diff -r d2a32e24fe50 xen/arch/x86/mm/p2m.c
--- a/xen/arch/x86/mm/p2m.c	Wed Sep 09 16:39:41 2009 +0100
+++ b/xen/arch/x86/mm/p2m.c	Fri Sep 11 11:33:39 2009 +0100
@@ -307,6 +307,17 @@
     }
 #endif
 
+    /* Pages from domain_alloc and returned by the balloon driver aren't
+     * guaranteed to be zero; but by reclaiming zero pages, we implicitly promise
+     * to provide zero pages.  So we scrub pages before using */
+    for ( i=0; i< 1 << order ; i++)
+    {
+        char * b;
+        b = map_domain_page(mfn_x(page_to_mfn(page)) + i);
+        clear_page(b);
+        unmap_domain_page(b);
+    }
+
     spin_lock(&d->page_alloc_lock);
 
     /* First, take all pages off the domain list */