diff --git a/demos/README.md b/demos/README.md
index cc87aaf4d..948ec8399 100644
--- a/demos/README.md
+++ b/demos/README.md
@@ -7,7 +7,6 @@ these demo songs are not under the GPL. all rights are reserved to the original
 # contributors
 
 - 0x5066
-- aarchMoth
 - Abstract 64
 - Aburtos
 - ActualNK358
@@ -16,12 +15,14 @@ these demo songs are not under the GPL. all rights are reserved to the original
 - aloelucidity
 - AmigaX
 - AquaDoesStuff
+- asikwus
 - AstralBlue
 - Background2982
 - battybeats
 - bbqzzd
 - Bernie
 - billimanmcjonnson
+- biolizardshadow
 - BlastBrothers
 - Blaze Weednix
 - BlueElectric05
@@ -134,6 +135,7 @@ these demo songs are not under the GPL. all rights are reserved to the original
 - Xan
 - Yuzu4K
 - Zabir
+- Zaxinoth Digital
 - Zaxolotl
 - ZoomTen (Zumi)
 
diff --git a/demos/c64/PICOHOTCREDITS.fur b/demos/c64/PICOHOTCREDITS.fur
new file mode 100644
index 000000000..76ed5fdfb
Binary files /dev/null and b/demos/c64/PICOHOTCREDITS.fur differ
diff --git a/demos/genesis/shiningcrystal_cave.fur b/demos/genesis/shiningcrystal_cave.fur
new file mode 100644
index 000000000..139c05627
Binary files /dev/null and b/demos/genesis/shiningcrystal_cave.fur differ
diff --git a/demos/misc/brokenspace-msm5232.fur b/demos/misc/brokenspace-msm5232.fur
deleted file mode 100644
index ba3d81948..000000000
Binary files a/demos/misc/brokenspace-msm5232.fur and /dev/null differ
diff --git a/demos/misc/cavedotwave-msm5232.fur b/demos/misc/cavedotwave-msm5232.fur
deleted file mode 100644
index d589c65eb..000000000
Binary files a/demos/misc/cavedotwave-msm5232.fur and /dev/null differ
diff --git a/demos/misc/horizon_beyond_gba.fur b/demos/misc/horizon_beyond_gba.fur
new file mode 100644
index 000000000..9c0331ff8
Binary files /dev/null and b/demos/misc/horizon_beyond_gba.fur differ
diff --git a/demos/multichip/steak.fur b/demos/multichip/steak.fur
new file mode 100644
index 000000000..7ff5e3910
Binary files /dev/null and b/demos/multichip/steak.fur differ
diff --git a/demos/sn7/Updraft Flight.fur b/demos/sn7/Updraft Flight.fur
new file mode 100644
index 000000000..72808ab99
Binary files /dev/null and b/demos/sn7/Updraft Flight.fur differ
diff --git a/src/engine/cmdStream.cpp b/src/engine/cmdStream.cpp
index f1b267869..6d2309369 100644
--- a/src/engine/cmdStream.cpp
+++ b/src/engine/cmdStream.cpp
@@ -200,13 +200,16 @@ bool DivCSPlayer::tick() {
           case DIV_CMD_HINT_PITCH:
             arg0=(signed char)stream.readC();
             break;
-          case DIV_CMD_PANNING:
           case DIV_CMD_HINT_VIBRATO:
           case DIV_CMD_HINT_ARPEGGIO:
           case DIV_CMD_HINT_PORTA:
             arg0=(signed char)stream.readC();
             arg1=(unsigned char)stream.readC();
             break;
+          case DIV_CMD_PANNING:
+            arg0=(unsigned char)stream.readC();
+            arg1=(unsigned char)stream.readC();
+            break;
           case DIV_CMD_PRE_PORTA:
             arg0=(unsigned char)stream.readC();
             arg1=(arg0&0x40)?1:0;
diff --git a/src/engine/dispatch.h b/src/engine/dispatch.h
index a3e203102..47fb7b45d 100644
--- a/src/engine/dispatch.h
+++ b/src/engine/dispatch.h
@@ -67,9 +67,9 @@ enum DivDispatchCmds {
   DIV_CMD_HINT_ARPEGGIO, // (note1, note2)
   DIV_CMD_HINT_VOLUME, // (vol)
   DIV_CMD_HINT_VOL_SLIDE, // (amount, oneTick)
-  DIV_CMD_HINT_VOL_SLIDE_TARGET, // (amount, target)
   DIV_CMD_HINT_PORTA, // (target, speed)
   DIV_CMD_HINT_LEGATO, // (note)
+  DIV_CMD_HINT_VOL_SLIDE_TARGET, // (amount, target)
 
   DIV_CMD_SAMPLE_MODE, // (enabled)
   DIV_CMD_SAMPLE_FREQ, // (frequency)
diff --git a/src/engine/fileOps/dmf.cpp b/src/engine/fileOps/dmf.cpp
index 6da165ced..760b2fc0b 100644
--- a/src/engine/fileOps/dmf.cpp
+++ b/src/engine/fileOps/dmf.cpp
@@ -910,7 +910,8 @@ bool DivEngine::loadDMF(unsigned char* file, size_t len) {
       int vol=50;
       short* data;
       unsigned char* adpcmData;
-      if (length<0) {
+      // I don't think a sample can be that big
+      if (length<0 || length>(1<<29L)) {
         logE("invalid sample length %d. are we doing something wrong?",length);
         lastError="file is corrupt or unreadable at samples";
         delete[] file;
@@ -928,6 +929,11 @@ bool DivEngine::loadDMF(unsigned char* file, size_t len) {
         sample->centerRate=sample->rate;
         pitch=reader.readC();
         vol=reader.readC();
+
+        if (pitch<0 || pitch>10) {
+          logW("%d: sample pitch is wrong! (%d)",i,pitch);
+          pitch=5;
+        }
       }
       if (ds.version<=0x08) {
         sample->rate=ymuSampleRate*400;
diff --git a/src/engine/fileOps/mod.cpp b/src/engine/fileOps/mod.cpp
index 6065b2454..2eccfcad7 100644
--- a/src/engine/fileOps/mod.cpp
+++ b/src/engine/fileOps/mod.cpp
@@ -198,7 +198,7 @@ bool DivEngine::loadMod(unsigned char* file, size_t len) {
           int period=data[1]+((data[0]&0x0f)<<8);
           if (period>0 && period<0x0fff) {
             short note=(short)round(log2(3424.0/period)*12);
-            dstrow[0]=((note-1)%12)+1;
+            dstrow[0]=((note+11)%12)+1;
             dstrow[1]=(note-1)/12+1;
             if (period<114) {
               bypassLimits=true;
diff --git a/src/engine/playback.cpp b/src/engine/playback.cpp
index 987b2b7b7..b3fe8cea0 100644
--- a/src/engine/playback.cpp
+++ b/src/engine/playback.cpp
@@ -67,9 +67,9 @@ const char* cmdName[]={
   "HINT_ARPEGGIO",
   "HINT_VOLUME",
   "HINT_VOL_SLIDE",
-  "HINT_VOL_SLIDE_TARGET",
   "HINT_PORTA",
   "HINT_LEGATO",
+  "HINT_VOL_SLIDE_TARGET",
 
   "SAMPLE_MODE",
   "SAMPLE_FREQ",
diff --git a/src/engine/safeReader.cpp b/src/engine/safeReader.cpp
index 98f06f417..ffd1db6f6 100644
--- a/src/engine/safeReader.cpp
+++ b/src/engine/safeReader.cpp
@@ -61,6 +61,7 @@ int SafeReader::read(void* where, size_t count) {
 #endif
   if (count==0) return 0;
   if (curSeek+count>len) throw EndOfFileException(this,len);
+  if (curSeek+count<curSeek) throw EndOfFileException(this,len);
   memcpy(where,&buf[curSeek],count);
   curSeek+=count;
   return count;
@@ -71,6 +72,7 @@ signed char SafeReader::readC() {
   logD("SR: reading char %x:",curSeek);
 #endif
   if (curSeek+1>len) throw EndOfFileException(this,len);
+  if (curSeek+1<curSeek) throw EndOfFileException(this,len);
 #ifdef READ_DEBUG
   logD("SR: %.2x",buf[curSeek]);
 #endif
@@ -83,6 +85,7 @@ short SafeReader::readS_BE() {
   logD("SR: reading short %x:",curSeek);
 #endif
   if (curSeek+2>len) throw EndOfFileException(this,len);
+  if (curSeek+2<curSeek) throw EndOfFileException(this,len);
   short ret;
   memcpy(&ret,&buf[curSeek],2);
 #ifdef READ_DEBUG
@@ -94,6 +97,7 @@ short SafeReader::readS_BE() {
 
 short SafeReader::readS() {
   if (curSeek+2>len) throw EndOfFileException(this,len);
+  if (curSeek+2<curSeek) throw EndOfFileException(this,len);
   short ret;
   memcpy(&ret,&buf[curSeek],2);
   curSeek+=2;
@@ -105,6 +109,7 @@ int SafeReader::readI_BE() {
   logD("SR: reading int %x:",curSeek);
 #endif
   if (curSeek+4>len) throw EndOfFileException(this,len);
+  if (curSeek+4<curSeek) throw EndOfFileException(this,len);
   int ret;
   memcpy(&ret,&buf[curSeek],4);
   curSeek+=4;
@@ -116,6 +121,7 @@ int SafeReader::readI_BE() {
 
 int SafeReader::readI() {
   if (curSeek+4>len) throw EndOfFileException(this,len);
+  if (curSeek+4<curSeek) throw EndOfFileException(this,len);
   unsigned int ret;
   memcpy(&ret,&buf[curSeek],4);
   curSeek+=4;
@@ -124,6 +130,7 @@ int SafeReader::readI() {
 
 int64_t SafeReader::readL() {
   if (curSeek+8>len) throw EndOfFileException(this,len);
+  if (curSeek+8<curSeek) throw EndOfFileException(this,len);
   unsigned char ret[8];
   memcpy(ret,&buf[curSeek],8);
   curSeek+=8;
@@ -132,6 +139,7 @@ int64_t SafeReader::readL() {
 
 float SafeReader::readF() {
   if (curSeek+4>len) throw EndOfFileException(this,len);
+  if (curSeek+4<curSeek) throw EndOfFileException(this,len);
   unsigned int ret;
   memcpy(&ret,&buf[curSeek],4);
   curSeek+=4;
@@ -143,6 +151,7 @@ float SafeReader::readF() {
 
 double SafeReader::readD() {
   if (curSeek+8>len) throw EndOfFileException(this,len);
+  if (curSeek+8<curSeek) throw EndOfFileException(this,len);
   unsigned char ret[8];
   unsigned char retB[8];
   memcpy(ret,&buf[curSeek],8);
@@ -165,6 +174,7 @@ short SafeReader::readS() {
   logD("SR: reading short %x:",curSeek);
 #endif
   if (curSeek+2>len) throw EndOfFileException(this,len);
+  if (curSeek+2<curSeek) throw EndOfFileException(this,len);
   short ret;
   memcpy(&ret,&buf[curSeek],2);
 #ifdef READ_DEBUG
@@ -176,6 +186,7 @@ short SafeReader::readS() {
 
 short SafeReader::readS_BE() {
   if (curSeek+2>len) throw EndOfFileException(this,len);
+  if (curSeek+2<curSeek) throw EndOfFileException(this,len);
   short ret;
   memcpy(&ret,&buf[curSeek],2);
   curSeek+=2;
@@ -187,6 +198,7 @@ int SafeReader::readI() {
   logD("SR: reading int %x:",curSeek);
 #endif
   if (curSeek+4>len) throw EndOfFileException(this,len);
+  if (curSeek+4<curSeek) throw EndOfFileException(this,len);
   int ret;
   memcpy(&ret,&buf[curSeek],4);
   curSeek+=4;
@@ -198,6 +210,7 @@ int SafeReader::readI() {
 
 int SafeReader::readI_BE() {
   if (curSeek+4>len) throw EndOfFileException(this,len);
+  if (curSeek+4<curSeek) throw EndOfFileException(this,len);
   unsigned int ret;
   memcpy(&ret,&buf[curSeek],4);
   curSeek+=4;
@@ -206,6 +219,7 @@ int SafeReader::readI_BE() {
 
 int64_t SafeReader::readL() {
   if (curSeek+8>len) throw EndOfFileException(this,len);
+  if (curSeek+8<curSeek) throw EndOfFileException(this,len);
   int64_t ret;
   memcpy(&ret,&buf[curSeek],8);
   curSeek+=8;
@@ -214,6 +228,7 @@ int64_t SafeReader::readL() {
 
 float SafeReader::readF() {
   if (curSeek+4>len) throw EndOfFileException(this,len);
+  if (curSeek+4<curSeek) throw EndOfFileException(this,len);
   float ret;
   memcpy(&ret,&buf[curSeek],4);
   curSeek+=4;
@@ -222,6 +237,7 @@ float SafeReader::readF() {
 
 double SafeReader::readD() {
   if (curSeek+8>len) throw EndOfFileException(this,len);
+  if (curSeek+8<curSeek) throw EndOfFileException(this,len);
   double ret;
   memcpy(&ret,&buf[curSeek],8);
   curSeek+=8;
diff --git a/src/gui/csPlayer.cpp b/src/gui/csPlayer.cpp
index 7be1f4e1d..6e91db87e 100644
--- a/src/gui/csPlayer.cpp
+++ b/src/gui/csPlayer.cpp
@@ -139,7 +139,7 @@ void FurnaceGUI::drawCSPlayer() {
       if (ImGui::BeginTabBar("CSOptions")) {
         int chans=e->getTotalChannelCount();
         if (ImGui::BeginTabItem(_("Status"))) {
-          if (ImGui::BeginTable("CSStat",12,ImGuiTableFlags_SizingFixedSame|ImGuiTableFlags_ScrollX|ImGuiTableFlags_Borders)) {
+          if (ImGui::BeginTable("CSStat",13,ImGuiTableFlags_SizingStretchSame|ImGuiTableFlags_ScrollX|ImGuiTableFlags_Borders)) {
             ImGui::TableSetupScrollFreeze(1,1);
             ImGui::TableNextRow(ImGuiTableRowFlags_Headers);
             ImGui::TableNextColumn();
diff --git a/src/gui/dataList.cpp b/src/gui/dataList.cpp
index 6e9d614f7..36695caad 100644
--- a/src/gui/dataList.cpp
+++ b/src/gui/dataList.cpp
@@ -71,47 +71,51 @@ const char* sampleNote[12]={
   }
 
 #define SIMPLE_DRAG_SOURCE(_c,_toMoveVar) \
-  if (settings.draggableDataView && ImGui::BeginDragDropSource()) { \
-    _toMoveVar=i; \
-    ImGui::SetDragDropPayload(_c,NULL,0,ImGuiCond_Once); \
-    ImGui::Button(ICON_FA_ARROWS "##AssetDrag"); \
-    ImGui::EndDragDropSource(); \
+  if (settings.draggableDataView) { \
+    if (ImGui::BeginDragDropSource()) { \
+      _toMoveVar=i; \
+      ImGui::SetDragDropPayload(_c,NULL,0,ImGuiCond_Once); \
+      ImGui::Button(ICON_FA_ARROWS "##AssetDrag"); \
+      ImGui::EndDragDropSource(); \
+    } \
   }
 
 #define SIMPLE_DRAG_TARGET(_c,_toMoveVar,_curVar,_swapFn,_moveUpFn,_moveDownFn) \
-  if (settings.draggableDataView && ImGui::BeginDragDropTarget()) { \
-    const ImGuiPayload* payload=ImGui::AcceptDragDropPayload(_c); \
-    if (payload!=NULL) { \
-      int target=i; \
-      bool markModified=false; \
-      if (_toMoveVar!=target) { \
-        if (ImGui::IsKeyDown(ImGuiKey_ModCtrl)) { \
-          markModified=_swapFn(_toMoveVar,target); \
-        } else { \
-          while (_toMoveVar>target) { \
-            if (_moveUpFn(_toMoveVar)) { \
-              _toMoveVar--; \
-              markModified=true; \
-            } else { \
-              break; \
-            } \
-          } \
-          while (_toMoveVar<target) { \
-            if (_moveDownFn(_toMoveVar)) { \
-              _toMoveVar++; \
-              markModified=true; \
-            } else { \
-              break; \
+  if (settings.draggableDataView) { \
+    if (ImGui::BeginDragDropTarget()) { \
+      const ImGuiPayload* payload=ImGui::AcceptDragDropPayload(_c); \
+      if (payload!=NULL) { \
+        int target=i; \
+        bool markModified=false; \
+        if (_toMoveVar!=target) { \
+          if (ImGui::IsKeyDown(ImGuiKey_ModCtrl)) { \
+            markModified=_swapFn(_toMoveVar,target); \
+          } else { \
+            while (_toMoveVar>target) { \
+              if (_moveUpFn(_toMoveVar)) { \
+                _toMoveVar--; \
+                markModified=true; \
+              } else { \
+                break; \
+              } \
+            } \
+            while (_toMoveVar<target) { \
+              if (_moveDownFn(_toMoveVar)) { \
+                _toMoveVar++; \
+                markModified=true; \
+              } else { \
+                break; \
+              } \
             } \
           } \
+          _curVar=target; \
         } \
-        _curVar=target; \
+        if (markModified) { \
+          MARK_MODIFIED; \
+        } \
+        _toMoveVar=-1; \
+        ImGui::EndDragDropTarget(); \
       } \
-      if (markModified) { \
-        MARK_MODIFIED; \
-      } \
-      _toMoveVar=-1; \
-      ImGui::EndDragDropTarget(); \
     } \
   }
 
diff --git a/src/gui/editing.cpp b/src/gui/editing.cpp
index b7aa730ad..edbf94417 100644
--- a/src/gui/editing.cpp
+++ b/src/gui/editing.cpp
@@ -676,6 +676,10 @@ void FurnaceGUI::doPasteFurnace(PasteMode mode, int arg, bool readClipboard, Str
     }
   }
 
+  if (mode==GUI_PASTE_MODE_OVERFLOW && !e->isPlaying()) {
+    setOrder(curOrder);
+  }
+
   if (readClipboard) {
     if (settings.cursorPastePos) {
       makeCursorUndo();
diff --git a/src/gui/findReplace.cpp b/src/gui/findReplace.cpp
index 7a7492317..157de0441 100644
--- a/src/gui/findReplace.cpp
+++ b/src/gui/findReplace.cpp
@@ -371,7 +371,7 @@ void FurnaceGUI::doReplace() {
 
     switch (queryReplaceEffectPos) {
       case 0: // clear
-        for (int j=0; j<e->song.subsong[i.subsong]->pat[i.x].effectCols; j++) {
+        for (int j=0; j<e->song.subsong[i.subsong]->pat[i.x].effectCols && j<8; j++) {
           effectOrder[j]=j;
         }
         break;
@@ -380,7 +380,7 @@ void FurnaceGUI::doReplace() {
         for (int j=0; j<8 && placementIndex<8 && i.effectPos[j]>=0; j++) {
           effectOrder[placementIndex++]=i.effectPos[j];
         }
-        for (int j=0; j<e->song.subsong[i.subsong]->pat[i.x].effectCols; j++) {
+        for (int j=0; j<e->song.subsong[i.subsong]->pat[i.x].effectCols && placementIndex<8 && j<8; j++) {
           if (p->data[i.y][4+j*2]!=-1 || p->data[i.y][5+j*2]!=-1) {
             effectOrder[placementIndex++]=j;
           }
@@ -392,7 +392,7 @@ void FurnaceGUI::doReplace() {
         for (int j=0; j<8 && placementIndex<8 && i.effectPos[j]>=0; j++) {
           effectOrder[placementIndex++]=i.effectPos[j];
         }
-        for (int j=0; j<e->song.subsong[i.subsong]->pat[i.x].effectCols; j++) {
+        for (int j=0; j<e->song.subsong[i.subsong]->pat[i.x].effectCols && placementIndex<8 && j<8; j++) {
           if (p->data[i.y][4+j*2]!=-1 || p->data[i.y][5+j*2]!=-1) {
             effectOrder[placementIndex++]=j;
           }
@@ -406,7 +406,7 @@ void FurnaceGUI::doReplace() {
       }
       case 3: { // insert in free spaces
         int placementIndex=0;
-        for (int j=0; j<e->song.subsong[i.subsong]->pat[i.x].effectCols; j++) {
+        for (int j=0; j<e->song.subsong[i.subsong]->pat[i.x].effectCols && j<8; j++) {
           if (p->data[i.y][4+j*2]==-1 && p->data[i.y][5+j*2]==-1) {
             effectOrder[placementIndex++]=j;
           }
@@ -415,7 +415,7 @@ void FurnaceGUI::doReplace() {
       }
     }
 
-    for (int j=0; j<queryReplaceEffectCount; j++) {
+    for (int j=0; j<queryReplaceEffectCount && j<8; j++) {
       signed char pos=effectOrder[j];
       if (pos==-1) continue;
       if (queryReplaceEffectDo[j]) {