diff --git a/src/ride/track_design.c b/src/ride/track_design.c
index ae11e4ed48..4f6d0e6c91 100644
--- a/src/ride/track_design.c
+++ b/src/ride/track_design.c
@@ -243,13 +243,14 @@ static rct_track_td6 *track_design_open_from_buffer(uint8 *src, size_t srcLength
 
 	// Set the element helper pointers
 	uintptr_t entranceElementsStart;
+	uintptr_t sceneryElementsStart;
 	if (td6->type == RIDE_TYPE_MAZE) {
 		td6->track_elements = NULL;
 		td6->maze_elements = (rct_td6_maze_element*)td6->elements;
 
 		rct_td6_maze_element *maze = td6->maze_elements;
 		for (; maze->all != 0; maze++) { }
-		entranceElementsStart = (uintptr_t)(++maze);
+		sceneryElementsStart = (uintptr_t)(++maze);
 	} else {
 		td6->maze_elements = NULL;
 		td6->track_elements = (rct_td6_track_element*)td6->elements;
@@ -257,13 +258,12 @@ static rct_track_td6 *track_design_open_from_buffer(uint8 *src, size_t srcLength
 		rct_td6_track_element *track = td6->track_elements;
 		for (; track->type != 0xFF; track++) { }
 		entranceElementsStart = (uintptr_t)track + 1;
-	}
 
-	uintptr_t sceneryElementsStart;
-	rct_td6_entrance_element *entranceElement = (rct_td6_entrance_element*)entranceElementsStart;
-	td6->entrance_elements = entranceElement;
-	for (; entranceElement->z != -1; entranceElement++) { }
-	sceneryElementsStart = (uintptr_t)entranceElement + 1;
+		rct_td6_entrance_element *entranceElement = (rct_td6_entrance_element*)entranceElementsStart;
+		td6->entrance_elements = entranceElement;
+		for (; entranceElement->z != -1; entranceElement++) { }
+		sceneryElementsStart = (uintptr_t)entranceElement + 1;
+	}
 
 	rct_td6_scenery_element *sceneryElement = (rct_td6_scenery_element*)sceneryElementsStart;
 	td6->scenery_elements = sceneryElement;
@@ -884,6 +884,7 @@ int track_design_place_maze(rct_track_td6 *td6, sint16 x, sint16 y, sint16 z, ui
 		RCT2_GLOBAL(RCT2_ADDRESS_MAP_ARROW_DIRECTION, uint8) = _currentTrackPieceDirection;
 	}
 
+	word_F440D5 = 0;
 	dword_F440D5 = 0;
 
 	rct_td6_maze_element *maze = td6->maze_elements;
diff --git a/src/ride/track_design_save.c b/src/ride/track_design_save.c
index 58b31b9195..59f109ffd9 100644
--- a/src/ride/track_design_save.c
+++ b/src/ride/track_design_save.c
@@ -688,7 +688,7 @@ static bool track_design_save_copy_scenery_to_td6(rct_track_td6 *td6)
 
 		sint16 x = ((uint8)scenery->x) * 32 - gTrackPreviewOrigin.x;
 		sint16 y = ((uint8)scenery->y) * 32 - gTrackPreviewOrigin.y;
-		rotate_map_coordinates(&x, &y, _trackSaveDirection ^ 2);
+		rotate_map_coordinates(&x, &y, (0 - _trackSaveDirection) & 3);
 		x /= 32;
 		y /= 32;
 
@@ -851,7 +851,7 @@ static bool track_design_save_to_td6_for_maze(uint8 rideIndex, rct_track_td6 *td
 				maze++;
 				numMazeElements++;
 
-				if (maze >= RCT2_ADDRESS(0x009DA151, rct_td6_maze_element)) {
+				if (numMazeElements >= 2000) {
 					gGameCommandErrorText = STR_TRACK_TOO_LARGE_OR_TOO_MUCH_SCENERY;
 					SafeFree(td6->maze_elements);
 					return false;
@@ -917,8 +917,13 @@ static bool track_design_save_to_td6_for_maze(uint8 rideIndex, rct_track_td6 *td
 	maze++;
 	numMazeElements++;
 
-	td6->maze_elements = realloc(td6->maze_elements, numMazeElements * sizeof(rct_td6_maze_element) + 1);
-	*((uint8*)&td6->maze_elements[numMazeElements]) = 0xFF;
+	// Write end marker
+	maze->all = 0;
+	maze++;
+	numMazeElements++;
+
+	// Trim memory
+	td6->maze_elements = realloc(td6->maze_elements, numMazeElements * sizeof(rct_td6_maze_element));
 
 	// Save global vars as they are still used by scenery
 	sint16 startZ = gTrackPreviewOrigin.z;
@@ -1243,6 +1248,7 @@ static void auto_buffer_write(auto_buffer *buffer, const void *src, size_t len)
  */
 static bool track_design_save_to_file(rct_track_td6 *td6, utf8 *path)
 {
+	const rct_td6_maze_element EndMarkerForMaze = { 0 };
 	const uint8 EndMarker = 0xFF;
 
 	window_close_construction_windows();
@@ -1252,17 +1258,15 @@ static bool track_design_save_to_file(rct_track_td6 *td6, utf8 *path)
 	auto_buffer_write(&td6Buffer, td6, 0xA3);
 	if (td6->type == RIDE_TYPE_MAZE) {
 		auto_buffer_write(&td6Buffer, td6->maze_elements, track_design_get_maze_elements_count(td6) * sizeof(rct_td6_maze_element));
-		auto_buffer_write(&td6Buffer, &EndMarker, sizeof(EndMarker));
-		auto_buffer_write(&td6Buffer, &EndMarker, sizeof(EndMarker));
-		auto_buffer_write(&td6Buffer, &EndMarker, sizeof(EndMarker));
+		auto_buffer_write(&td6Buffer, &EndMarkerForMaze, sizeof(EndMarkerForMaze));
 	} else {
 		auto_buffer_write(&td6Buffer, td6->track_elements, track_design_get_track_elements_count(td6) * sizeof(rct_td6_track_element));
 		auto_buffer_write(&td6Buffer, &EndMarker, sizeof(EndMarker));
 		auto_buffer_write(&td6Buffer, td6->entrance_elements, track_design_get_entrance_elements_count(td6) * sizeof(rct_td6_entrance_element));
 		auto_buffer_write(&td6Buffer, &EndMarker, sizeof(EndMarker));
-		auto_buffer_write(&td6Buffer, td6->scenery_elements, track_design_get_scenery_elements_count(td6) * sizeof(rct_td6_scenery_element));
-		auto_buffer_write(&td6Buffer, &EndMarker, sizeof(EndMarker));
 	}
+	auto_buffer_write(&td6Buffer, td6->scenery_elements, track_design_get_scenery_elements_count(td6) * sizeof(rct_td6_scenery_element));
+	auto_buffer_write(&td6Buffer, &EndMarker, sizeof(EndMarker));
 
 	// Encode TD6 data
 	uint8 *encodedData = malloc(0x8000);