diff --git a/docs/envvars.html b/docs/envvars.html
index b2c0e01ee32..bb1c914cc73 100644
--- a/docs/envvars.html
+++ b/docs/envvars.html
@@ -51,5 +51,24 @@ See the <A HREF="xlibdriver.html">Xlib software driver page</A> for details.
 </ul>
 
 
+<p>
+These environment variables are for the Intel i945/i965 drivers:
+</p>
+<ul>
+<li>INTEL_STRICT_CONFORMANCE - if set to 1, enable sw fallbacks to improve
+    OpenGL conformance.  If set to 2, always use software rendering.
+<li>INTEL_NO_BLIT - if set, disable hardware-accelerated glBitmap,
+    glCopyPixels, glDrawPixels.
+</ul>
+
+
+<p>
+These environment variables are for the Radeon R300 driver:
+</p>
+<ul>
+<li>R300_NO_TCL - if set, disable hardware-accelerated Transform/Clip/Lighting.
+</ul>
+
+
 </BODY>
 </HTML>
diff --git a/src/mesa/main/fbobject.c b/src/mesa/main/fbobject.c
index 0556f168501..de1b524c0b5 100644
--- a/src/mesa/main/fbobject.c
+++ b/src/mesa/main/fbobject.c
@@ -1353,15 +1353,26 @@ _mesa_DeleteFramebuffersEXT(GLsizei n, const GLuint *framebuffers)
             ASSERT(fb == &DummyFramebuffer || fb->Name == framebuffers[i]);
 
             /* check if deleting currently bound framebuffer object */
-            if (fb == ctx->DrawBuffer) {
-               /* bind default */
-               ASSERT(fb->RefCount >= 2);
-               _mesa_BindFramebufferEXT(GL_DRAW_FRAMEBUFFER_EXT, 0);
+            if (ctx->Extensions.EXT_framebuffer_blit) {
+               /* separate draw/read binding points */
+               if (fb == ctx->DrawBuffer) {
+                  /* bind default */
+                  ASSERT(fb->RefCount >= 2);
+                  _mesa_BindFramebufferEXT(GL_DRAW_FRAMEBUFFER_EXT, 0);
+               }
+               if (fb == ctx->ReadBuffer) {
+                  /* bind default */
+                  ASSERT(fb->RefCount >= 2);
+                  _mesa_BindFramebufferEXT(GL_READ_FRAMEBUFFER_EXT, 0);
+               }
             }
-            if (fb == ctx->ReadBuffer) {
-               /* bind default */
-               ASSERT(fb->RefCount >= 2);
-               _mesa_BindFramebufferEXT(GL_READ_FRAMEBUFFER_EXT, 0);
+            else {
+               /* only one binding point for read/draw buffers */
+               if (fb == ctx->DrawBuffer || fb == ctx->ReadBuffer) {
+                  /* bind default */
+                  ASSERT(fb->RefCount >= 2);
+                  _mesa_BindFramebufferEXT(GL_FRAMEBUFFER_EXT, 0);
+               }    
             }
 
 	    /* remove from hash table immediately, to free the ID */
diff --git a/src/mesa/main/state.c b/src/mesa/main/state.c
index 904ad012052..5e07d1d2f15 100644
--- a/src/mesa/main/state.c
+++ b/src/mesa/main/state.c
@@ -82,12 +82,6 @@ compute_max_element(struct gl_client_array *array)
       } else {
 	 array->_MaxElement = 0;
       }
-      /* Compute the max element we can access in the VBO without going
-       * out of bounds.
-       */
-      array->_MaxElement = ((GLsizeiptrARB) array->BufferObj->Size
-                            - (GLsizeiptrARB) array->Ptr + array->StrideB
-                            - array->_ElementSize) / array->StrideB;
    }
    else {
       /* user-space array, no idea how big it is */
diff --git a/src/mesa/vbo/vbo_exec_array.c b/src/mesa/vbo/vbo_exec_array.c
index 2c82f7c9c5c..bd2fccdba14 100644
--- a/src/mesa/vbo/vbo_exec_array.c
+++ b/src/mesa/vbo/vbo_exec_array.c
@@ -688,6 +688,16 @@ vbo_exec_DrawRangeElementsBaseVertex(GLenum mode,
     * or we can read/write out of memory in several different places!
     */
 
+   /* Catch/fix some potential user errors */
+   if (type == GL_UNSIGNED_BYTE) {
+      start = MIN2(start, 0xff);
+      end = MIN2(end, 0xff);
+   }
+   else if (type == GL_UNSIGNED_SHORT) {
+      start = MIN2(start, 0xffff);
+      end = MIN2(end, 0xffff);
+   }
+
    if (end >= ctx->Array.ArrayObj->_MaxElement) {
       /* the max element is out of bounds of one or more enabled arrays */
       warnCount++;
@@ -738,6 +748,10 @@ vbo_exec_DrawRangeElementsBaseVertex(GLenum mode,
           */
       }
 #endif
+
+      /* Set 'end' to the max possible legal value */
+      assert(ctx->Array.ArrayObj->_MaxElement >= 1);
+      end = ctx->Array.ArrayObj->_MaxElement - 1;
    }
    else if (0) {
       _mesa_printf("glDraw[Range]Elements{,BaseVertex}"