diff --git a/mps/test/conerr/66.c b/mps/test/conerr/66.c
new file mode 100644
index 00000000000..7e6f003854b
--- /dev/null
+++ b/mps/test/conerr/66.c
@@ -0,0 +1,65 @@
+/* 
+TEST_HEADER
+ id = $Id$
+ summary = AMS pool asserts on unaligned exact reference
+ language = c
+ link = myfmt.o testlib.o
+OUTPUT_SPEC
+ assert = true
+ assertfile P= poolams.c
+ assertcond = AddrIsAligned(base, PoolAlignment(pool))
+END_HEADER
+*/
+
+#include "testlib.h"
+#include "mpscams.h"
+#include "myfmt.h"
+
+static void test(void)
+{
+ void *marker = ▮
+ mps_arena_t arena;
+ mps_pool_t pool;
+ mps_thr_t thread;
+ mps_root_t root;
+ mps_fmt_t format;
+ mps_ap_t ap;
+ mps_addr_t p, q, unaligned;
+
+ cdie(mps_arena_create_k(&arena, mps_arena_class_vm(), mps_args_none), "create arena");
+ mps_arena_park(arena);
+ cdie(mps_thread_reg(&thread, arena), "register thread");
+ cdie(mps_root_create_thread(&root, arena, thread, marker), "create root");
+ cdie(mps_fmt_create_A(&format, arena, &fmtA), "create format");
+ MPS_ARGS_BEGIN(args) {
+   MPS_ARGS_ADD(args, MPS_KEY_FORMAT, format);
+   cdie(mps_pool_create_k(&pool, arena, mps_class_ams(), args), "pool");
+ } MPS_ARGS_END(args);
+ cdie(mps_ap_create(&ap, pool, mps_rank_exact()), "ap");
+
+ /* p is in the AMS pool */
+ p = allocone(ap, 0, NULL, NULL, sizeof(mycell));
+
+ /* q is in the AMS pool with unaligned exact reference to p */
+ unaligned = (void *)((char*)p + 1);
+ q = allocone(ap, 1, p, unaligned, sizeof(mycell));
+
+ mps_arena_start_collect(arena);
+ mps_arena_park(arena);
+
+ /* Keep q (and thus p) alive during the collection. */
+ report("q", "%p", q);
+
+ mps_ap_destroy(ap);
+ mps_pool_destroy(pool);
+ mps_fmt_destroy(format);
+ mps_root_destroy(root);
+ mps_thread_dereg(thread);
+ mps_arena_destroy(arena);
+}
+
+int main(void)
+{
+ easy_tramp(test);
+ return 0;
+}
diff --git a/mps/test/conerr/67.c b/mps/test/conerr/67.c
new file mode 100644
index 00000000000..6c150142ba8
--- /dev/null
+++ b/mps/test/conerr/67.c
@@ -0,0 +1,67 @@
+/* 
+TEST_HEADER
+ id = $Id$
+ summary = AMS pool asserts on exact reference to unallocated object
+ language = c
+ link = myfmt.o testlib.o
+OUTPUT_SPEC
+ assert = true
+ assertfile P= poolams.c
+ assertcond = AMS_ALLOCED(seg, i)
+END_HEADER
+*/
+
+#include "testlib.h"
+#include "mpscams.h"
+#include "myfmt.h"
+
+static void test(void)
+{
+ void *marker = ▮
+ mps_arena_t arena;
+ mps_pool_t pool;
+ mps_thr_t thread;
+ mps_root_t root;
+ mps_fmt_t format;
+ mps_ap_t ap;
+ mps_addr_t p, q, unallocated;
+
+ cdie(mps_arena_create_k(&arena, mps_arena_class_vm(), mps_args_none), "create arena");
+ mps_arena_park(arena);
+ cdie(mps_thread_reg(&thread, arena), "register thread");
+ cdie(mps_root_create_thread(&root, arena, thread, marker), "create root");
+ cdie(mps_fmt_create_A(&format, arena, &fmtA), "create format");
+ MPS_ARGS_BEGIN(args) {
+   MPS_ARGS_ADD(args, MPS_KEY_FORMAT, format);
+   cdie(mps_pool_create_k(&pool, arena, mps_class_ams(), args), "pool");
+ } MPS_ARGS_END(args);
+ cdie(mps_ap_create(&ap, pool, mps_rank_exact()), "ap");
+
+ /* p is in the AMS pool */
+ p = allocone(ap, 0, NULL, NULL, sizeof(mycell));
+
+ /* q is in the AMS pool with exact references to p and unallocated object */
+ unallocated = (void *)((char*)p + 2 * sizeof(mycell));
+ q = allocone(ap, 1, p, unallocated, sizeof(mycell));
+
+ /* Destroy the allocation point so that the segment gets unbuffered. */
+ mps_ap_destroy(ap);
+
+ mps_arena_start_collect(arena);
+ mps_arena_park(arena);
+
+ /* Keep q (and thus p) alive during the collection. */
+ report("q", "%p", q);
+
+ mps_pool_destroy(pool);
+ mps_fmt_destroy(format);
+ mps_root_destroy(root);
+ mps_thread_dereg(thread);
+ mps_arena_destroy(arena);
+}
+
+int main(void)
+{
+ easy_tramp(test);
+ return 0;
+}
diff --git a/mps/test/conerr/68.c b/mps/test/conerr/68.c
new file mode 100644
index 00000000000..5b2875e5d4e
--- /dev/null
+++ b/mps/test/conerr/68.c
@@ -0,0 +1,72 @@
+/* 
+TEST_HEADER
+ id = $Id$
+ summary = AMS pool asserts on exact out-of-bounds reference
+ language = c
+ link = myfmt.o testlib.o
+OUTPUT_SPEC
+ assert = true
+ assertfile P= poolams.c
+ assertcond = ss->rank == RankAMBIG
+END_HEADER
+*/
+
+#include "testlib.h"
+#include "mpscams.h"
+#include "myfmt.h"
+
+static void test(void)
+{
+ void *marker = ▮
+ mps_arena_t arena;
+ mps_pool_t pool;
+ mps_thr_t thread;
+ mps_root_t root;
+ mps_fmt_t fmt;
+ mps_ap_t ap;
+ mps_addr_t p, q, out_of_bounds;
+ size_t header = sizeof(mycell);
+
+ cdie(mps_arena_create_k(&arena, mps_arena_class_vm(), mps_args_none), "create arena");
+ mps_arena_park(arena);
+ cdie(mps_thread_reg(&thread, arena), "register thread");
+ cdie(mps_root_create_thread(&root, arena, thread, marker), "create root");
+ MPS_ARGS_BEGIN(args) {
+   MPS_ARGS_ADD(args, MPS_KEY_FMT_HEADER_SIZE, header);
+   fmtargs(args + 1);
+   cdie(mps_fmt_create_k(&fmt, arena, args), "format");
+ } MPS_ARGS_END(args);
+ MPS_ARGS_BEGIN(args) {
+   MPS_ARGS_ADD(args, MPS_KEY_FORMAT, fmt);
+   cdie(mps_pool_create_k(&pool, arena, mps_class_ams(), args), "pool");
+ } MPS_ARGS_END(args);
+ cdie(mps_ap_create(&ap, pool, mps_rank_exact()), "ap");
+
+ /* p is in the AMS pool */
+ p = allocheader(ap, 0, NULL, NULL, sizeof(mycell), header);
+
+ /* q is in the AMS pool with exact reference to p and out-of-bounds object */
+ out_of_bounds = (void *)((char*)p - header);
+ q = allocheader(ap, 1, p, out_of_bounds, sizeof(mycell), header);
+
+ /* Destroy the allocation point so that the segment gets unbuffered. */
+ mps_ap_destroy(ap);
+
+ mps_arena_start_collect(arena);
+ mps_arena_park(arena);
+
+ /* Keep q (and thus p) alive during the collection. */
+ report("q", "%p", q);
+
+ mps_pool_destroy(pool);
+ mps_fmt_destroy(fmt);
+ mps_root_destroy(root);
+ mps_thread_dereg(thread);
+ mps_arena_destroy(arena);
+}
+
+int main(void)
+{
+ easy_tramp(test);
+ return 0;
+}
diff --git a/mps/test/testsets/conerr b/mps/test/testsets/conerr
index 44293c4f73d..ca00fcb4a8a 100644
--- a/mps/test/testsets/conerr
+++ b/mps/test/testsets/conerr
@@ -73,3 +73,6 @@ conerr/59.c
 % conerr/63.c -- assertion is on the critical path
 % conerr/64.c -- assertion is on the critical path
 % conerr/65.c -- assertion is on the critical path
+% conerr/66.c -- assertion is on the critical path
+% conerr/67.c -- assertion is on the critical path
+% conerr/68.c -- assertion is on the critical path
diff --git a/mps/test/testsets/coolonly b/mps/test/testsets/coolonly
index aae9b5a74e5..8fce260bddd 100644
--- a/mps/test/testsets/coolonly
+++ b/mps/test/testsets/coolonly
@@ -51,4 +51,7 @@ conerr/62.c
 conerr/63.c
 conerr/64.c
 conerr/65.c
+conerr/66.c
+conerr/67.c
+conerr/68.c
 function/72.c