diff --git a/course/02-KVM.md b/course/02-KVM.md
index 6c24187d34ea555118322c2e48be0ae538e0293e..aa8549e8559bf06e3c83b4c6ead0cd12ab9bc76c 100644
--- a/course/02-KVM.md
+++ b/course/02-KVM.md
@@ -742,7 +742,7 @@ How does VMM retrieve an hypercall's parameters?
 
 ```{.c .tiny}
 if (run->io.direction == KVM_EXIT_IO_OUT) {  // See struct kvm_run in "(6) Create a vCPU"
-    uint8_t *addr = (uint8_t *)kvm_run + run->io.data_offset;
+    uint8_t *addr = (uint8_t *)run + run->io.data_offset;
     uint32_t value;
     switch (run->io.size) {
         case 1:  // Retrieve the 8-bit value written by the guest
@@ -804,7 +804,7 @@ if (run->mmio.is_write) {  // See struct kvm_run in "(6) Create a vCPU"
  
 ```{.c .tiny}
 if (run->io.direction == KVM_EXIT_IO_IN) {  // See struct kvm_run
-  uint8_t *addr = (uint8_t *)kvm_run + run->io.data_offset;
+  uint8_t *addr = (uint8_t *)run + run->io.data_offset;
   switch (run->io.size) {
     case 1: { // Guest is reading 8 bits from the port
       *addr = 0x12;  // 8-bit example value injected into the guest