diff --git a/src/stub/l_lx_exec.c b/src/stub/l_lx_exec.c
index ceb9901c..dc2ee32c 100644
--- a/src/stub/l_lx_exec.c
+++ b/src/stub/l_lx_exec.c
@@ -357,12 +357,12 @@ void upx_main(
     // FIXME: packer could set address delta
     mmap(buf + (PAGE_MASK & (header.p_filesize + ~PAGE_MASK)),
         -PAGE_MASK, PROT_READ | PROT_WRITE,
-        MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS, 0, 0 );
+        MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS, -1, 0 );
 #else
     // Temporary decompression buffer.
     // FIXME: packer could set length
     buf = mmap(0, (header.p_blocksize + OVERHEAD + ~PAGE_MASK) & PAGE_MASK,
-        PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, 0, 0 );
+        PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0 );
     if ((unsigned long) buf >= (unsigned long) -4095)
         goto error;
 #endif
diff --git a/src/stub/l_lx_sh.c b/src/stub/l_lx_sh.c
index eae08e3d..2816f80b 100644
--- a/src/stub/l_lx_sh.c
+++ b/src/stub/l_lx_sh.c
@@ -209,7 +209,7 @@ xfind_pages(unsigned mflags, Elf32_Phdr const *phdr, int phnum)
     lo   -= ~PAGE_MASK & lo;  // round down to page boundary
     hi    =  PAGE_MASK & (hi - lo - PAGE_MASK -1);  // page length
     szlo  =  PAGE_MASK & (szlo    - PAGE_MASK -1);  // page length
-    addr = mmap((void *)lo, hi, PROT_READ|PROT_WRITE|PROT_EXEC, mflags, 0, 0);
+    addr = mmap((void *)lo, hi, PROT_READ|PROT_WRITE|PROT_EXEC, mflags, -1, 0);
 
     // Doing this may destroy the brk() that we set so carefully above.
     // The munmap() is "needed" only for discontiguous PT_LOAD,
@@ -266,7 +266,7 @@ ERR_LAB
         addr += mlen + frag;  /* page boundary on hi end */
         if (addr < haddr) { // need pages for .bss
             if (addr != mmap(addr, haddr - addr, prot,
-                    MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS, 0, 0 ) ) {
+                    MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS, -1, 0 ) ) {
                 err_exit(9);
             }
         }
diff --git a/src/stub/l_lx_sh86.asm b/src/stub/l_lx_sh86.asm
index c84eec05..62844b1e 100644
--- a/src/stub/l_lx_sh86.asm
+++ b/src/stub/l_lx_sh86.asm
@@ -149,7 +149,7 @@ unfold:
         add ecx, 1+ 3+ (3 -1)+ PAGE_SIZE  ; '\0' + "-c" + decompr_overrun + stub
 
         push eax  ; offset (ignored when MAP_ANONYMOUS)
-        push eax  ; fd     (ignored when MAP_ANONYMOUS)
+        push byte -1  ; fd [required by *BSD for MAP_ANONYMOUS]
         push byte MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS
         push byte PROT_READ | PROT_WRITE | PROT_EXEC
         push ecx  ; length