diff -up ./nss/cmd/modutil/pk11.c.1056036 ./nss/cmd/modutil/pk11.c
--- ./nss/cmd/modutil/pk11.c.1056036	2014-02-24 15:49:00.802754246 -0800
+++ ./nss/cmd/modutil/pk11.c	2014-02-24 15:49:00.806754285 -0800
@@ -826,6 +826,12 @@ EnableModule(char *moduleName, char *slo
 		    PK11_GetSlotName(slot), "enabled");
 	    }
 	} else {
+	    if (module->internal) {
+		PR_fprintf(PR_STDERR, errStrings[ENABLE_FAILED_ERR],
+		    "disable", PK11_GetSlotName(slot));
+		rv = ENABLE_FAILED_ERR;
+		goto loser;
+	    }
 	    if(! PK11_UserDisableSlot(slot)) {
 		PR_fprintf(PR_STDERR, errStrings[ENABLE_FAILED_ERR],
 		    "disable", PK11_GetSlotName(slot));
diff -up ./nss/doc/modutil.xml.1056036 ./nss/doc/modutil.xml
--- ./nss/doc/modutil.xml.1056036	2014-01-03 11:59:10.000000000 -0800
+++ ./nss/doc/modutil.xml	2014-02-24 15:49:00.806754285 -0800
@@ -86,7 +86,7 @@
 
       <varlistentry>
         <term>-disable modulename</term>
-	  <listitem><para>Disable all slots on the named module. Use the <option>-slot</option> argument to disable a specific slot.</para></listitem>
+	  <listitem><para>Disable all slots on the named module. Use the <option>-slot</option> argument to disable a specific slot.</para><para>The internal NSS PKCS #11 module cannot be disabled.</para></listitem>
       </varlistentry>
 
       <varlistentry>
diff -up ./nss/lib/dev/devtoken.c.1056036 ./nss/lib/dev/devtoken.c
--- ./nss/lib/dev/devtoken.c.1056036	2014-02-24 15:55:16.687529925 -0800
+++ ./nss/lib/dev/devtoken.c	2014-02-24 15:56:15.720143547 -0800
@@ -1438,6 +1438,7 @@ nssToken_IsPresent (
   NSSToken *token
 )
 {
+    if (token == NULL) return PR_FALSE;
     return nssSlot_IsTokenPresent(token->slot);
 }