diff --git a/src/libboard_artiq/src/drtioaux_proto.rs b/src/libboard_artiq/src/drtioaux_proto.rs
index 7026219..e19dd97 100644
--- a/src/libboard_artiq/src/drtioaux_proto.rs
+++ b/src/libboard_artiq/src/drtioaux_proto.rs
@@ -332,11 +332,15 @@ pub enum Packet {
     CoreMgmtAllocatorDebugRequest {
         destination: u8,
     },
-    CoreMgmtFlashRequest {
+    CoreMgmtFlashRequest { 
+        destination: u8,
+        payload_length: u32,
+    },
+    CoreMgmtFlashAddDataRequest {
         destination: u8,
         last: bool,
         length: u16,
-        data: [u8; MASTER_PAYLOAD_MAX_SIZE],
+        data: [u8; MASTER_PAYLOAD_MAX_SIZE]
     },
     CoreMgmtDropLinkAck {
         destination: u8,
@@ -694,24 +698,28 @@ impl Packet {
             0xda => Packet::CoreMgmtAllocatorDebugRequest {
                 destination: reader.read_u8()?,
             },
-            0xdb => {
+            0xdb => Packet::CoreMgmtFlashRequest {
+                destination: reader.read_u8()?,
+                payload_length: reader.read_u32()?,
+            },
+            0xdc => {
                 let destination = reader.read_u8()?;
                 let last = reader.read_bool()?;
                 let length = reader.read_u16()?;
                 let mut data: [u8; MASTER_PAYLOAD_MAX_SIZE] = [0; MASTER_PAYLOAD_MAX_SIZE];
                 reader.read_exact(&mut data[0..length as usize])?;
-                Packet::CoreMgmtFlashRequest {
+                Packet::CoreMgmtFlashAddDataRequest {
                     destination: destination,
                     last: last,
                     length: length,
                     data: data,
                 }
             }
-            0xdc => Packet::CoreMgmtDropLinkAck {
+            0xdd => Packet::CoreMgmtDropLinkAck {
                 destination: reader.read_u8()?,
             },
-            0xdd => Packet::CoreMgmtDropLink,
-            0xde => {
+            0xde => Packet::CoreMgmtDropLink,
+            0xdf => {
                 let last = reader.read_bool()?;
                 let length = reader.read_u16()?;
                 let mut data: [u8; SAT_PAYLOAD_MAX_SIZE] = [0; SAT_PAYLOAD_MAX_SIZE];
@@ -722,7 +730,7 @@ impl Packet {
                     data: data,
                 }
             }
-            0xdf => {
+            0xe0 => {
                 let last = reader.read_bool()?;
                 let length = reader.read_u16()?;
                 let mut value: [u8; SAT_PAYLOAD_MAX_SIZE] = [0; SAT_PAYLOAD_MAX_SIZE];
@@ -733,7 +741,7 @@ impl Packet {
                     value: value,
                 }
             }
-            0xe0 => Packet::CoreMgmtReply {
+            0xe1 => Packet::CoreMgmtReply {
                 succeeded: reader.read_bool()?,
             },
 
@@ -1182,37 +1190,42 @@ impl Packet {
                 writer.write_u8(0xda)?;
                 writer.write_u8(destination)?;
             }
-            Packet::CoreMgmtFlashRequest {
+            Packet::CoreMgmtFlashRequest { destination, payload_length } => {
+                writer.write_u8(0xdb)?;
+                writer.write_u8(destination)?;
+                writer.write_u32(payload_length)?;
+            }
+            Packet::CoreMgmtFlashAddDataRequest {
                 destination,
                 last,
                 length,
                 data,
             } => {
-                writer.write_u8(0xdb)?;
+                writer.write_u8(0xdc)?;
                 writer.write_u8(destination)?;
                 writer.write_bool(last)?;
                 writer.write_u16(length)?;
                 writer.write_all(&data[..length as usize])?;
             }
             Packet::CoreMgmtDropLinkAck { destination } => {
-                writer.write_u8(0xdc)?;
+                writer.write_u8(0xdd)?;
                 writer.write_u8(destination)?;
             }
-            Packet::CoreMgmtDropLink => writer.write_u8(0xdd)?,
+            Packet::CoreMgmtDropLink => writer.write_u8(0xde)?,
             Packet::CoreMgmtGetLogReply { last, length, data } => {
-                writer.write_u8(0xde)?;
+                writer.write_u8(0xdf)?;
                 writer.write_bool(last)?;
                 writer.write_u16(length)?;
                 writer.write_all(&data[0..length as usize])?;
             }
             Packet::CoreMgmtConfigReadReply { last, length, value } => {
-                writer.write_u8(0xdf)?;
+                writer.write_u8(0xe0)?;
                 writer.write_bool(last)?;
                 writer.write_u16(length)?;
                 writer.write_all(&value[0..length as usize])?;
             }
             Packet::CoreMgmtReply { succeeded } => {
-                writer.write_u8(0xe0)?;
+                writer.write_u8(0xe1)?;
                 writer.write_bool(succeeded)?;
             }
         }
diff --git a/src/runtime/src/mgmt.rs b/src/runtime/src/mgmt.rs
index f83cc94..621a886 100644
--- a/src/runtime/src/mgmt.rs
+++ b/src/runtime/src/mgmt.rs
@@ -640,6 +640,31 @@ mod remote_coremgmt {
     ) -> Result<()> {
         let mut image = &image[..];
 
+        let alloc_reply = drtio::aux_transact(
+            aux_mutex,
+            linkno,
+            routing_table,
+            &Packet::CoreMgmtFlashRequest {
+                destination: destination,
+                payload_length: image.len() as u32,
+            },
+            timer,
+        ).await;
+
+        match alloc_reply {
+            Ok(Packet::CoreMgmtReply { succeeded: true }) => Ok(()),
+            Ok(packet) => {
+                error!("received unexpected aux packet: {:?}", packet);
+                write_i8(stream, Reply::Error as i8).await?;
+                Err(drtio::Error::UnexpectedReply)
+            }
+            Err(e) => {
+                error!("aux packet error ({})", e);
+                write_i8(stream, Reply::Error as i8).await?;
+                Err(drtio::Error::AuxError)
+            }
+        }?;
+
         while !image.is_empty() {
             let mut data = [0; MASTER_PAYLOAD_MAX_SIZE];
             let len = image.read(&mut data).unwrap();
@@ -649,7 +674,7 @@ mod remote_coremgmt {
                 aux_mutex,
                 linkno,
                 routing_table,
-                &Packet::CoreMgmtFlashRequest {
+                &Packet::CoreMgmtFlashAddDataRequest {
                     destination: destination,
                     last: last,
                     length: len as u16,
diff --git a/src/satman/src/main.rs b/src/satman/src/main.rs
index a51d377..cf00c8a 100644
--- a/src/satman/src/main.rs
+++ b/src/satman/src/main.rs
@@ -1281,6 +1281,24 @@ fn process_aux_packet(
             drtioaux::send(0, &drtioaux::Packet::CoreMgmtReply { succeeded: false })
         }
         drtioaux::Packet::CoreMgmtFlashRequest {
+            destination: _destination,
+            payload_length
+        } => {
+            forward!(
+                router,
+                _routing_table,
+                _destination,
+                *rank,
+                *self_destination,
+                _repeaters,
+                &packet,
+                timer
+            );
+
+            core_manager.allocate_image_buffer(payload_length as usize);
+            drtioaux::send(0, &drtioaux::Packet::CoreMgmtReply { succeeded: true })
+        }
+        drtioaux::Packet::CoreMgmtFlashAddDataRequest {
             destination: _destination,
             last,
             length,
diff --git a/src/satman/src/mgmt.rs b/src/satman/src/mgmt.rs
index fd60942..d92bc60 100644
--- a/src/satman/src/mgmt.rs
+++ b/src/satman/src/mgmt.rs
@@ -115,6 +115,10 @@ impl<'a> Manager<'_> {
             .map_err(|err| warn!("failed to erase: {:?}", err))
     }
 
+    pub fn allocate_image_buffer(&mut self, image_size: usize) {
+        self.image_payload = Vec::with_capacity(image_size);
+    }
+
     pub fn add_image_data(&mut self, data: &[u8], data_len: usize) {
         self.image_payload.extend(&data[..data_len]);
     }