diff -r fe15a885f9f9 xen/arch/x86/mm/p2m.c
--- a/xen/arch/x86/mm/p2m.c	Wed Sep 09 14:48:41 2009 +0100
+++ b/xen/arch/x86/mm/p2m.c	Fri Sep 11 10:19:57 2009 +0100
@@ -257,6 +257,17 @@
     }
 #endif
 
+    /* Pages from domain_alloc and returned by the balloon driver aren't
+     * guaranteed to be zero; but by reclaiming zero pages, we implicitly promise
+     * to provide zero pages.  So we scrub pages before using */
+    for ( i=0; i< 1 << order ; i++)
+    {
+        char * b;
+        b = map_domain_page(page_to_mfn(page) + i);
+        clear_page(b);
+        unmap_domain_page(b);
+    }
+
     spin_lock(&d->page_alloc_lock);
 
     /* First, take all pages off the domain list */