diff --git a/ChangeLog b/ChangeLog
index 7ad83b01..5c212144 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -20,6 +20,7 @@ v0.35.01	05-Jun-2002
 
 	mbcico:
 		Now uses the new session password field for session handshake.
+		The binkd version string now includes the OS and CPU type.
 
 	mbfile:
 		Added -v commandline switch to supress virus checking for the
@@ -34,6 +35,7 @@ v0.35.01	05-Jun-2002
 		during first configure of this program are automatic installed
 		in the setup and enabled. Others are shown there with default
 		paths but are disabled, they can be used as examples.
+		Fixed crashing mbsetup in menus 10.3.2, 10.4.5 and 10.4.6.
 
 
 v0.33.21	04-Jun-2002
diff --git a/TODO b/TODO
index 7936c9d5..bab29c12 100644
--- a/TODO
+++ b/TODO
@@ -69,8 +69,6 @@ mbfido:
 	N: The first file received in a not yet created tic area is refused
 	   after the area is created: node xxx not connected to area xxx.
 
-	N: Doesn't erase netmail.jam and/or echomail.jam after a full mailscan.
-
 	N: Add traffic to html.nodes
 
 mbcico:
@@ -111,8 +109,6 @@ mbnewusr:
 	N: On NetBSD, supress error message from mbpasswd.
 
 mbsetup:
-	U: In menu 10.3, selection 2, pressing enter crashes mbsetup.
-
 	U: PickAka function lets mbsetup crash if domain is 12 characters
 
 	U: Use some sort of sorting for the system aka's and make sure the
diff --git a/mbcico/binkp.c b/mbcico/binkp.c
index 392f4797..d0727a98 100644
--- a/mbcico/binkp.c
+++ b/mbcico/binkp.c
@@ -325,7 +325,7 @@ void b_banner(int originate)
 	binkp_send_control(MM_NUL,"NDL %s", CFG.Flags);
 	t = time(NULL);
 	binkp_send_control(MM_NUL,"TIME %s", rfcdate(t));
-	binkp_send_control(MM_NUL,"VER mbcico/%s binkp/1.0", VERSION);
+	binkp_send_control(MM_NUL,"VER mbcico/%s/%s-%s binkp/1.0", VERSION, OsName(), OsCPU());
 	if (strlen(CFG.Phone))
 		binkp_send_control(MM_NUL,"PHN %s", CFG.Phone);
 	if (strlen(CFG.comment))
diff --git a/mbfido/scan.c b/mbfido/scan.c
index e93bb44e..02660070 100644
--- a/mbfido/scan.c
+++ b/mbfido/scan.c
@@ -88,11 +88,11 @@ void ScanMail(int DoAll)
 	} else {
 		scanned = 0;
 		Fname = calloc(PATH_MAX, sizeof(char));
-		temp  = calloc(128, sizeof(char));
+		temp  = calloc(PATH_MAX, sizeof(char));
 
 		sprintf(Fname, "%s/tmp/echomail.jam", getenv("MBSE_ROOT"));
 		if ((fp = fopen(Fname, "r")) != NULL) {
-			while ((fgets(temp, 128, fp)) != NULL) {
+			while ((fgets(temp, PATH_MAX - 1, fp)) != NULL) {
 				path = strtok(temp, " ");
 				msg = atol(strtok(NULL, "\n"));
 				Syslog('+', "Export message %lu from %s", msg, path);
@@ -106,7 +106,7 @@ void ScanMail(int DoAll)
 
 		sprintf(Fname, "%s/tmp/netmail.jam", getenv("MBSE_ROOT"));
 		if ((fp = fopen(Fname, "r")) != NULL) {
-			while ((fgets(temp, 128, fp)) != NULL) {
+			while ((fgets(temp, PATH_MAX - 1, fp)) != NULL) {
 				path = strtok(temp, " ");
 				msg = atol(strtok(NULL, "\n"));
 				Syslog('+', "Export message %lu from %s", msg, path);
diff --git a/mbsetup/m_ticarea.c b/mbsetup/m_ticarea.c
index 83198ecc..752e2cb4 100644
--- a/mbsetup/m_ticarea.c
+++ b/mbsetup/m_ticarea.c
@@ -1097,15 +1097,16 @@ char *PickTicarea(char *shdr)
 
 	clr_index();
 	working(1, 0, 0);
+	memset(&Buf, 0, sizeof(Buf));
 	if (config_read() == -1) {
 		working(2, 0, 0);
-		return '\0';
+		return Buf;
 	}
 
 	records = CountTicarea();
 	if (records == -1) {
 		working(2, 0, 0);
-		return '\0';
+		return Buf;
 	}
 
 	working(0, 0, 0);
@@ -1146,7 +1147,7 @@ char *PickTicarea(char *shdr)
 		strcpy(pick, select_pick(records, 10));
 
 		if (strncmp(pick, "-", 1) == 0)
-			return '\0';
+			return Buf;
 
 		if (strncmp(pick, "N", 1) == 0)
 			if ((o + 10) < records)