diff --git a/vm/address-space.c b/vm/address-space.c
index 60d1ee3..2b3cf2a 100644
--- a/vm/address-space.c
+++ b/vm/address-space.c
@@ -141,16 +141,16 @@ static struct vm_area *get_entry(
 
 		if (address < child->vma_base) {
 			next = btree_left(cur);
-			if (LEFT_DIFF(address, child)
-			    < LEFT_DIFF(address, closest_left)) {
-				closest_left = child;
-			}
-		} else if (address > child->vma_limit) {
-			next = btree_right(cur);
 			if (RIGHT_DIFF(address, child)
 			    < RIGHT_DIFF(address, closest_right)) {
 				closest_right = child;
 			}
+		} else if (address > child->vma_limit) {
+			next = btree_right(cur);
+			if (LEFT_DIFF(address, child)
+			    < LEFT_DIFF(address, closest_left)) {
+				closest_left = child;
+			}
 		} else {
 			result = child;
 			break;
@@ -995,9 +995,11 @@ kern_status_t address_space_unmap(
 			= (area_base <= unmap_base
 		           && area_limit >= unmap_limit);
 		bool left_reduce
-			= (unmap_base <= area_base && unmap_limit < area_limit);
+			= (unmap_base <= area_base && unmap_limit > area_base
+		           && unmap_limit < area_limit);
 		bool right_reduce
-			= (unmap_base > area_base && unmap_limit >= area_limit);
+			= (unmap_base > area_base && unmap_base < area_limit
+		           && unmap_limit >= area_limit);
 
 		if (split) {
 			status = split_area(
@@ -1135,9 +1137,10 @@ kern_status_t address_space_release(
 		           && area_limit >= release_limit);
 		bool left_reduce
 			= (release_base <= area_base
+		           && release_limit > area_base
 		           && release_limit < area_limit);
 		bool right_reduce
-			= (release_base > area_base
+			= (release_base > area_base && release_base < area_limit
 		           && release_limit >= area_limit);
 
 		if (split) {