diff --git a/apps/zasm/README.md b/apps/zasm/README.md
index 906f4c8..0d880ae 100644
--- a/apps/zasm/README.md
+++ b/apps/zasm/README.md
@@ -121,15 +121,20 @@ allowed. An included file cannot have an `.inc` directive.
           expression written as the second parameter. Example:
           `.equ foo 0x42+'A'`
           
-          If the symbol specified has already been defined, no error occur and
-          the first value defined stays intact. This allows for "user override"
-          of programs.
+If the symbol specified has already been defined, no error occur and
+the first value defined stays intact. This allows for "user override"
+of programs.
 
 **.fill**: Outputs the number of null bytes specified by its argument, an
            expression. Often used with `$` to fill our binary up to a certain
            offset. For example, if we want to place an instruction exactly at
            byte 0x38, we would precede it with `.fill 0x38-$`.
 
+The maximum value possible for `.fill` is `0xd000`. We do this to
+avoid "overshoot" errors, that is, error where `$` is greater than
+the offset you're trying to reach in an expression like `.fill X-$`
+(such an expression overflows to `0xffff`).
+
 **.org**: Sets the Program Counter to the value of the argument, an expression.
           For example, a label being defined right after a `.org 0x400`, would
           have a value of `0x400`. Does not do any filling. You have to do that
diff --git a/apps/zasm/directive.asm b/apps/zasm/directive.asm
index f13cfd1..b443f19 100644
--- a/apps/zasm/directive.asm
+++ b/apps/zasm/directive.asm
@@ -201,8 +201,11 @@ handleFIL:
 	jr	nz, .badfmt
 	call	parseExpr
 	jr	nz, .badarg
-	push	bc
+	push	bc	; --> lvl 1
 	push	ix \ pop bc
+	ld	a, b
+	cp	0xd0
+	jr	nc, .overflow
 .loop:
 	ld	a, b
 	or	c
@@ -213,20 +216,22 @@ handleFIL:
 	dec	bc
 	jr	.loop
 .loopend:
-	cp	a		; ensure Z
-	pop	bc
+	cp	a	; ensure Z
+	pop	bc	; <-- lvl 1
 	ret
 .ioError:
 	ld	a, SHELL_ERR_IO_ERROR
-	jr	.error
+	jp	unsetZ
 .badfmt:
 	ld	a, ERR_BAD_FMT
-	jr	.error
+	jp	unsetZ
 .badarg:
 	ld	a, ERR_BAD_ARG
-.error:
-	call	unsetZ
-	ret
+	jp	unsetZ
+.overflow:
+	pop	bc	; <-- lvl 1
+	ld	a, ERR_OVFL
+	jp	unsetZ
 
 handleOUT:
 	push	hl
diff --git a/tools/tests/zasm/errtests.sh b/tools/tests/zasm/errtests.sh
index b4f34f4..b08c2c4 100755
--- a/tools/tests/zasm/errtests.sh
+++ b/tools/tests/zasm/errtests.sh
@@ -54,6 +54,7 @@ chkerr ".inc" 19
 chkerr ".inc foo" 19
 chkerr "ld a, 0x100" 20
 chkerr ".db 0x100" 20
+chkerr $'nop \ nop \ nop\n.fill 2-$' 20
 chkerr ".inc \"doesnotexist\"" 21
 chkerr "foo:\\foo:" 22
 chkoom