diff --git a/core/embed/models/T2B1/memory.ld b/core/embed/models/T2B1/memory.ld
index 418edda4a..774e4dad0 100644
--- a/core/embed/models/T2B1/memory.ld
+++ b/core/embed/models/T2B1/memory.ld
@@ -25,6 +25,8 @@ STORAGE_1_SECTOR_START = 0x4;
 STORAGE_1_SECTOR_END = 0x4;
 STORAGE_2_SECTOR_START = 0x10;
 STORAGE_2_SECTOR_END = 0x10;
+KERNEL_CCMRAM_SIZE = 0x6000;
+KERNEL_SRAM_SIZE = 0x400;
 BOOTARGS_SIZE = 0x100;
 BOARD_CAPABILITIES_ADDR = 0x800bf00;
 CODE_ALIGNMENT = 0x200;
diff --git a/core/embed/models/T2B1/model_T2B1.h b/core/embed/models/T2B1/model_T2B1.h
index 0dbe3f8a9..037393b43 100644
--- a/core/embed/models/T2B1/model_T2B1.h
+++ b/core/embed/models/T2B1/model_T2B1.h
@@ -53,6 +53,8 @@
 #define STORAGE_1_SECTOR_END 4
 #define STORAGE_2_SECTOR_START 16
 #define STORAGE_2_SECTOR_END 16
+#define KERNEL_CCMRAM_SIZE 24 * 1024
+#define KERNEL_SRAM_SIZE 1 * 1024
 
 #define BOOTARGS_SIZE 0x100
 #define BOARD_CAPABILITIES_ADDR 0x0800BF00
diff --git a/core/embed/trezorhal/stm32f4/consumption_mask.c b/core/embed/trezorhal/stm32f4/consumption_mask.c
index 3252fdaec..99f40c77b 100644
--- a/core/embed/trezorhal/stm32f4/consumption_mask.c
+++ b/core/embed/trezorhal/stm32f4/consumption_mask.c
@@ -29,10 +29,7 @@
 #error Not implemented for boardloader!
 #endif
 
-#if defined BOOTLOADER
-__attribute__((section(".buf")))
-#endif
-uint32_t pwm_data[SAMPLES] = {0};
+__attribute__((section(".buf"))) uint32_t pwm_data[SAMPLES] = {0};
 
 void consumption_mask_randomize() {
   for (int i = 0; i < SAMPLES; i++) {
diff --git a/core/embed/trezorhal/stm32f4/limited_util.S b/core/embed/trezorhal/stm32f4/limited_util.S
index 0c2f72f8c..1dfec5c8a 100644
--- a/core/embed/trezorhal/stm32f4/limited_util.S
+++ b/core/embed/trezorhal/stm32f4/limited_util.S
@@ -10,10 +10,13 @@ memset_reg:
   // r1 - address of first word following the address in r0 to NOT write (exclusive)
   // r2 - word value to be written
   // both addresses in r0 and r1 needs to be divisible by 4!
+  cmp r0, r1
+  beq .L_loop_end
   .L_loop_begin:
     str r2, [r0], 4 // store the word in r2 to the address in r0, post-indexed
     cmp r0, r1
   bne .L_loop_begin
+  .L_loop_end:
   bx lr
 
   .global jump_to
diff --git a/core/embed/trezorhal/stm32f4/linker/kernel.ld b/core/embed/trezorhal/stm32f4/linker/kernel.ld
index 48a59b3a2..35f779a74 100644
--- a/core/embed/trezorhal/stm32f4/linker/kernel.ld
+++ b/core/embed/trezorhal/stm32f4/linker/kernel.ld
@@ -9,7 +9,7 @@ MEMORY {
   SRAM   (wal)    : ORIGIN = MCU_SRAM + MCU_SRAM_SIZE - KERNEL_SRAM_SIZE, LENGTH = KERNEL_SRAM_SIZE
 }
 
-main_stack_base = ORIGIN(SRAM) + SIZEOF(.stack); /* 8-byte aligned full descending stack */
+main_stack_base = ORIGIN(CCMRAM) + SIZEOF(.stack); /* 8-byte aligned full descending stack */
 _sstack = ORIGIN(SRAM);
 _estack = main_stack_base;
 
diff --git a/core/embed/trezorhal/stm32f4/mpu.c b/core/embed/trezorhal/stm32f4/mpu.c
index f86567da6..8778aca4d 100644
--- a/core/embed/trezorhal/stm32f4/mpu.c
+++ b/core/embed/trezorhal/stm32f4/mpu.c
@@ -521,14 +521,14 @@ mpu_mode_t mpu_reconfig(mpu_mode_t mode) {
     case MPU_MODE_ASSETS:
       DIS_REGION( 5 );
       // Assets (Privileged, Read-Write, Non-Executable)
-      SET_REGION( 6, FLASH_BASE + 0x108000, SIZE_32KB, 0x00, FLASH_DATA, PRIV_RW );
+      SET_REGION( 6, FLASH_BASE + 0x104000, SIZE_32KB, 0x00, FLASH_DATA, PRIV_RW );
       break;
 
     case MPU_MODE_APP:
       // Unused (maybe privileged kernel code in the future)
       DIS_REGION( 5 );
       // Assets (Unprivileged, Read-Only, Non-Executable)
-      SET_REGION( 6, FLASH_BASE + 0x108000, SIZE_32KB, 0x00, FLASH_DATA, PRIV_RO_URO );
+      SET_REGION( 6, FLASH_BASE + 0x104000, SIZE_32KB, 0x00, FLASH_DATA, PRIV_RO_URO );
       break;
 
 #else