diff --git a/sys-utils/libcmt/include/libcmt/io.h b/sys-utils/libcmt/include/libcmt/io.h
index 19b5603e..29d8a47a 100644
--- a/sys-utils/libcmt/include/libcmt/io.h
+++ b/sys-utils/libcmt/include/libcmt/io.h
@@ -91,6 +91,8 @@ enum {
 typedef struct {
     cmt_buf_t tx[1];
     cmt_buf_t rx[1];
+    uint32_t rx_max_length;
+    uint32_t rx_fromhost_length;
     int fd;
 } cmt_io_driver_ioctl_t;
 
diff --git a/sys-utils/libcmt/src/ioctl/io.c b/sys-utils/libcmt/src/ioctl/io.c
index 22f51af1..b341feb5 100644
--- a/sys-utils/libcmt/src/ioctl/io.c
+++ b/sys-utils/libcmt/src/ioctl/io.c
@@ -44,6 +44,9 @@ int cmt_io_init(cmt_io_driver_t *_me) {
         goto do_unmap;
     }
 
+    me->rx_max_length = setup.rx.length;
+    me->rx_fromhost_length = 0;
+
     cmt_buf_init(me->tx, setup.tx.length, tx);
     cmt_buf_init(me->rx, setup.rx.length, rx);
     return 0;
@@ -69,17 +72,23 @@ void cmt_io_fini(cmt_io_driver_t *_me) {
 }
 
 cmt_buf_t cmt_io_get_tx(cmt_io_driver_t *me) {
-    cmt_buf_t empty = {NULL, NULL};
+    static const cmt_buf_t empty = {NULL, NULL};
     if (!me)
         return empty;
     return *me->ioctl.tx;
 }
 
+static uint32_t min(uint32_t a, uint32_t b) {
+    return a < b? a: b;
+}
+
 cmt_buf_t cmt_io_get_rx(cmt_io_driver_t *me) {
-    cmt_buf_t empty = {NULL, NULL};
+    static const cmt_buf_t empty = {NULL, NULL};
     if (!me)
         return empty;
-    return *me->ioctl.rx;
+    cmt_buf_t rx = *me->ioctl.rx;
+    rx.end = rx.begin + min(me->ioctl.rx_max_length, me->ioctl.rx_fromhost_length);
+    return rx;
 }
 
 static uint64_t pack(struct cmt_io_yield *rr) {
@@ -125,6 +134,9 @@ int cmt_io_yield(cmt_io_driver_t *_me, struct cmt_io_yield *rr) {
     if (ioctl(me->fd, IOCTL_CMIO_YIELD, &req))
         return -errno;
     *rr = unpack(req);
+
+    me->rx_fromhost_length = rr->data;
+
     if (enabled) {
         fprintf(stderr,
             "fromhost {\n"
diff --git a/sys-utils/libcmt/src/rollup.c b/sys-utils/libcmt/src/rollup.c
index 601dc58f..6f4f488f 100644
--- a/sys-utils/libcmt/src/rollup.c
+++ b/sys-utils/libcmt/src/rollup.c
@@ -205,16 +205,9 @@ int cmt_rollup_read_inspect_state(cmt_rollup_t *me, cmt_rollup_inspect_t *inspec
         return -EINVAL;
     if (!inspect)
         return -EINVAL;
-
-    cmt_buf_t rd[1] = {cmt_io_get_rx(me->io)};
-    cmt_buf_t st[1] = {{rd->begin + 4, rd->end}}; // EVM offsets are from after funsel
-    cmt_buf_t of[1];
-
-    size_t length = 0;
-    if (DBG(cmt_abi_check_funsel(rd, EVM_INSPECT)) || DBG(cmt_abi_get_bytes_s(rd, of)) ||
-        DBG(cmt_abi_get_bytes_d(st, of, &length, &inspect->data)))
-        return -ENOBUFS;
-    inspect->length = length;
+    cmt_buf_t rx[1] = {cmt_io_get_rx(me->io)};
+    inspect->length = cmt_buf_length(rx);
+    inspect->data = rx->begin;
     return 0;
 }