diff --git a/MdeModulePkg/Universal/DriverSampleDxe/NVDataStruc.h b/MdeModulePkg/Universal/DriverSampleDxe/NVDataStruc.h
index 0a5d46bc96..bdc4a46147 100644
--- a/MdeModulePkg/Universal/DriverSampleDxe/NVDataStruc.h
+++ b/MdeModulePkg/Universal/DriverSampleDxe/NVDataStruc.h
@@ -1,6 +1,6 @@
 /** @file
 
-Copyright (c) 2007 - 2008, Intel Corporation
+Copyright (c) 2007 - 2009, Intel Corporation
 All rights reserved. This program and the accompanying materials
 are licensed and made available under the terms and conditions of the BSD License
 which accompanies this distribution.  The full text of the license may be found at
@@ -57,7 +57,7 @@ typedef struct {
   UINT8   ChooseToActivateNuclearWeaponry;
   UINT8   SuppressGrayOutSomething;
   UINT8   OrderedList[8];
-  UINT8   BootOrder[8];
+  UINT16  BootOrder[8];
   UINT8   BootOrderLarge;
   UINT8   DynamicRefresh;
   UINT8   DynamicOneof;
diff --git a/MdeModulePkg/Universal/SetupBrowserDxe/InputHandler.c b/MdeModulePkg/Universal/SetupBrowserDxe/InputHandler.c
index b7c07e8d7c..1a8af2e289 100644
--- a/MdeModulePkg/Universal/SetupBrowserDxe/InputHandler.c
+++ b/MdeModulePkg/Universal/SetupBrowserDxe/InputHandler.c
@@ -729,6 +729,7 @@ GetSelectionInputPopUp (
   Question = MenuOption->ThisTag;
   if (Question->Operand == EFI_IFR_ORDERED_LIST_OP) {
     ValueArray = Question->BufferValue;
+    ValueType = Question->ValueType;
     OrderedList = TRUE;
   } else {
     OrderedList = FALSE;
diff --git a/MdeModulePkg/Universal/SetupBrowserDxe/Presentation.c b/MdeModulePkg/Universal/SetupBrowserDxe/Presentation.c
index 9fd08c5529..c880c8afbb 100644
--- a/MdeModulePkg/Universal/SetupBrowserDxe/Presentation.c
+++ b/MdeModulePkg/Universal/SetupBrowserDxe/Presentation.c
@@ -857,6 +857,7 @@ SetupBrowser (
   EFI_BROWSER_ACTION_REQUEST      ActionRequest;
   EFI_HANDLE                      NotifyHandle;
   EFI_HII_VALUE                   *HiiValue;
+  EFI_IFR_TYPE_VALUE              *TypeValue;
   FORM_BROWSER_STATEMENT          *Statement;
   EFI_HII_CONFIG_ACCESS_PROTOCOL  *ConfigAccess;
   FORM_BROWSER_FORMSET            *FormSet;
@@ -1019,23 +1020,30 @@ SetupBrowser (
       if (((Statement->QuestionFlags & EFI_IFR_FLAG_CALLBACK) == EFI_IFR_FLAG_CALLBACK) && (Statement->Operand != EFI_IFR_PASSWORD_OP)) {
         ActionRequest = EFI_BROWSER_ACTION_REQUEST_NONE;
 
+        if (ConfigAccess == NULL) {
+          return EFI_UNSUPPORTED;
+        }
+
         HiiValue = &Statement->HiiValue;
+        TypeValue = &HiiValue->Value;
         if (HiiValue->Type == EFI_IFR_TYPE_STRING) {
           //
           // Create String in HII database for Configuration Driver to retrieve
           //
           HiiValue->Value.string = NewString ((CHAR16 *) Statement->BufferValue, Selection->FormSet->HiiHandle);
+        } else if (HiiValue->Type == EFI_IFR_TYPE_BUFFER) {
+          //
+          // For OrderedList, passing in the value buffer to Callback()
+          //
+          TypeValue = (EFI_IFR_TYPE_VALUE *) Statement->BufferValue;
         }
 
-        if (ConfigAccess == NULL) {
-          return EFI_UNSUPPORTED;
-        }
         Status = ConfigAccess->Callback (
                                  ConfigAccess,
                                  EFI_BROWSER_ACTION_CHANGING,
                                  Statement->QuestionId,
                                  HiiValue->Type,
-                                 &HiiValue->Value,
+                                 TypeValue,
                                  &ActionRequest
                                  );
 
diff --git a/MdeModulePkg/Universal/SetupBrowserDxe/Ui.c b/MdeModulePkg/Universal/SetupBrowserDxe/Ui.c
index db2bd27df3..5deb3019bc 100644
--- a/MdeModulePkg/Universal/SetupBrowserDxe/Ui.c
+++ b/MdeModulePkg/Universal/SetupBrowserDxe/Ui.c
@@ -2557,11 +2557,11 @@ UiDisplayMenu (
           Selection->QuestionId = Statement->RefQuestionId;
         } else if (Statement->RefFormId != 0) {
           //
-          // Check Ref From is suppressed.
+          // Check whether target From is suppressed.
           //
           RefForm = IdToForm (Selection->FormSet, Statement->RefFormId);
 
-          if (RefForm->SuppressExpression != NULL) {
+          if ((RefForm != NULL) && (RefForm->SuppressExpression != NULL)) {
             Status = EvaluateExpression (Selection->FormSet, RefForm, RefForm->SuppressExpression);
             if (EFI_ERROR (Status)) {
               return Status;