diff --git a/xen/arch/arm/mm.c b/xen/arch/arm/mm.c
index 65552da..4d27cc3 100644
--- a/xen/arch/arm/mm.c
+++ b/xen/arch/arm/mm.c
@@ -915,6 +915,8 @@ void __init setup_frametable_mappings(paddr_t ps, paddr_t pe)
            frametable_size - (nr_pdxs * sizeof(struct page_info)));
 
     frametable_virt_end = FRAMETABLE_VIRT_START + (nr_pdxs * sizeof(struct page_info));
+
+    printk("BW_DEBUG: 00 count_info=0x%016lx\n", mfn_to_page(_mfn(0x01533))->count_info);
 }
 
 void *__init arch_vmap_virt_end(void)
diff --git a/xen/arch/arm/setup.c b/xen/arch/arm/setup.c
index fca7e68..c0ef166 100644
--- a/xen/arch/arm/setup.c
+++ b/xen/arch/arm/setup.c
@@ -829,11 +829,17 @@ void __init start_xen(unsigned long boot_phys_offset,
 
     setup_mm();
 
+    printk("BW_DEBUG: .3 count_info=0x%016lx\n", mfn_to_page(_mfn(0x01533))->count_info);
+
     /* Parse the ACPI tables for possible boot-time configuration */
     acpi_boot_table_init();
 
+    printk("BW_DEBUG: .6 count_info=0x%016lx\n", mfn_to_page(_mfn(0x01533))->count_info);
+
     end_boot_allocator();
 
+    printk("BW_DEBUG: 01 count_info=0x%016lx\n", mfn_to_page(_mfn(0x01533))->count_info);
+
     /*
      * The memory subsystem has been initialized, we can now switch from
      * early_boot -> boot.
@@ -858,6 +864,8 @@ void __init start_xen(unsigned long boot_phys_offset,
 
     platform_init();
 
+    printk("BW_DEBUG: 02 count_info=0x%016lx\n", mfn_to_page(_mfn(0x01533))->count_info);
+
     preinit_xen_time();
 
     gic_preinit();
@@ -866,6 +874,7 @@ void __init start_xen(unsigned long boot_phys_offset,
     console_init_preirq();
     console_init_ring();
 
+    printk("BW_DEBUG:2.5 count_info=0x%016lx\n", mfn_to_page(_mfn(0x01533))->count_info);
     processor_id();
 
     smp_init_cpus();
@@ -873,6 +882,8 @@ void __init start_xen(unsigned long boot_phys_offset,
     printk(XENLOG_INFO "SMP: Allowing %u CPUs\n", cpus);
     nr_cpu_ids = cpus;
 
+    printk("BW_DEBUG: 03 count_info=0x%016lx\n", mfn_to_page(_mfn(0x01533))->count_info);
+
     /*
      * Some errata relies on SMCCC version which is detected by psci_init()
      * (called from smp_init_cpus()).
@@ -887,6 +898,8 @@ void __init start_xen(unsigned long boot_phys_offset,
 
     tasklet_subsys_init();
 
+   printk("BW_DEBUG: 04 count_info=0x%016lx\n", mfn_to_page(_mfn(0x01533))->count_info);
+
     if ( xsm_dt_init() != 1 )
         warning_add("WARNING: SILO mode is not enabled.\n"
                     "It has implications on the security of the system,\n"
@@ -904,6 +917,8 @@ void __init start_xen(unsigned long boot_phys_offset,
 
     setup_system_domains();
 
+    printk("BW_DEBUG: 05 count_info=0x%016lx\n", mfn_to_page(_mfn(0x01533))->count_info);
+
     local_irq_enable();
     local_abort_enable();
 
@@ -928,6 +943,8 @@ void __init start_xen(unsigned long boot_phys_offset,
     printk("Brought up %ld CPUs\n", (long)num_online_cpus());
     /* TODO: smp_cpus_done(); */
 
+    printk("BW_DEBUG: 06 count_info=0x%016lx\n", mfn_to_page(_mfn(0x01533))->count_info);
+
     setup_virt_paging();
 
     rc = iommu_setup();
@@ -943,6 +960,8 @@ void __init start_xen(unsigned long boot_phys_offset,
     apply_alternatives_all();
     enable_errata_workarounds();
 
+    printk("BW_DEBUG: 07 count_info=0x%016lx\n", mfn_to_page(_mfn(0x01533))->count_info);
+
     /* Create initial domain 0. */
     /* The vGIC for DOM0 is exactly emulating the hardware GIC */
     dom0_cfg.arch.gic_version = XEN_DOMCTL_CONFIG_GIC_NATIVE;
@@ -963,9 +982,13 @@ void __init start_xen(unsigned long boot_phys_offset,
     if ( IS_ERR(dom0) || (alloc_dom0_vcpu0(dom0) == NULL) )
         panic("Error creating domain 0\n");
 
+    printk("BW_DEBUG: 08 count_info=0x%016lx\n", mfn_to_page(_mfn(0x01533))->count_info);
+
     if ( construct_dom0(dom0) != 0)
         panic("Could not set up DOM0 guest OS\n");
 
+    printk("BW_DEBUG: 09 count_info=0x%016lx\n", mfn_to_page(_mfn(0x01533))->count_info);
+
     heap_init_late();
 
     init_trace_bufs();
@@ -974,6 +997,8 @@ void __init start_xen(unsigned long boot_phys_offset,
 
     console_endboot();
 
+    printk("BW_DEBUG: 10 count_info=0x%016lx\n", mfn_to_page(_mfn(0x01533))->count_info);
+
     /* Hide UART from DOM0 if we're using it */
     serial_endboot();
 
@@ -983,6 +1008,8 @@ void __init start_xen(unsigned long boot_phys_offset,
 
     domain_unpause_by_systemcontroller(dom0);
 
+    printk("BW_DEBUG: 11 count_info=0x%016lx\n", mfn_to_page(_mfn(0x01533))->count_info);
+
     /* Switch on to the dynamically allocated stack for the idle vcpu
      * since the static one we're running on is about to be freed. */
     memcpy(idle_vcpu[0]->arch.cpu_info, get_cpu_info(),
diff --git a/xen/common/page_alloc.c b/xen/common/page_alloc.c
index 7cb1bd3..95e874d 100644
--- a/xen/common/page_alloc.c
+++ b/xen/common/page_alloc.c
@@ -1389,6 +1389,8 @@ static void free_heap_pages(
 
     for ( i = 0; i < (1 << order); i++ )
     {
+        WARN_ON(mfn_x(page_to_mfn(pg + i)) == 0x01533);
+
         /*
          * Cannot assume that count_info == 0, as there are some corner cases
          * where it isn't the case and yet it isn't a bug: