diff --git a/core/src/main/java/org/teavm/backend/wasm/WasmGCTarget.java b/core/src/main/java/org/teavm/backend/wasm/WasmGCTarget.java
index 4c2ce9111..ec4d469da 100644
--- a/core/src/main/java/org/teavm/backend/wasm/WasmGCTarget.java
+++ b/core/src/main/java/org/teavm/backend/wasm/WasmGCTarget.java
@@ -439,8 +439,7 @@ public class WasmGCTarget implements TeaVMTarget, TeaVMWasmGCHost {
 
         if (enableDirectMallocSupport) {
             var minPages = (memorySize - 1) / WasmHeap.PAGE_SIZE + 1;
-            var maxPages = (memorySize - directMallocMinHeapSize + directMallocMaxHeapSize - 1)
-                    / WasmHeap.PAGE_SIZE + 1;
+            var maxPages = (memorySize + directMallocMaxHeapSize - WasmHeap.PAGE_SIZE - 1) / WasmHeap.PAGE_SIZE + 1;
             module.setMinMemorySize(minPages);
             module.setMaxMemorySize(maxPages);
         } else {
diff --git a/core/src/main/java/org/teavm/runtime/LaxMalloc.java b/core/src/main/java/org/teavm/runtime/LaxMalloc.java
index d6216e230..c924ebce8 100644
--- a/core/src/main/java/org/teavm/runtime/LaxMalloc.java
+++ b/core/src/main/java/org/teavm/runtime/LaxMalloc.java
@@ -283,7 +283,7 @@ public final class LaxMalloc {
                     allocateMemoryFromChunk(addrIterator, chunkSize, sizeBytes);
                     
                     // +4 bytes to skip size int
-                    Address ret = chunkPtr.add(4);
+                    Address ret = addrIterator.add(4);
                     
                     // clear if requested
                     if (cleared) {