diff --git a/kernel/syscall/ioctl.c b/kernel/syscall/ioctl.c
index 811d159..a7a68da 100644
--- a/kernel/syscall/ioctl.c
+++ b/kernel/syscall/ioctl.c
@@ -134,25 +134,29 @@ int32_t SYSCALL5(sys_ioctl, ioh1, cmd1, arg1, arg2, arg3) {
       ret = vobj->read(vobj, buffer, len, off);
     } break;
     case IOCTL_STAT: {
-      if (ioh >= PROC_VFSHANDLES_MAX) {
+      const char *opath = (const char *)arg2;
+      
+      if (opath == NULL) {
         ret = E_INVALIDARGUMENT;
         goto done;
       }
 
-      spinlock_acquire(&PROCS.spinlock);
-      Proc *proc = PROCS.current;
-      spinlock_release(&PROCS.spinlock);
+      char mp[IOCTL_MP_MAX];
+      char path[IOCTL_PATH_MAX];
 
-      VfsObj *vobj = proc->vobjs[ioh];
+      path_parse(opath, mp, path);
 
+      VfsObj *vobj = vfs_open(mp, path, IOCTL_F_READ);
       if (vobj == NULL) {
-        ret = E_INVALIDARGUMENT;
+        ret = E_NOENTRY;
         goto done;
       }
 
       VfsStat stat1;
       ret = vobj->stat(vobj, &stat1);
 
+      vfs_close(vobj);
+
       IoctlStat *iostat = (IoctlStat *)arg1;
       if (iostat == NULL) {
         ret = E_INVALIDARGUMENT;
diff --git a/share/sysdefs/ioctl.h b/share/sysdefs/ioctl.h
index bf588c0..1e03e54 100644
--- a/share/sysdefs/ioctl.h
+++ b/share/sysdefs/ioctl.h
@@ -12,6 +12,7 @@ enum {
   IOCTL_READ = 2,
   IOCTL_STAT = 3,
   IOCTL_WRITE = 4,
+  IOCTL_FETCHDIRENT = 5,
 };
 
 enum {
@@ -30,6 +31,11 @@ typedef struct IoctlStat {
   int32_t type;
 } IoctlStat;
 
+typedef struct IoctlDirent {
+  IoctlStat stat;
+  char name[0x100];
+} IoctlDirent;
+
 typedef int32_t IOH;
 
 #endif // SHARE_SYSDEFS_IOCTL_H_
diff --git a/user/fs/fetch.c b/user/fs/fetch.c
index 631dbf0..ea4c166 100644
--- a/user/fs/fetch.c
+++ b/user/fs/fetch.c
@@ -18,7 +18,7 @@ void fs_fetch(void) {
 
   IoctlStat statbuf; ZERO(&statbuf);
 
-  ioctl(ioh, IOCTL_STAT, (uint64_t)&statbuf, 0, 0);
+  ioctl(ioh, IOCTL_STAT, (uint64_t)&statbuf, (uint64_t)path, 0);
   if (statbuf.type == IOCTLSTAT_FILE) {
     uint8_t *buf = umalloc(statbuf.size+1);
     string_memset(buf, 0, statbuf.size+1);
@@ -31,5 +31,8 @@ void fs_fetch(void) {
     }
 
     uprintf("%s", buf);
+    ufree(buf);
   }
+
+  ioctl(ioh, IOCTL_CLOSEF, 0, 0, 0);
 }
diff --git a/user/tb/main.c b/user/tb/main.c
index 3fdee2e..9175c28 100644
--- a/user/tb/main.c
+++ b/user/tb/main.c
@@ -68,7 +68,7 @@ void do_file(char *filepath) {
 
   IoctlStat statbuf; ZERO(&statbuf);
 
-  ioctl(ioh, IOCTL_STAT, (uint64_t)&statbuf, 0, 0);
+  ioctl(ioh, IOCTL_STAT, (uint64_t)&statbuf, (uint64_t)filepath, 0);
   if (statbuf.type != IOCTLSTAT_FILE) {
     LOG(LOG_ERR, "%s is not a file (%d)\n", filepath, statbuf.type);
     return;