init.c
+++ b/exosphere/src/warmboot_init.c
@@ -28,8 +28,8 @@ void warmboot_crt0_critical_section_enter(volatile critical_section_t *critical_
 }
 
 void set_memory_registers_enable_mmu(void) {
-    static const uintptr_t vbar  = TZRAM_GET_SEGMENT_PA(TZRAM_SEGEMENT_ID_SECMON_EVT) + 0x800;
-    static const uintptr_t ttbr0 = vbar - 64;
+    static const uintptr_t vbar  = TZRAM_GET_SEGMENT_ADDRESS(TZRAM_SEGEMENT_ID_SECMON_EVT) + 0x800;
+    static const uintptr_t ttbr0 = TZRAM_GET_SEGMENT_PA(TZRAM_SEGEMENT_ID_SECMON_EVT) + 0x800 - 64;
 
     /*
         - Disable table walk descriptor access prefetch.