diff --git a/ccid/patches/ccid-1.3.11.patch b/ccid/patches/ccid-1.3.11.patch
index d22a2d6..b487112 100644
--- a/ccid/patches/ccid-1.3.11.patch
+++ b/ccid/patches/ccid-1.3.11.patch
@@ -1,7 +1,7 @@
 Index: ccid-1.3.11/src/ccid.h
 ===================================================================
---- ccid-1.3.11.orig/src/ccid.h	2010-09-27 21:25:46.000000000 +0200
-+++ ccid-1.3.11/src/ccid.h	2010-09-27 21:26:26.000000000 +0200
+--- ccid-1.3.11.orig/src/ccid.h	2009-06-30 21:42:38.000000000 +0200
++++ ccid-1.3.11/src/ccid.h	2010-09-28 09:31:55.822260851 +0200
 @@ -137,8 +137,10 @@
  #define CCID_CLASS_EXCHANGE_MASK	0x00070000
  
@@ -52,8 +52,8 @@ Index: ccid-1.3.11/src/ccid.h
  #define ISO_DATA_RATES 10753, 14337, 15625, 17204, \
 Index: ccid-1.3.11/src/ccid_ifdhandler.h
 ===================================================================
---- ccid-1.3.11.orig/src/ccid_ifdhandler.h	2010-09-27 21:26:05.000000000 +0200
-+++ ccid-1.3.11/src/ccid_ifdhandler.h	2010-09-27 21:26:26.000000000 +0200
+--- ccid-1.3.11.orig/src/ccid_ifdhandler.h	2009-06-30 21:42:38.000000000 +0200
++++ ccid-1.3.11/src/ccid_ifdhandler.h	2010-09-28 09:31:55.822260851 +0200
 @@ -38,6 +38,8 @@
  #define IOCTL_FEATURE_IFD_PIN_PROPERTIES \
  	SCARD_CTL_CODE(FEATURE_IFD_PIN_PROPERTIES + CLASS2_IOCTL_MAGIC)
@@ -65,8 +65,8 @@ Index: ccid-1.3.11/src/ccid_ifdhandler.h
  #define DRIVER_OPTION_GEMPC_TWIN_KEY_APDU 2
 Index: ccid-1.3.11/src/commands.c
 ===================================================================
---- ccid-1.3.11.orig/src/commands.c	2010-09-27 21:25:29.000000000 +0200
-+++ ccid-1.3.11/src/commands.c	2010-09-27 22:46:29.000000000 +0200
+--- ccid-1.3.11.orig/src/commands.c	2009-06-12 15:06:22.000000000 +0200
++++ ccid-1.3.11/src/commands.c	2010-09-28 11:03:32.786258812 +0200
 @@ -68,7 +68,19 @@
  	unsigned int tx_length, unsigned char tx_buffer[], unsigned int *rx_length,
  	unsigned char rx_buffer[]);
@@ -87,7 +87,7 @@ Index: ccid-1.3.11/src/commands.c
  
  
  /*****************************************************************************
-@@ -691,6 +703,336 @@
+@@ -691,6 +703,341 @@
  	return ret;
  } /* SecurePINModify */
  
@@ -202,7 +202,10 @@ Index: ccid-1.3.11/src/commands.c
 +        return IFD_COMMUNICATION_ERROR;
 +    }
 +    lengthOutputData = w2i(output, parsed);
-+    /* XXX */
++    if ((unsigned int)lengthOutputData+6 != output_length) {
++        DEBUG_CRITICAL("Malformed Establish PACE Channel output data.");
++        return IFD_COMMUNICATION_ERROR;
++    }
 +    parsed += 2;
 +
 +    if (parsed+2 > output_length) {
@@ -289,6 +292,7 @@ Index: ccid-1.3.11/src/commands.c
 +	unsigned char TxBuffer[], unsigned int TxLength,
 +	unsigned char RxBuffer[], unsigned int *RxLength)
 +{
++    /* bPINOperation: PIN PACE Capabilities */
 +    RESPONSECODE return_value;
 +    int old_read_timeout;
 +    _ccid_descriptor *ccid_descriptor = get_ccid_descriptor(reader_index);
@@ -300,7 +304,6 @@ Index: ccid-1.3.11/src/commands.c
 +    if (IFD_SUCCESS != return_value)
 +        goto err;
 +
-+    /* bPINOperation: PIN PACE Capabilities */
 +    return_value = SecurePINPACE(reader_index, TxBuffer, TxLength, RxBuffer,
 +            RxLength, CCID_CLASS_PIN_PACE_EXECUTE);
 +    if (IFD_SUCCESS != return_value)
@@ -312,7 +315,7 @@ Index: ccid-1.3.11/src/commands.c
 +        goto err;
 +    }
 +
-+    return_value = transform_EstablishPACEChannel_OutputData(RxBuffer+6, (*RxLength)-6);
++    return_value = transform_EstablishPACEChannel_OutputData(RxBuffer, *RxLength);
 +    if (IFD_SUCCESS != return_value)
 +        goto err;
 +
@@ -338,7 +341,7 @@ Index: ccid-1.3.11/src/commands.c
 +        return r;
 +
 +    uint32_t s = PACE_SUCCESS;
-+    memcpy(RxBuffer,   &s,       4);
++    memcpy(RxBuffer,   &s,       4);    /* Result */
 +    memcpy(RxBuffer+4, &length,  2);    /* lengthOutputData */
 +    *RxLength = length + 6;
 +
@@ -356,11 +359,11 @@ Index: ccid-1.3.11/src/commands.c
 +    status_t res;
 +
 +    cmd[0] = 0x69;                                  /* Secure */
-+    i2dw(TxLength, cmd+1);                          /* dwLength */
-+    cmd[5] = ccid_descriptor->bCurrentSlotIndex;    /* slot number */
++    i2dw(TxLength, cmd+1);
++    cmd[5] = ccid_descriptor->bCurrentSlotIndex;
 +    cmd[6] = (*ccid_descriptor->pbSeq)++;
-+    cmd[7] = 0;		                            /* bBWI */
-+    cmd[8] = 0;                                     /* wLevelParameter */
++    cmd[7] = 0;
++    cmd[8] = 0;
 +    cmd[9] = 0;
 +    cmd[10] = bPINOperation;
 +
@@ -370,7 +373,7 @@ Index: ccid-1.3.11/src/commands.c
 +                11+TxLength - sizeof(cmd));
 +        return IFD_COMMUNICATION_ERROR;
 +    }
-+    memcpy(cmd + 11, TxBuffer, TxLength);
++    memcpy(cmd+11, TxBuffer, TxLength);
 +
 +    res = WritePort(reader_index, 11+TxLength, cmd);
 +    if (res != STATUS_SUCCESS)
@@ -410,21 +413,23 @@ Index: ccid-1.3.11/src/commands.c
 +    }
 +
 +    length = dw2i(cmd, 1);
-+    if (length + 6 <= *RxLength)
-+        *RxLength = length + 6;
++    if (length <= *RxLength)
++        *RxLength = length;
 +    else
 +    {
-+        DEBUG_CRITICAL2("overrun by %d bytes", length + 6 - *RxLength);
++        DEBUG_CRITICAL2("overrun by %d bytes", length - *RxLength);
 +        return IFD_ERROR_INSUFFICIENT_BUFFER;
 +    }
 +
++    memcpy(RxBuffer, cmd+10, *RxLength);
++
 +    return IFD_SUCCESS;
 +}
 +
  
  /*****************************************************************************
   *
-@@ -2081,3 +2423,15 @@
+@@ -2081,3 +2428,15 @@
  	buffer[3] = (value >> 24) & 0xFF;
  } /* i2dw */
  
@@ -442,8 +447,8 @@ Index: ccid-1.3.11/src/commands.c
 +
 Index: ccid-1.3.11/src/commands.h
 ===================================================================
---- ccid-1.3.11.orig/src/commands.h	2010-09-27 21:25:37.000000000 +0200
-+++ ccid-1.3.11/src/commands.h	2010-09-27 21:26:26.000000000 +0200
+--- ccid-1.3.11.orig/src/commands.h	2009-01-07 00:14:35.000000000 +0100
++++ ccid-1.3.11/src/commands.h	2010-09-28 09:31:55.826261505 +0200
 @@ -37,6 +37,14 @@
  	unsigned char TxBuffer[], unsigned int TxLength,
  	unsigned char RxBuffer[], unsigned int *RxLength);
@@ -461,8 +466,8 @@ Index: ccid-1.3.11/src/commands.h
  	unsigned char RxBuffer[], unsigned int *RxLength);
 Index: ccid-1.3.11/src/defs.h
 ===================================================================
---- ccid-1.3.11.orig/src/defs.h	2010-09-27 21:25:55.000000000 +0200
-+++ ccid-1.3.11/src/defs.h	2010-09-27 21:26:26.000000000 +0200
+--- ccid-1.3.11.orig/src/defs.h	2009-07-01 14:28:01.000000000 +0200
++++ ccid-1.3.11/src/defs.h	2010-09-28 09:31:55.826261505 +0200
 @@ -66,16 +66,10 @@
  /* Flag set when a power down is requested */
  #define MASK_POWERFLAGS_PDWN 0x02
@@ -486,8 +491,8 @@ Index: ccid-1.3.11/src/defs.h
  
 Index: ccid-1.3.11/src/ifdhandler.c
 ===================================================================
---- ccid-1.3.11.orig/src/ifdhandler.c	2010-09-27 21:25:14.000000000 +0200
-+++ ccid-1.3.11/src/ifdhandler.c	2010-09-27 21:38:53.000000000 +0200
+--- ccid-1.3.11.orig/src/ifdhandler.c	2009-07-28 22:57:07.000000000 +0200
++++ ccid-1.3.11/src/ifdhandler.c	2010-09-28 09:31:55.826261505 +0200
 @@ -68,6 +68,71 @@
  	int clock_frequency);
  static unsigned int T1_card_timeout(double f, double d, int TC1, int BWI,
diff --git a/ccid/src/ccid.c b/ccid/src/ccid.c
index a88fbf7..dc91fef 100644
--- a/ccid/src/ccid.c
+++ b/ccid/src/ccid.c
@@ -821,7 +821,6 @@ perform_PC_to_RDR_Secure_EstablishPACEChannel(sc_card_t *card,
     }
     pace_input.chat = &abData[parsed];
     parsed += pace_input.chat_length;
-    /* XXX make this human readable */
     if (pace_input.chat_length)
         bin_log(ctx, "Card holder authorization template",
                 pace_input.chat, pace_input.chat_length);
@@ -860,7 +859,6 @@ perform_PC_to_RDR_Secure_EstablishPACEChannel(sc_card_t *card,
     }
     pace_input.certificate_description = &abData[parsed];
     parsed += pace_input.certificate_description_length;
-    /* XXX make this human readable */
     if (pace_input.certificate_description_length)
         bin_log(ctx, "Certificate description",
                 pace_input.certificate_description,
@@ -945,7 +943,7 @@ perform_PC_to_RDR_Secure_EstablishPACEChannel(sc_card_t *card,
 
 
     if (pace_output.previous_car_length > 0xff) {
-        sc_error(ctx, "Most previous CAR %u bytes too long",
+        sc_error(ctx, "Previous CAR %u bytes too long",
                 pace_output.previous_car_length-0xff);
         sc_result = SC_ERROR_INVALID_DATA;
         goto err;
@@ -973,11 +971,14 @@ perform_PC_to_RDR_Secure_EstablishPACEChannel(sc_card_t *card,
     p += pace_output.id_icc_length;
 
 
-    *abDataOutLen = 2 +
-            2+pace_output.ef_cardaccess_length +
-            1+pace_output.recent_car_length +
-            1+pace_output.previous_car_length +
-            2+pace_output.id_icc_length;
+    *abDataOutLen =
+            4 +                                     /* Result */
+            2 +                                     /* length Output data */
+            2 +                                     /* Statusbytes */
+            2+pace_output.ef_cardaccess_length +    /* EF.CardAccess */
+            1+pace_output.recent_car_length +       /* Most recent CAR */
+            1+pace_output.previous_car_length +     /* Previous CAR */
+            2+pace_output.id_icc_length ;           /* identifier of the MRTD chip */
 
     sc_result = SC_SUCCESS;
 
@@ -986,7 +987,7 @@ err:
     ef_cardaccess = pace_output.ef_cardaccess;
     ef_cardaccess_length = pace_output.ef_cardaccess_length;
 #else
-    free(pace_output.ef_cardaccess;
+    free(pace_output.ef_cardaccess);
 #endif
     free(pace_output.recent_car);
     free(pace_output.previous_car);