Zongheng and took over the army, thereafter executing Qin Yan and Bi. Sun soon defeated Yang Xingmi and took over Yang Prefecture, claiming the title of military governor of Huainan. (Yang subsequently took Ningguo Circuit (寧國, headquartered in modern Xuanzhou, Anhui and became its military governor.) In 889, Sun had Liu attack and capture Chang (常州, in modern Changzhou, Jiangsu) and Run (潤州, in modern Zhenjiang, Jiangsu) from Yang Xingmi's subordinate Tian Jun and Cheng Ji (), a subordinate of Qian Liu (who then controlled Hang Prefecture (杭州, in modern Hangzhou, Zhejiang), respectively. In 890, by which time Chang Prefecture had again been taken by Yang Xingmi and was defended by Yang Xingmi's subordinate Zhang Xingzhou (), Liu again captured it and killed Zhang, and then put Su Prefecture (蘇州, in modern Suzhou, Jiangsu), then under the control of Yang Xingmi's subordinate Li You (), under siege. Sun subsequently captured Su Prefecture himself and killed Li. In spring 891, Sun launched the initial phase of an ambitious plan to first destroy Yang Xingmi and then Zhu. He took all of the army available to him and headed for Xuanshe's capital Xuan Prefecture (). Liu was part of Sun's army. Sun's army was initially victorious, and by spring 892 had put Xuan Prefecture under siege. However, Sun was unable to capture Xuan, and soon got bogged down, with Yang sending raiders to cut off his food supplies. Further, his army was soon troubled by torrential floods and illnesses, and Sun himself was suffering from malaria. He was forced to send Liu and Ma out to raid the nearby regions for food. Meanwhile, Yang, hearing that Sun was suffering from malaria, attacked. He crushed Sun's army and killed Sun. Most of Sun's soldiers surrendered to Yang. Liu and Ma took 7,000 soldiers and headed south, toward Zhennan Circuit (鎮南, headquartered in modern Nanchang, Jiangsi); the soldiers supported Liu as their leader, with Ma as his forward commander and Zhang Ji as his strategist. The army's size eventually ballooned to over 100,000. Seizure of Wu'an Circuit Instead of attacking Zhennan Circuit, Liu Jianfeng's army continued to head southwest, toward Wu'an Circuit, which was then ruled by Deng Chuna. When Liu reached Liling (醴陵, in modern Zhuzhou, Hunan) in summer 894, Deng sent his subordinates Jiang Xun () and Deng Jichong () to defend Longhui Pass (龍回關, in modern Shaoyang, Hunan) against Liu's advance.