diff --git a/src/vat/api_format.c b/src/vat/api_format.c
index 24b6fb0..d6af698 100644
--- a/src/vat/api_format.c
+++ b/src/vat/api_format.c
@@ -5884,7 +5884,7 @@
   W (ret);
   /* json responses may or may not include a useful reply... */
   if (vec_len (vam->cmd_reply))
-    print (vam->ofp, (char *) (vam->cmd_reply));
+    print (vam->ofp, "%v", (char *) (vam->cmd_reply));
   return ret;
 }
 
diff --git a/src/vat/main.c b/src/vat/main.c
index e2c9b70..aa990a3 100644
--- a/src/vat/main.c
+++ b/src/vat/main.c
@@ -308,6 +308,7 @@
   u8 *heap;
   mheap_t *h;
   int i;
+  f64 timeout;
 
   clib_mem_init (0, 128 << 20);
 
@@ -432,6 +433,18 @@
       fclose (vam->ifp);
     }
 
+  /*
+   * Particularly when running a script, don't be in a hurry to leave.
+   * A reply message queued to this process will end up constipating
+   * the allocation rings.
+   */
+  timeout = vat_time_now (vam) + 2.0;
+  while (vam->result_ready == 0 && vat_time_now (vam) < timeout)
+    ;
+
+  if (vat_time_now (vam) > timeout)
+    clib_warning ("BUG: message reply spin-wait timeout");
+
   vl_client_disconnect_from_vlib ();
   exit (0);
 }
diff --git a/src/vlibmemory/memory_client.c b/src/vlibmemory/memory_client.c
index 3f8b799..55913f5 100644
--- a/src/vlibmemory/memory_client.c
+++ b/src/vlibmemory/memory_client.c
@@ -80,6 +80,7 @@
   unix_shared_memory_queue_t *q;
   memory_client_main_t *mm = &memory_client_main;
   api_main_t *am = &api_main;
+  int i;
 
   q = am->vl_input_queue;
 
@@ -87,10 +88,27 @@
   if (setjmp (mm->rx_thread_jmpbuf) == 0)
     {
       mm->rx_thread_jmpbuf_valid = 1;
-      while (1)
+      /*
+       * Find an unused slot in the per-cpu-mheaps array,
+       * and grab it for this thread. We need to be able to
+       * push/pop the thread heap without affecting other thread(s).
+       */
+      if (__os_thread_index == 0)
 	{
-	  vl_msg_api_queue_handler (q);
+	  for (i = 0; i < ARRAY_LEN (clib_per_cpu_mheaps); i++)
+	    {
+	      if (clib_per_cpu_mheaps[i] == 0)
+		{
+		  /* Copy the main thread mheap pointer */
+		  clib_per_cpu_mheaps[i] = clib_per_cpu_mheaps[0];
+		  __os_thread_index = i;
+		  break;
+		}
+	    }
+	  ASSERT (__os_thread_index > 0);
 	}
+      while (1)
+	vl_msg_api_queue_handler (q);
     }
   pthread_exit (0);
 }
@@ -138,7 +156,7 @@
 
   /* Recreate the vnet-side API message handler table */
   tblv = uword_to_pointer (mp->message_table, u8 *);
-  serialize_open_vector (sm, tblv);
+  unserialize_open_data (sm, tblv, vec_len (tblv));
   unserialize_integer (sm, &nmsgs, sizeof (u32));
 
   for (i = 0; i < nmsgs; i++)
@@ -311,6 +329,7 @@
       /* drain the queue */
       if (ntohs (rp->_vl_msg_id) != VL_API_MEMCLNT_DELETE_REPLY)
 	{
+	  clib_warning ("queue drain: %d", ntohs (rp->_vl_msg_id));
 	  vl_msg_api_handler ((void *) rp);
 	  continue;
 	}
diff --git a/src/vlibmemory/memory_vlib.c b/src/vlibmemory/memory_vlib.c
index 65d04dc..338fda4 100644
--- a/src/vlibmemory/memory_vlib.c
+++ b/src/vlibmemory/memory_vlib.c
@@ -188,7 +188,6 @@
   int rv = 0;
   void *oldheap;
   api_main_t *am = &api_main;
-  u8 *serialized_message_table_in_shmem;
 
   /*
    * This is tortured. Maintain a vlib-address-space private
@@ -237,7 +236,9 @@
   regp->name = format (0, "%s", mp->name);
   vec_add1 (regp->name, 0);
 
-  serialized_message_table_in_shmem = vl_api_serialize_message_table (am, 0);
+  if (am->serialized_message_table_in_shmem == 0)
+    am->serialized_message_table_in_shmem =
+      vl_api_serialize_message_table (am, 0);
 
   pthread_mutex_unlock (&svm->mutex);
   svm_pop_heap (oldheap);
@@ -250,7 +251,8 @@
      am->shmem_hdr->application_restarts);
   rp->context = mp->context;
   rp->response = ntohl (rv);
-  rp->message_table = pointer_to_uword (serialized_message_table_in_shmem);
+  rp->message_table =
+    pointer_to_uword (am->serialized_message_table_in_shmem);
 
   vl_msg_api_send_shmem (q, (u8 *) & rp);
 }