Index: linux-2.6.18-rc4-mm3/include/linux/mm.h
===================================================================
--- linux-2.6.18-rc4-mm3.orig/include/linux/mm.h	2006-08-31 08:41:30.692243285 -0700
+++ linux-2.6.18-rc4-mm3/include/linux/mm.h	2006-08-31 10:43:02.072176955 -0700
@@ -231,7 +231,10 @@
 					 * to show when page is mapped
 					 * & limit reverse map searches.
 					 */
-		int inuse;		/* Slabifier: used objects */
+		struct {
+			short unsigned int inuse;/* Slabifier: used objects */
+			short unsigned int offset;/* Freepointe offset */
+		};
 	};
 	union {
 	    struct {
Index: linux-2.6.18-rc4-mm3/mm/slabifier.c
===================================================================
--- linux-2.6.18-rc4-mm3.orig/mm/slabifier.c	2006-08-31 10:40:44.440488583 -0700
+++ linux-2.6.18-rc4-mm3/mm/slabifier.c	2006-08-31 10:55:31.910227301 -0700
@@ -296,6 +296,8 @@
 	if (!page)
 		return NULL;
 
+	page->offset = s->offset;
+
 	page->slab = (struct slab_cache *)s;
 	__SetPageSlab(page);
 	atomic_long_inc(&s->nr_slabs);
@@ -455,7 +457,9 @@
 		return NULL;
 
 	s->offset = sc->offset / sizeof(void *);
+	BUG_ON(s->offset > 65535);
 	s->objects = (PAGE_SIZE << sc->order) / s->size;
+	BUG_ON(s->objects > 65535);
 	atomic_long_set(&s->nr_slabs, 0);
 	s->nr_partial = 0;
 #ifdef CONFIG_SMP
@@ -595,7 +599,7 @@
 
 	page->inuse++;
 	object = page->freelist;
-	next_object = object[s->offset];
+	next_object = object[page->offset];
 	page->freelist = next_object;
 	check_free_chain(s, page);
 	SetPageReferenced(page);
@@ -666,7 +670,7 @@
 		goto double_free;
 #endif
 
-	prior = object[s->offset] = page->freelist;
+	prior = object[page->offset] = page->freelist;
 	page->freelist = object;
 	page->inuse--;