diff --git a/pvmfw/src/dice.rs b/pvmfw/src/dice.rs
index 4e303ac..0aa1273 100644
--- a/pvmfw/src/dice.rs
+++ b/pvmfw/src/dice.rs
@@ -17,7 +17,6 @@
 use crate::cstr;
 use crate::helpers::flushed_zeroize;
 use core::ffi::c_void;
-use core::ffi::CStr;
 use core::mem::size_of;
 use core::slice;
 
diff --git a/pvmfw/src/entry.rs b/pvmfw/src/entry.rs
index 8e3e47b..d172474 100644
--- a/pvmfw/src/entry.rs
+++ b/pvmfw/src/entry.rs
@@ -64,6 +64,9 @@
     // - can't access non-pvmfw memory (only statically-mapped memory)
     // - can't access MMIO (therefore, no logging)
 
+    // SAFETY - This function should and will only be called once, here.
+    unsafe { heap::init() };
+
     match main_wrapper(fdt_address as usize, payload_start as usize, payload_size as usize) {
         Ok((entry, bcc)) => jump_to_payload(fdt_address, entry.try_into().unwrap(), bcc),
         Err(_) => reboot(), // TODO(b/220071963) propagate the reason back to the host.
@@ -188,9 +191,6 @@
     // - only perform logging once the logger has been initialized
     // - only access non-pvmfw memory once (and while) it has been mapped
 
-    // SAFETY - This function should and will only be called once, here.
-    unsafe { heap::init() };
-
     logger::init(LevelFilter::Info).map_err(|_| RebootReason::InternalError)?;
 
     // Use debug!() to avoid printing to the UART if we failed to configure it as only local
diff --git a/pvmfw/src/exceptions.rs b/pvmfw/src/exceptions.rs
index 462a9cc..a6ac4fe 100644
--- a/pvmfw/src/exceptions.rs
+++ b/pvmfw/src/exceptions.rs
@@ -86,7 +86,7 @@
 }
 
 #[no_mangle]
-extern "C" fn sync_exception_current(_elr: u64, _spsr: u64) {
+extern "C" fn sync_exception_current(elr: u64, _spsr: u64) {
     // Disable logging in exception handler to prevent unsafe writes to UART.
     let _guard = logger::suppress();
     let esr: Esr = read_sysreg!("esr_el1").into();
@@ -97,7 +97,7 @@
         if !handling_uart_exception(esr, far) {
             eprintln!("sync_exception_current");
             eprintln!("{e}");
-            eprintln!("{esr}, far={far:#08x}");
+            eprintln!("{esr}, far={far:#08x}, elr={elr:#08x}");
         }
         reboot()
     }
diff --git a/pvmfw/src/fdt.rs b/pvmfw/src/fdt.rs
index 5ecb038..98802b4 100644
--- a/pvmfw/src/fdt.rs
+++ b/pvmfw/src/fdt.rs
@@ -742,7 +742,7 @@
     set_or_clear_chosen_flag(fdt, cstr!("avf,strict-boot"), strict_boot)?;
     set_or_clear_chosen_flag(fdt, cstr!("avf,new-instance"), new_instance)?;
 
-    if debuggable {
+    if !debuggable {
         if let Some(bootargs) = read_bootargs_from(fdt)? {
             filter_out_dangerous_bootargs(fdt, &bootargs)?;
         }
diff --git a/pvmfw/src/helpers.rs b/pvmfw/src/helpers.rs
index c230784..403c7e4 100644
--- a/pvmfw/src/helpers.rs
+++ b/pvmfw/src/helpers.rs
@@ -31,6 +31,7 @@
     ($sysreg:literal) => {{
         let mut r: usize;
         // Safe because it reads a system register and does not affect Rust.
+        #[allow(unused_unsafe)] // In case the macro is used within an unsafe block.
         unsafe {
             core::arch::asm!(
                 concat!("mrs {}, ", $sysreg),
@@ -182,6 +183,6 @@
 #[macro_export]
 macro_rules! cstr {
     ($str:literal) => {{
-        CStr::from_bytes_with_nul(concat!($str, "\0").as_bytes()).unwrap()
+        core::ffi::CStr::from_bytes_with_nul(concat!($str, "\0").as_bytes()).unwrap()
     }};
 }