diff --git a/sysmodules/loader/source/hbldr.c b/sysmodules/loader/source/hbldr.c
index e1c32fc..c1d9ccf 100644
--- a/sysmodules/loader/source/hbldr.c
+++ b/sysmodules/loader/source/hbldr.c
@@ -175,11 +175,15 @@ static const u32 kernelCaps[] =
     // Normal applications only have access to 0x1FF50000-0x1FF58000, 0x1FF70000-0x1FF78000,
     // however we can load unsigned DSP firmware binaries.
     0xFF81FF00, // RW static range mapping: 0x1FF00000 (DSP RAM, start)
-    0xFF81FF80, // RW static range mapping: 0x1FF80000 (DSP RAM, end)
+    0xFF91FF80, // RW static range mapping: 0x1FF80000 (DSP RAM, end)
 
     0xFF91F000, // RO static range mapping: 0x1F000000 (VRAM, start)
     0xFF91F600, // RO static range mapping: 0x1F600000 (VRAM, end)
 
+    // Give access to all Arm11-accessible IO
+    0xFF81EC00, // RW IO range mapping: 0x1EC00000 (PA 0x10100000, start)
+    0xFF81F000, // RW IO range mapping: 0x10500000 (PA 0x10500000, end)
+
     0xFF002109, // Exflags: APPLICATION memtype + "Shared page writing" + "Allow debug" + "Access core2"
     0xFE000200, // Handle table size: 0x200