fix copy on write bug; jump to ring3