diff --git a/nx/include/switch/sf/cmif.h b/nx/include/switch/sf/cmif.h
index d4d14dcb..f0668031 100644
--- a/nx/include/switch/sf/cmif.h
+++ b/nx/include/switch/sf/cmif.h
@@ -225,25 +225,25 @@ NX_CONSTEXPR void cmifRequestOutPointer(CmifRequest* req, void* buffer, size_t s
     *req->out_pointer_sizes++ = size;
 }
 
-NX_CONSTEXPR void cmifRequestInAutoBuffer(CmifRequest* req, const void* buffer, size_t size)
+NX_CONSTEXPR void cmifRequestInAutoBuffer(CmifRequest* req, const void* buffer, size_t size, HipcBufferMode mode)
 {
     if (req->server_pointer_size && size <= req->server_pointer_size) {
         cmifRequestInPointer(req, buffer, size);
-        cmifRequestInBuffer(req, NULL, 0, HipcBufferMode_Normal);
+        cmifRequestInBuffer(req, NULL, 0, mode);
     } else {
         cmifRequestInPointer(req, NULL, 0);
-        cmifRequestInBuffer(req, buffer, size, HipcBufferMode_Normal);
+        cmifRequestInBuffer(req, buffer, size, mode);
     }
 }
 
-NX_CONSTEXPR void cmifRequestOutAutoBuffer(CmifRequest* req, void* buffer, size_t size)
+NX_CONSTEXPR void cmifRequestOutAutoBuffer(CmifRequest* req, void* buffer, size_t size, HipcBufferMode mode)
 {
     if (req->server_pointer_size && size <= req->server_pointer_size) {
         cmifRequestOutPointer(req, buffer, size);
-        cmifRequestOutBuffer(req, NULL, 0, HipcBufferMode_Normal);
+        cmifRequestOutBuffer(req, NULL, 0, mode);
     } else {
         cmifRequestOutPointer(req, NULL, 0);
-        cmifRequestOutBuffer(req, buffer, size, HipcBufferMode_Normal);
+        cmifRequestOutBuffer(req, buffer, size, mode);
     }
 }
 
diff --git a/nx/include/switch/sf/service.h b/nx/include/switch/sf/service.h
index f3f5258e..971468f6 100644
--- a/nx/include/switch/sf/service.h
+++ b/nx/include/switch/sf/service.h
@@ -150,10 +150,14 @@ NX_INLINE void serviceCreate(Service* s, Handle h)
  */
 NX_INLINE void serviceCreateNonDomainSubservice(Service* s, Service* parent, Handle h)
 {
-    s->session = h;
-    s->own_handle = 1;
-    s->object_id = 0;
-    s->pointer_buffer_size = parent->pointer_buffer_size;
+    if (h != INVALID_HANDLE) {
+        s->session = h;
+        s->own_handle = 1;
+        s->object_id = 0;
+        s->pointer_buffer_size = parent->pointer_buffer_size;
+    } else {
+        *s = (Service){};
+    }
 }
 
 /**
@@ -164,10 +168,14 @@ NX_INLINE void serviceCreateNonDomainSubservice(Service* s, Service* parent, Han
  */
 NX_CONSTEXPR void serviceCreateDomainSubservice(Service* s, Service* parent, u32 object_id)
 {
-    s->session = parent->session;
-    s->own_handle = 0;
-    s->object_id = object_id;
-    s->pointer_buffer_size = parent->pointer_buffer_size;
+    if (object_id != 0) {
+        s->session = parent->session;
+        s->own_handle = 0;
+        s->object_id = object_id;
+        s->pointer_buffer_size = parent->pointer_buffer_size;
+    } else {
+        *s = (Service){};
+    }
 }
 
 /**
@@ -293,10 +301,15 @@ NX_CONSTEXPR void _serviceRequestProcessBuffer(CmifRequest* req, const SfBuffer*
     const bool is_out = (attr & SfBufferAttr_Out);
 
     if (attr & SfBufferAttr_HipcAutoSelect) {
+        HipcBufferMode mode = HipcBufferMode_Normal;
+        if (attr & SfBufferAttr_HipcMapTransferAllowsNonSecure)
+            mode = HipcBufferMode_NonSecure;
+        if (attr & SfBufferAttr_HipcMapTransferAllowsNonDevice)
+            mode = HipcBufferMode_NonDevice;
         if (is_in)
-            cmifRequestInAutoBuffer(req, buf->ptr, buf->size);
+            cmifRequestInAutoBuffer(req, buf->ptr, buf->size, mode);
         if (is_out)
-            cmifRequestOutAutoBuffer(req, (void*)buf->ptr, buf->size);
+            cmifRequestOutAutoBuffer(req, (void*)buf->ptr, buf->size, mode);
     } else if (attr & SfBufferAttr_HipcPointer) {
         if (is_in)
             cmifRequestInPointer(req, buf->ptr, buf->size);