diff --git a/src/core/hle/service/nvdrv/nvdrv_interface.cpp b/src/core/hle/service/nvdrv/nvdrv_interface.cpp
index 5fae68adbb..b4ed187027 100644
--- a/src/core/hle/service/nvdrv/nvdrv_interface.cpp
+++ b/src/core/hle/service/nvdrv/nvdrv_interface.cpp
@@ -5,6 +5,8 @@
 // SPDX-FileCopyrightText: 2021 Skyline Team and Contributors
 // SPDX-License-Identifier: GPL-3.0-or-later
 
+#include <algorithm>
+
 #include "common/logging.h"
 #include "common/scope_exit.h"
 #include "common/string_util.h"
@@ -19,6 +21,17 @@
 
 namespace Service::Nvidia {
 
+namespace {
+
+size_t ClampIoctlOutputSize(size_t descriptor_size, u32 ioctl_length) {
+    if (ioctl_length == 0) {
+        return descriptor_size;
+    }
+    return (std::min)(descriptor_size, static_cast<size_t>(ioctl_length));
+}
+
+}
+
 void NVDRV::Open(HLERequestContext& ctx) {
     LOG_DEBUG(Service_NVDRV, "called");
     IPC::ResponseBuilder rb{ctx, 4};
@@ -68,7 +81,8 @@ void NVDRV::Ioctl1(HLERequestContext& ctx) {
     }
 
     // Check device
-    output_buffer.resize_destructive(ctx.GetWriteBufferSize(0));
+    output_buffer.resize_destructive(
+        ClampIoctlOutputSize(ctx.GetWriteBufferSize(0), command.length));
     const auto input_buffer = ctx.ReadBuffer(0);
 
     const auto nv_result = nvdrv->Ioctl1(fd, command, input_buffer, output_buffer);
@@ -95,7 +109,8 @@ void NVDRV::Ioctl2(HLERequestContext& ctx) {
 
     const auto input_buffer = ctx.ReadBuffer(0);
     const auto input_inlined_buffer = ctx.ReadBuffer(1);
-    output_buffer.resize_destructive(ctx.GetWriteBufferSize(0));
+    output_buffer.resize_destructive(
+        ClampIoctlOutputSize(ctx.GetWriteBufferSize(0), command.length));
 
     const auto nv_result =
         nvdrv->Ioctl2(fd, command, input_buffer, input_inlined_buffer, output_buffer);
@@ -121,7 +136,8 @@ void NVDRV::Ioctl3(HLERequestContext& ctx) {
     }
 
     const auto input_buffer = ctx.ReadBuffer(0);
-    output_buffer.resize_destructive(ctx.GetWriteBufferSize(0));
+    output_buffer.resize_destructive(
+        ClampIoctlOutputSize(ctx.GetWriteBufferSize(0), command.length));
     inline_output_buffer.resize_destructive(ctx.GetWriteBufferSize(1));
 
     const auto nv_result =
diff --git a/src/core/hle/service/nvnflinger/buffer_queue_producer.cpp b/src/core/hle/service/nvnflinger/buffer_queue_producer.cpp
index c3eb2796e3..243fd73def 100644
--- a/src/core/hle/service/nvnflinger/buffer_queue_producer.cpp
+++ b/src/core/hle/service/nvnflinger/buffer_queue_producer.cpp
@@ -19,11 +19,30 @@
 #include "core/hle/service/nvnflinger/buffer_queue_producer.h"
 #include "core/hle/service/nvnflinger/consumer_listener.h"
 #include "core/hle/service/nvnflinger/parcel.h"
+#include "core/hle/service/nvnflinger/producer_listener.h"
 #include "core/hle/service/nvnflinger/ui/graphic_buffer.h"
 #include "core/hle/service/nvnflinger/window.h"
 
 namespace Service::android {
 
+namespace {
+
+class BufferWaitEventListener final : public IProducerListener {
+public:
+    explicit BufferWaitEventListener(Kernel::KEvent* event_, Kernel::KernelCore& kernel_)
+        : event{event_}, kernel{kernel_} {}
+
+    void OnBufferReleased() override {
+        event->Signal(kernel);
+    }
+
+private:
+    Kernel::KEvent* event;
+    Kernel::KernelCore& kernel;
+};
+
+}
+
 BufferQueueProducer::BufferQueueProducer(Service::KernelHelpers::ServiceContext& service_context_,
                                          std::shared_ptr<BufferQueueCore> buffer_queue_core_,
                                          Service::Nvidia::NvCore::NvMap& nvmap_)
@@ -35,6 +54,13 @@ BufferQueueProducer::BufferQueueProducer(Service::KernelHelpers::ServiceContext&
 }
 
 BufferQueueProducer::~BufferQueueProducer() {
+    {
+        std::scoped_lock lock{core->mutex};
+        if (core->connected_producer_listener == internal_listener) {
+            core->connected_producer_listener = nullptr;
+        }
+        internal_listener = nullptr;
+    }
     service_context.CloseEvent(buffer_wait_event);
 }
 
@@ -668,7 +694,15 @@ Status BufferQueueProducer::Connect(const std::shared_ptr<IProducerListener>& li
         core->connected_api = api;
         output->Inflate(core->default_width, core->default_height, core->transform_hint,
                         static_cast<u32>(core->queue.size()));
-        core->connected_producer_listener = listener;
+        if (listener != nullptr) {
+            core->connected_producer_listener = listener;
+        } else {
+            if (internal_listener == nullptr) {
+                internal_listener = std::make_shared<BufferWaitEventListener>(
+                    buffer_wait_event, service_context.kernel);
+            }
+            core->connected_producer_listener = internal_listener;
+        }
         break;
     default:
         LOG_ERROR(Service_Nvnflinger, "unknown api = {}", api);
diff --git a/src/core/hle/service/nvnflinger/buffer_queue_producer.h b/src/core/hle/service/nvnflinger/buffer_queue_producer.h
index 697de0ac9b..d933c1a6b0 100644
--- a/src/core/hle/service/nvnflinger/buffer_queue_producer.h
+++ b/src/core/hle/service/nvnflinger/buffer_queue_producer.h
@@ -81,6 +81,7 @@ private:
 
     Kernel::KEvent* buffer_wait_event{};
     Service::KernelHelpers::ServiceContext& service_context;
+    std::shared_ptr<IProducerListener> internal_listener;
 
     std::shared_ptr<BufferQueueCore> core;
     BufferQueueDefs::SlotsType& slots;
diff --git a/src/video_core/buffer_cache/buffer_cache.h b/src/video_core/buffer_cache/buffer_cache.h
index 5009e12e5e..7b7247e6e5 100644
--- a/src/video_core/buffer_cache/buffer_cache.h
+++ b/src/video_core/buffer_cache/buffer_cache.h
@@ -1565,10 +1565,10 @@ typename BufferCache<P>::OverlapResult BufferCache<P>::ResolveOverlaps(DAddr dev
             // When this memory region has been joined a bunch of times, we assume it's being used
             // as a stream buffer. Increase the size to skip constantly recreating buffers.
             has_stream_leap = true;
-            if (expands_right) {
+            if (expands_left) {
                 expand_begin(CACHING_PAGESIZE * 128);
             }
-            if (expands_left) {
+            if (expands_right) {
                 expand_end(CACHING_PAGESIZE * 128);
             }
         }
diff --git a/src/video_core/renderer_vulkan/blit_image.cpp b/src/video_core/renderer_vulkan/blit_image.cpp
index 89083d29fb..69a4d3b75c 100644
--- a/src/video_core/renderer_vulkan/blit_image.cpp
+++ b/src/video_core/renderer_vulkan/blit_image.cpp
@@ -797,7 +797,6 @@ void BlitImageHelper::ConvertR16ToD16(const Framebuffer* dst_framebuffer,
 void BlitImageHelper::ConvertABGR8ToD24S8(const Framebuffer* dst_framebuffer,
                                           const ImageView& src_image_view) {
     if (!device.IsExtShaderStencilExportSupported()) {
-        // Shader requires VK_EXT_shader_stencil_export which is not available
         LOG_WARNING(Render_Vulkan, "ConvertABGR8ToD24S8 requires shader_stencil_export, skipping");
         return;
     }