diff -up xorg-server-1.1.1/hw/xfree86/dixmods/extmod/xf86misc.c.jx xorg-server-1.1.1/hw/xfree86/dixmods/extmod/xf86misc.c
diff -up xorg-server-1.1.1/hw/xfree86/common/xf86MiscExt.c.jx xorg-server-1.1.1/hw/xfree86/common/xf86MiscExt.c
--- xorg-server-1.1.1/hw/xfree86/common/xf86MiscExt.c.jx	2006-07-05 14:31:40.000000000 -0400
+++ xorg-server-1.1.1/hw/xfree86/common/xf86MiscExt.c	2007-12-11 15:03:32.000000000 -0500
@@ -647,6 +647,10 @@ MiscExtPassMessage(int scrnIndex, const 
 
     DEBUG_P("MiscExtPassMessage");
 
+    /* should check this in the protocol, but xf86NumScreens isn't exported */
+    if (scrnIndex >= xf86NumScreens)
+	return BadValue;
+
     if (*pScr->HandleMessage == NULL)
 	    return BadImplementation;
     return (*pScr->HandleMessage)(scrnIndex, msgtype, msgval, retstr);