diff --git a/dm-sflc/src/lite/posmap.c b/dm-sflc/src/lite/posmap.c
index cb96692..f2bbe5e 100644
--- a/dm-sflc/src/lite/posmap.c
+++ b/dm-sflc/src/lite/posmap.c
@@ -189,15 +189,20 @@ int sflite_flush_posmap(struct sflite_volume *svol)
 	while (1) {
 		unsigned int j;
 
+		// Find next region of 1s
 		i = find_next_bit(svol->posmap.dirty_bitmap, bitmap_bits, i);
 		if (unlikely(i == bitmap_bits))
 			break;
 		j = find_next_zero_bit(svol->posmap.dirty_bitmap, bitmap_bits, i);
 
+		// Encrypt from block i to j (exclusive)
+
+		// Region on-disk
 		region.bdev = svol->dm_dev->bdev;
 		region.sector =  SFLITE_POSMAP_START_SECTOR(svol) + (i << SFLITE_BLOCK_SHIFT);
 		region.count = (sector_t)(j - i) << SFLITE_BLOCK_SHIFT;
 
+		// Request to dm-io
 		req.bi_opf = REQ_OP_WRITE | REQ_SYNC;
 		req.mem.type = DM_IO_VMA;
 		req.mem.ptr.vma = (char *)wc->memory_map + (size_t)i * BITMAP_GRANULARITY;	//TODO
@@ -206,7 +211,7 @@ int sflite_flush_posmap(struct sflite_volume *svol)
 		req.notify.context = &endio;
 		atomic_inc(&endio.pending);
 
-		/* writing via async dm-io (implied by notify.fn above) won't return an error */
+		/* Writing via async dm-io (implied by notify.fn above) won't return an error */
 		(void) sflc_dm_io(&req, 1, &region, NULL);
 		i = j;
 	}
diff --git a/dm-sflc/src/lite/sflite_types.h b/dm-sflc/src/lite/sflite_types.h
index 51749f3..7a44645 100644
--- a/dm-sflc/src/lite/sflite_types.h
+++ b/dm-sflc/src/lite/sflite_types.h
@@ -85,6 +85,8 @@ struct sflite_posmap
 
 	// Table mapping LSI => PSI
 	u32			*entries;
+	// Encrypted version of the above table
+	u8			*crypt_entries;
 	// Number of non-nil entries
 	u32			nr_mapped_slices;
 
diff --git a/dm-sflc/src/lite/volume.c b/dm-sflc/src/lite/volume.c
index 2a9720b..68186ff 100644
--- a/dm-sflc/src/lite/volume.c
+++ b/dm-sflc/src/lite/volume.c
@@ -107,6 +107,12 @@ struct sflc_volume_base *sflite_vol_ctr(struct sflc_device_base *sd_base,
 		err = -ENOMEM;
 		goto bad_posmap_entries_alloc;
 	}
+	svol->posmap.crypt_entries = vmalloc(sdev->posmap_size_sectors * SECTOR_SIZE);
+	if (!svol->posmap.crypt_entries) {
+		DMERR("Could not allocate position map encrypted entries");
+		err = -ENOMEM;
+		goto bad_posmap_crypt_entries_alloc;
+	}
 	svol->posmap.nr_mapped_slices = 0;
 	/* Dirty bitmap */
 	svol->posmap.dirty_bitmap = bitmap_zalloc(sdev->posmap_size_blocks);
@@ -148,7 +154,9 @@ bad_sysfs:
 bad_posmap_load:
 	bitmap_free(svol->posmap.dirty_bitmap);
 bad_posmap_dirty_bitmap_alloc:
-	vfree(svol->posmap);
+	vfree(svol->posmap.crypt_entries);
+bad_posmap_crypt_entries_alloc:
+	vfree(svol->posmap.entries);
 bad_posmap_entries_alloc:
 bad_tfm_setkey:
 	crypto_free_skcipher(svol->tfm);
@@ -168,7 +176,8 @@ void sflite_vol_dtr(struct sflc_volume_base *sv_base)
 	struct sflite_volume *svol = container_of(sv_base, struct sflite_volume, sv_base);
 
 	sflite_sysfs_remove_volume(svol);
-	vfree(svol->posmap);
+	vfree(svol->posmap.crypt_entries);
+	vfree(svol->posmap.entries);
 	crypto_free_skcipher(svol->tfm);
 	dm_put_device(svol->ti, svol->dm_dev);
 	sflc_vol_base_exit(&svol->sv_base);