diff --git a/lib/spawn/spawn.c b/lib/spawn/spawn.c
index 6207bcb..6f2235b 100644
--- a/lib/spawn/spawn.c
+++ b/lib/spawn/spawn.c
@@ -458,14 +458,15 @@ errval_t spawn_load_argv(int argc, char *argv[], struct spawninfo *si,
     if (err_is_fail(err)) return err;
 
     // rueegges: initialize the foreign paging state
-    struct paging_state child_paging_state;
+    struct paging_state _child_paging_state;
+    struct paging_state *child_paging_state = &_child_paging_state;
     // 64 * 1024 is enough to catch null pointers and also enough to not conflict with child starting paging_alloc at VADDR_OFFSET
-    err = paging_init_state_foreign(&child_paging_state, 64 * 1024, si->vspace_cap_l0_pagetable, get_default_slot_allocator());
+    err = paging_init_state_foreign(child_paging_state, 64 * 1024, si->vspace_cap_l0_pagetable, get_default_slot_allocator());
     if (err_is_fail(err)) return err_push(err, SPAWN_ERR_PAGING_INIT);
 
     // - Load the ELF binary
     struct allocate_state st = {
-        .paging_state = &child_paging_state,
+        .paging_state = child_paging_state,
         .temp_mapping_head = NULL,
     };
     genvaddr_t entry;
@@ -510,7 +511,7 @@ errval_t spawn_load_argv(int argc, char *argv[], struct spawninfo *si,
 
     dispatcher_handle_t handle_child;
     err = paging_map_frame_attr(
-        &child_paging_state, (void **)&handle_child,
+        child_paging_state, (void **)&handle_child,
         DISPATCHER_FRAME_SIZE, si->cspace_cap_dispframe, VREGION_FLAGS_READ_WRITE
     );
     if (err_is_fail(err)) return err_push(err, SPAWN_ERR_MAP_DISPATCHER_TO_NEW);
@@ -565,18 +566,13 @@ errval_t spawn_load_argv(int argc, char *argv[], struct spawninfo *si,
     // afeer: map frame to new process
     lvaddr_t arguments_page_in_child;
     err = paging_map_frame_attr(
-        &child_paging_state, (void **) &arguments_page_in_child,
+        child_paging_state, (void **) &arguments_page_in_child,
         ARGS_SIZE, si->cspace_cap_argspage, VREGION_FLAGS_READ_WRITE);
     if (err_is_fail(err)) return err_push(err, SPAWN_ERR_MAP_ARGSPG_TO_NEW);
 
     // afeer: put the arguments into the argspage
     struct spawn_domain_params * domain_params = (struct spawn_domain_params *) arguments_page_in_self;
 
-    err = spawn_serialize_vspace(si, &child_paging_state, domain_params);
-    if (err_is_fail(err)) {
-        return err_push(err, SPAWN_ERR_SERIALISE_VSPACE);
-    }
-
     // Create shared memory for RPC
     err = frame_alloc(&si->rpc_shared_frame, RPC_SHARED_SIZE, NULL);
     if (err_is_fail(err)) return err_push(err, LIB_ERR_FRAME_ALLOC);
@@ -588,10 +584,16 @@ errval_t spawn_load_argv(int argc, char *argv[], struct spawninfo *si,
     if (err_is_fail(err)) return err;
 
     err = paging_map_frame_attr(
-        &child_paging_state, &domain_params->rpc_shared_memory,
+        child_paging_state, &domain_params->rpc_shared_memory,
         RPC_SHARED_SIZE, si->rpc_shared_frame, VREGION_FLAGS_READ_WRITE);
     if (err_is_fail(err)) return err;
 
+    err = spawn_serialize_vspace(si, child_paging_state, domain_params);
+    if (err_is_fail(err)) {
+        return err_push(err, SPAWN_ERR_SERIALISE_VSPACE);
+    }
+    // so we don't use it after serializing
+    child_paging_state = NULL;
 
     // afeer: TODO: what do i put here? do we need to set these fields to some value?
     // domain_params->tls_init_base = NULL;