diff --git a/sortix/include/sortix/kernel/process.h b/sortix/include/sortix/kernel/process.h
index f0855e64..8bb2010c 100644
--- a/sortix/include/sortix/kernel/process.h
+++ b/sortix/include/sortix/kernel/process.h
@@ -115,7 +115,6 @@ private:
 	size_t zombiewaiting;
 	bool iszombie;
 	bool nozombify;
-	addr_t mmapfrom;
 	int exitstatus;
 
 public:
@@ -182,7 +181,6 @@ public:
 
 public:
 	void ResetForExecute();
-	addr_t AllocVirtualAddr(size_t size);
 
 public:
 	static Process* Get(pid_t pid);
diff --git a/sortix/include/sortix/kernel/thread.h b/sortix/include/sortix/kernel/thread.h
index 324d2377..49f43793 100644
--- a/sortix/include/sortix/kernel/thread.h
+++ b/sortix/include/sortix/kernel/thread.h
@@ -106,8 +106,6 @@ public:
 
 public:
 	addr_t addrspace;
-	addr_t stackpos;
-	size_t stacksize;
 	sighandler_t sighandler;
 	addr_t kernelstackpos;
 	size_t kernelstacksize;
diff --git a/sortix/kernel.cpp b/sortix/kernel.cpp
index 901b40b9..0db4ca5a 100644
--- a/sortix/kernel.cpp
+++ b/sortix/kernel.cpp
@@ -632,7 +632,6 @@ static void InitThread(void* /*user*/)
 	// the init ramdisk and transfer execution to it. We will then become a
 	// regular user-space program with root permissions.
 
-	Thread* thread = CurrentThread();
 	Process* process = CurrentProcess();
 
 	const char* initpath = "/" CPUTYPE_STR "/bin/init";
@@ -666,21 +665,6 @@ static void InitThread(void* /*user*/)
 
 	init.Reset();
 
-	const size_t DEFAULT_STACK_SIZE = 512UL * 1024UL;
-
-	size_t stacksize = 0;
-	if ( !stacksize ) { stacksize = DEFAULT_STACK_SIZE; }
-
-	addr_t stackpos = process->AllocVirtualAddr(stacksize);
-	if ( !stackpos ) { Panic("Could not allocate init stack space"); }
-
-	int prot = PROT_FORK | PROT_READ | PROT_WRITE | PROT_KREAD | PROT_KWRITE;
-	if ( !Memory::MapRange(stackpos, stacksize, prot) )
-		Panic("Could not allocate init stack memory");
-
-	thread->stackpos = stackpos;
-	thread->stacksize = stacksize;
-
 	int argc = 1;
 	const char* argv[] = { "init", NULL };
 	const char* cputype = "cputype=" CPUTYPE_STR;
diff --git a/sortix/process.cpp b/sortix/process.cpp
index ef1f2ab2..6c6f764a 100644
--- a/sortix/process.cpp
+++ b/sortix/process.cpp
@@ -98,7 +98,6 @@ Process::Process()
 	segments_used = 0;
 	segments_length = 0;
 	segment_lock = KTHREAD_MUTEX_INITIALIZER;
-	mmapfrom = 0x80000000UL;
 	exitstatus = -1;
 	pid = AllocatePID();
 	uid = euid = 0;
@@ -648,8 +647,6 @@ Process* Process::Fork()
 	kthread_mutex_unlock(&groupchildlock);
 
 	// Initialize everything that is safe and can't fail.
-	clone->mmapfrom = mmapfrom;
-
 	kthread_mutex_lock(&ptrlock);
 	clone->root = root;
 	clone->cwd = cwd;
@@ -745,10 +742,29 @@ int Process::Execute(const char* programname, const uint8_t* program,
 	delete[] program_image_path;
 	program_image_path = programname_clone; programname_clone = NULL;
 
-	// TODO: This may be an ugly hack!
-	// TODO: Move this to x86/process.cpp.
+	uintptr_t userspace_addr;
+	size_t userspace_size;
+	Memory::GetUserVirtualArea(&userspace_addr, &userspace_size);
 
-	addr_t stackpos = CurrentThread()->stackpos + CurrentThread()->stacksize;
+	const size_t DEFAULT_STACK_SIZE = 512UL * 1024UL;
+	void* const PREFERRED_STACK_LOCATION =
+		(void*) (userspace_addr + userspace_size - DEFAULT_STACK_SIZE);
+	const int STACK_PROTECTION = PROT_READ | PROT_WRITE | PROT_KREAD |
+	                             PROT_KWRITE | PROT_FORK;
+
+	// Attempt to allocate a stack for the new process.
+	kthread_mutex_lock(&segment_lock);
+	struct segment stack_segment;
+	if ( !PlaceSegment(&stack_segment, this, PREFERRED_STACK_LOCATION, DEFAULT_STACK_SIZE, 0) ||
+	     !Memory::MapMemory(this, stack_segment.addr, stack_segment.size, stack_segment.prot = STACK_PROTECTION) )
+	{
+		kthread_mutex_unlock(&segment_lock);
+		ResetForExecute();
+		return errno = ENOMEM, -1;
+	}
+	kthread_mutex_unlock(&segment_lock);
+
+	addr_t stackpos = stack_segment.addr + stack_segment.size;
 
 	// Alright, move argv onto the new stack! First figure out exactly how
 	// big argv actually is.
@@ -929,8 +945,6 @@ pid_t sys_tfork(int flags, tforkregs_t* regs)
 	thread->kernelstackpos = (addr_t) newkernelstack;
 	thread->kernelstacksize = curthread->kernelstacksize;
 	thread->kernelstackmalloced = true;
-	thread->stackpos = curthread->stackpos;
-	thread->stacksize = curthread->stacksize;
 	thread->sighandler = curthread->sighandler;
 
 	StartKernelThread(thread);
@@ -1194,9 +1208,4 @@ void Process::Init()
 		Panic("could not allocate pidlist\n");
 }
 
-addr_t Process::AllocVirtualAddr(size_t size)
-{
-	return mmapfrom -= size;
-}
-
 } // namespace Sortix
diff --git a/sortix/thread.cpp b/sortix/thread.cpp
index d9f379bd..14f64f6c 100644
--- a/sortix/thread.cpp
+++ b/sortix/thread.cpp
@@ -51,8 +51,6 @@ Thread::Thread()
 	schedulerlistnext = NULL;
 	state = NONE;
 	memset(&registers, 0, sizeof(registers));
-	stackpos = 0;
-	stacksize = 0;
 	kernelstackpos = 0;
 	kernelstacksize = 0;
 	kernelstackmalloced = false;
@@ -90,8 +88,6 @@ addr_t Thread::SwitchAddressSpace(addr_t newaddrspace)
 // Last chance to clean up user-space things before this thread dies.
 void Thread::LastPrayer()
 {
-	Memory::UnmapRange(stackpos, stacksize);
-	Memory::Flush();
 }
 
 extern "C" void BootstrapKernelThread(void* user, ThreadEntry entry)