diff --git a/pvmfw/src/mmu.rs b/pvmfw/src/mmu.rs
index fa94e85..455edad 100644
--- a/pvmfw/src/mmu.rs
+++ b/pvmfw/src/mmu.rs
@@ -53,7 +53,8 @@
         let mut page_table = Self { idmap: IdMap::new(Self::ASID, Self::ROOT_LEVEL) };
 
         page_table.map_code(&layout::text_range())?;
-        page_table.map_data(&layout::writable_region())?;
+        page_table.map_data(&layout::scratch_range())?;
+        page_table.map_data(&layout::boot_stack_range())?;
         page_table.map_rodata(&layout::rodata_range())?;
         page_table.map_data(&appended_payload_range())?;
 
diff --git a/rialto/src/main.rs b/rialto/src/main.rs
index a3df7fa..72e8cde 100644
--- a/rialto/src/main.rs
+++ b/rialto/src/main.rs
@@ -80,18 +80,21 @@
     let reg_dev = MemoryRegion::new(0, SZ_1G);
     let reg_text = into_memreg(&layout::text_range());
     let reg_rodata = into_memreg(&layout::rodata_range());
-    let reg_data = into_memreg(&layout::writable_region());
+    let reg_scratch = into_memreg(&layout::scratch_range());
+    let reg_stack = into_memreg(&layout::boot_stack_range());
 
     debug!("Preparing kernel page table.");
     debug!("  dev:    {}-{}", reg_dev.start(), reg_dev.end());
     debug!("  text:   {}-{}", reg_text.start(), reg_text.end());
     debug!("  rodata: {}-{}", reg_rodata.start(), reg_rodata.end());
-    debug!("  data:   {}-{}", reg_data.start(), reg_data.end());
+    debug!("  scratch:{}-{}", reg_scratch.start(), reg_scratch.end());
+    debug!("  stack:  {}-{}", reg_stack.start(), reg_stack.end());
 
     pgt.map_range(&reg_dev, PROT_DEV)?;
     pgt.map_range(&reg_text, PROT_RX)?;
     pgt.map_range(&reg_rodata, PROT_RO)?;
-    pgt.map_range(&reg_data, PROT_RW)?;
+    pgt.map_range(&reg_scratch, PROT_RW)?;
+    pgt.map_range(&reg_stack, PROT_RW)?;
 
     pgt.activate();
     info!("Activated kernel page table.");
diff --git a/vmbase/example/src/layout.rs b/vmbase/example/src/layout.rs
index e660c5f..0a33995 100644
--- a/vmbase/example/src/layout.rs
+++ b/vmbase/example/src/layout.rs
@@ -58,10 +58,9 @@
     into_va_range(layout::boot_stack_range())
 }
 
-/// Writable data, including the stack.
-pub fn writable_region() -> MemoryRegion {
-    let r = layout::writable_region();
-    MemoryRegion::new(r.start, r.end)
+/// Writable data region for allocations.
+pub fn scratch_range() -> Range<VirtualAddress> {
+    into_va_range(layout::scratch_range())
 }
 
 fn data_load_address() -> VirtualAddress {
diff --git a/vmbase/example/src/main.rs b/vmbase/example/src/main.rs
index ed0275b..3bf850c 100644
--- a/vmbase/example/src/main.rs
+++ b/vmbase/example/src/main.rs
@@ -24,8 +24,8 @@
 extern crate alloc;
 
 use crate::layout::{
-    bionic_tls, dtb_range, print_addresses, rodata_range, stack_chk_guard, text_range,
-    writable_region, DEVICE_REGION,
+    bionic_tls, boot_stack_range, dtb_range, print_addresses, rodata_range, scratch_range,
+    stack_chk_guard, text_range, DEVICE_REGION,
 };
 use crate::pci::{check_pci, get_bar_region};
 use aarch64_paging::{idmap::IdMap, paging::Attributes};
@@ -100,7 +100,13 @@
         .unwrap();
     idmap
         .map_range(
-            &writable_region(),
+            &scratch_range().into(),
+            Attributes::NORMAL | Attributes::NON_GLOBAL | Attributes::EXECUTE_NEVER,
+        )
+        .unwrap();
+    idmap
+        .map_range(
+            &boot_stack_range().into(),
             Attributes::NORMAL | Attributes::NON_GLOBAL | Attributes::EXECUTE_NEVER,
         )
         .unwrap();
diff --git a/vmbase/src/layout.rs b/vmbase/src/layout.rs
index b5ab449..0d824bb 100644
--- a/vmbase/src/layout.rs
+++ b/vmbase/src/layout.rs
@@ -66,9 +66,9 @@
     linker_region!(boot_stack_begin, boot_stack_end)
 }
 
-/// Writable data, including the stack.
-pub fn writable_region() -> Range<usize> {
-    linker_region!(data_begin, boot_stack_end)
+/// All writable sections, excluding the stack.
+pub fn scratch_range() -> Range<usize> {
+    linker_region!(data_begin, bss_end)
 }
 
 /// Read-write data (original).