diff --git a/src/plugins/hs_apps/sapi/vpp_echo_bapi.c b/src/plugins/hs_apps/sapi/vpp_echo_bapi.c
index 6ad825d..807ec62 100644
--- a/src/plugins/hs_apps/sapi/vpp_echo_bapi.c
+++ b/src/plugins/hs_apps/sapi/vpp_echo_bapi.c
@@ -266,7 +266,6 @@
 echo_attach_session (uword segment_handle, uword rxf_offset, uword txf_offset,
 		     uword mq_offset, echo_session_t *s)
 {
-  svm_fifo_shared_t *rx_fifo, *tx_fifo;
   echo_main_t *em = &echo_main;
   u32 fs_index, eqs_index;
   fifo_segment_t *fs;
@@ -285,22 +284,19 @@
       ASSERT (eqs_index != (u32) ~0);
     }
 
-  rx_fifo = uword_to_pointer (rxf_offset, svm_fifo_shared_t *);
-  tx_fifo = uword_to_pointer (txf_offset, svm_fifo_shared_t *);
-  rx_fifo->client_session_index = s->session_index;
-  tx_fifo->client_session_index = s->session_index;
-
   clib_spinlock_lock (&em->segment_handles_lock);
 
   fs = fifo_segment_get_segment (&em->segment_main, fs_index);
-  s->rx_fifo = fifo_segment_alloc_fifo_w_shared (fs, rx_fifo);
-  s->tx_fifo = fifo_segment_alloc_fifo_w_shared (fs, tx_fifo);
+  s->rx_fifo = fifo_segment_alloc_fifo_w_offset (fs, rxf_offset);
+  s->tx_fifo = fifo_segment_alloc_fifo_w_offset (fs, txf_offset);
+  s->rx_fifo->shr->client_session_index = s->session_index;
+  s->tx_fifo->shr->client_session_index = s->session_index;
 
   if (mq_offset != (uword) ~0)
     {
       fs = fifo_segment_get_segment (&em->segment_main, eqs_index);
-      s->vpp_evt_q =
-	fifo_segment_msg_q_attach (fs, mq_offset, rx_fifo->slice_index);
+      s->vpp_evt_q = fifo_segment_msg_q_attach (fs, mq_offset,
+						s->rx_fifo->shr->slice_index);
     }
 
   clib_spinlock_unlock (&em->segment_handles_lock);
diff --git a/src/svm/fifo_segment.c b/src/svm/fifo_segment.c
index 0c3a79a..4ffec7c 100644
--- a/src/svm/fifo_segment.c
+++ b/src/svm/fifo_segment.c
@@ -278,7 +278,11 @@
   ASSERT (fsh->max_byte_index <= sh->ssvm_size - offset);
 
   fs->max_byte_index = fsh->max_byte_index;
-  fs->h = sh->opaque[0] = fsh;
+  fs->h = fsh;
+  sh->opaque[0] = (void *) ((u8 *) fsh - (u8 *) fs->ssvm.sh);
+
+  /* Allow random offsets */
+  fs->ssvm.sh->ssvm_va = 0;
 
   vec_validate (fs->slices, fs->n_slices - 1);
   for (i = 0; i < fs->n_slices; i++)
@@ -338,7 +342,7 @@
   fs->ssvm.ssvm_size = a->segment_size;
   fs->ssvm.my_pid = getpid ();
   fs->ssvm.name = format (0, "%s%c", a->segment_name, 0);
-  fs->ssvm.requested_va = sm->next_baseva;
+  fs->ssvm.requested_va = 0;
   if (a->segment_type == SSVM_SEGMENT_MEMFD)
     fs->ssvm.fd = a->memfd_fd;
   else
@@ -346,17 +350,15 @@
 
   if ((rv = ssvm_client_init (&fs->ssvm, a->segment_type)))
     {
-      _vec_len (fs) = vec_len (fs) - 1;
+      pool_put (sm->segments, fs);
       return (rv);
     }
 
-  /* Fish the segment header */
-  fsh = fs->h = fs->ssvm.sh->opaque[0];
-
   /* Probably a segment without fifos */
-  if (!fsh)
+  if (!fs->ssvm.sh->opaque[0])
     goto done;
 
+  fsh = fs->h = (void *) fs->ssvm.sh + (uword) fs->ssvm.sh->opaque[0];
   fs->max_byte_index = fsh->max_byte_index;
   vec_validate (fs->slices, 0);
   fs->slices[0].fifos =
@@ -824,9 +826,12 @@
 }
 
 svm_fifo_t *
-fifo_segment_alloc_fifo_w_shared (fifo_segment_t *fs, svm_fifo_shared_t *sf)
+fifo_segment_alloc_fifo_w_offset (fifo_segment_t *fs, uword offset)
 {
   svm_fifo_t *f = fs_fifo_alloc (fs, 0);
+  svm_fifo_shared_t *sf;
+
+  sf = (svm_fifo_shared_t *) ((u8 *) fs->h + offset);
   f->fs_hdr = fs->h;
   f->shr = sf;
 
@@ -950,6 +955,12 @@
     }
 }
 
+uword
+fifo_segment_fifo_offset (svm_fifo_t *f)
+{
+  return (u8 *) f->shr - (u8 *) f->fs_hdr;
+}
+
 svm_msg_q_t *
 fifo_segment_msg_q_alloc (fifo_segment_t *fs, u32 mq_index,
 			  svm_msg_q_cfg_t *cfg)
diff --git a/src/svm/fifo_segment.h b/src/svm/fifo_segment.h
index 195869a..8266690 100644
--- a/src/svm/fifo_segment.h
+++ b/src/svm/fifo_segment.h
@@ -104,6 +104,18 @@
 u32 fifo_segment_index (fifo_segment_main_t * sm, fifo_segment_t * fs);
 void fifo_segment_info (fifo_segment_t * seg, char **address, size_t * size);
 
+always_inline void *
+fifo_segment_ptr (fifo_segment_t *fs, uword offset)
+{
+  return (void *) ((u8 *) fs->h + offset);
+}
+
+always_inline uword
+fifo_segment_offset (fifo_segment_t *fs, void *p)
+{
+  return (uword) ((u8 *) p - (u8 *) fs->h);
+}
+
 /**
  * Allocate fifo in fifo segment
  *
@@ -116,8 +128,8 @@
 					     u32 slice_index,
 					     u32 data_bytes,
 					     fifo_segment_ftype_t ftype);
-svm_fifo_t *fifo_segment_alloc_fifo_w_shared (fifo_segment_t *fs,
-					      svm_fifo_shared_t *sf);
+svm_fifo_t *fifo_segment_alloc_fifo_w_offset (fifo_segment_t *fs,
+					      uword offset);
 
 /**
  * Free fifo allocated in fifo segment
@@ -130,6 +142,7 @@
 void fifo_segment_detach_fifo (fifo_segment_t * fs, svm_fifo_t * f);
 void fifo_segment_attach_fifo (fifo_segment_t * fs, svm_fifo_t * f,
 			       u32 slice_index);
+uword fifo_segment_fifo_offset (svm_fifo_t *f);
 
 /**
  * Allocate message queue on segment
diff --git a/src/vcl/vcl_private.c b/src/vcl/vcl_private.c
index 5b41235..a140e5e 100644
--- a/src/vcl/vcl_private.c
+++ b/src/vcl/vcl_private.c
@@ -379,7 +379,6 @@
 			    uword txf_offset, uword mq_offset, u8 is_ct,
 			    vcl_session_t *s)
 {
-  svm_fifo_shared_t *rxsf, *txsf;
   u32 fs_index, eqs_index;
   svm_fifo_t *rxf, *txf;
   fifo_segment_t *fs;
@@ -393,21 +392,18 @@
       return -1;
     }
 
-  if (mq_offset != (uword) ~0)
+  if (!is_ct && mq_offset != (uword) ~0)
     {
       eqs_handle = vcl_vpp_worker_segment_handle (0);
       eqs_index = vcl_segment_table_lookup (eqs_handle);
       ASSERT (eqs_index != VCL_INVALID_SEGMENT_INDEX);
     }
 
-  rxsf = uword_to_pointer (rxf_offset, svm_fifo_shared_t *);
-  txsf = uword_to_pointer (txf_offset, svm_fifo_shared_t *);
-
   clib_rwlock_reader_lock (&vcm->segment_table_lock);
 
   fs = fifo_segment_get_segment (&vcm->segment_main, fs_index);
-  rxf = fifo_segment_alloc_fifo_w_shared (fs, rxsf);
-  txf = fifo_segment_alloc_fifo_w_shared (fs, txsf);
+  rxf = fifo_segment_alloc_fifo_w_offset (fs, rxf_offset);
+  txf = fifo_segment_alloc_fifo_w_offset (fs, txf_offset);
 
   if (!is_ct && mq_offset != (uword) ~0)
     {
@@ -420,8 +416,8 @@
 
   if (!is_ct)
     {
-      rxsf->client_session_index = s->session_index;
-      txsf->client_session_index = s->session_index;
+      rxf->shr->client_session_index = s->session_index;
+      txf->shr->client_session_index = s->session_index;
       rxf->client_thread_index = vcl_get_worker_index ();
       txf->client_thread_index = vcl_get_worker_index ();
       s->rx_fifo = rxf;
diff --git a/src/vnet/session/session_api.c b/src/vnet/session/session_api.c
index 4602a78..2073a15 100644
--- a/src/vnet/session/session_api.c
+++ b/src/vnet/session/session_api.c
@@ -148,8 +148,8 @@
   mp = (session_accepted_msg_t *) evt->data;
   clib_memset (mp, 0, sizeof (*mp));
   mp->context = app->app_index;
-  mp->server_rx_fifo = pointer_to_uword (s->rx_fifo->shr);
-  mp->server_tx_fifo = pointer_to_uword (s->tx_fifo->shr);
+  mp->server_rx_fifo = fifo_segment_fifo_offset (s->rx_fifo);
+  mp->server_tx_fifo = fifo_segment_fifo_offset (s->tx_fifo);
   mp->segment_handle = session_segment_handle (s);
   mp->flags = s->flags;
 
@@ -313,8 +313,8 @@
 
       session_get_endpoint (s, &mp->lcl, 1 /* is_lcl */ );
 
-      mp->server_rx_fifo = pointer_to_uword (s->rx_fifo->shr);
-      mp->server_tx_fifo = pointer_to_uword (s->tx_fifo->shr);
+      mp->server_rx_fifo = fifo_segment_fifo_offset (s->rx_fifo);
+      mp->server_tx_fifo = fifo_segment_fifo_offset (s->tx_fifo);
       mp->segment_handle = session_segment_handle (s);
     }
   else
@@ -328,12 +328,12 @@
       mp->lcl.is_ip4 = cct->c_is_ip4;
       mp->vpp_event_queue_address =
 	fifo_segment_msg_q_offset (eq_seg, s->thread_index);
-      mp->server_rx_fifo = pointer_to_uword (s->rx_fifo->shr);
-      mp->server_tx_fifo = pointer_to_uword (s->tx_fifo->shr);
+      mp->server_rx_fifo = fifo_segment_fifo_offset (s->rx_fifo);
+      mp->server_tx_fifo = fifo_segment_fifo_offset (s->tx_fifo);
       mp->segment_handle = session_segment_handle (s);
       ss = ct_session_get_peer (s);
-      mp->ct_rx_fifo = pointer_to_uword (ss->tx_fifo->shr);
-      mp->ct_tx_fifo = pointer_to_uword (ss->rx_fifo->shr);
+      mp->ct_rx_fifo = fifo_segment_fifo_offset (ss->tx_fifo);
+      mp->ct_tx_fifo = fifo_segment_fifo_offset (ss->rx_fifo);
       mp->ct_segment_handle = session_segment_handle (ss);
     }
 
@@ -395,8 +395,8 @@
 
   if (session_transport_service_type (ls) == TRANSPORT_SERVICE_CL)
     {
-      mp->rx_fifo = pointer_to_uword (ls->rx_fifo->shr);
-      mp->tx_fifo = pointer_to_uword (ls->tx_fifo->shr);
+      mp->rx_fifo = fifo_segment_fifo_offset (ls->rx_fifo);
+      mp->tx_fifo = fifo_segment_fifo_offset (ls->tx_fifo);
       mp->segment_handle = session_segment_handle (ls);
     }
 
diff --git a/src/vnet/session/session_node.c b/src/vnet/session/session_node.c
index 49e4e5a..37df0c4 100644
--- a/src/vnet/session/session_node.c
+++ b/src/vnet/session/session_node.c
@@ -472,8 +472,8 @@
   evt->event_type = SESSION_CTRL_EVT_WORKER_UPDATE_REPLY;
   rmp = (session_worker_update_reply_msg_t *) evt->data;
   rmp->handle = mp->handle;
-  rmp->rx_fifo = pointer_to_uword (s->rx_fifo->shr);
-  rmp->tx_fifo = pointer_to_uword (s->tx_fifo->shr);
+  rmp->rx_fifo = fifo_segment_fifo_offset (s->rx_fifo);
+  rmp->tx_fifo = fifo_segment_fifo_offset (s->tx_fifo);
   rmp->segment_handle = session_segment_handle (s);
   svm_msg_q_add_and_unlock (app_wrk->event_queue, msg);