Index: /trunk/src/VBox/VMM/VMMAll/IEMAllInstCommon.cpp.h
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/IEMAllInstCommon.cpp.h	(revision 101957)
+++ /trunk/src/VBox/VMM/VMMAll/IEMAllInstCommon.cpp.h	(revision 101958)
@@ -939,38 +939,78 @@
     {
         case IEMMODE_16BIT:
-            IEM_MC_BEGIN(5, 1, 0, 0);
-            IEM_MC_ARG(uint16_t,        uSel,                                    0);
-            IEM_MC_ARG(uint16_t,        offSeg,                                  1);
-            IEM_MC_ARG_CONST(uint8_t,   iSegRegArg,/*=*/iSegReg,                 2);
-            IEM_MC_ARG_CONST(uint8_t,   iGRegArg,  /*=*/iGReg,                   3);
-            IEM_MC_ARG_CONST(IEMMODE,   enmEffOpSize,/*=*/pVCpu->iem.s.enmEffOpSize, 4);
-            IEM_MC_LOCAL(RTGCPTR,       GCPtrEff);
-            IEM_MC_CALC_RM_EFF_ADDR(GCPtrEff, bRm, 0);
-            IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX();
-            IEM_MC_FETCH_MEM_U16(offSeg, pVCpu->iem.s.iEffSeg, GCPtrEff);
-            IEM_MC_FETCH_MEM_U16_DISP(uSel, pVCpu->iem.s.iEffSeg, GCPtrEff, 2);
+            if (iSegReg >= X86_SREG_FS || !IEM_IS_32BIT_CODE(pVCpu)) /* IEM_CIMPL_F_XXX flag are combined for whole MC block, */
+            {                                                        /* thus the duplication. */
+                IEM_MC_BEGIN(5, 1, 0, 0);
+                IEM_MC_LOCAL(RTGCPTR,       GCPtrEff);
+                IEM_MC_CALC_RM_EFF_ADDR(GCPtrEff, bRm, 0);
+                IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX();
+                IEM_MC_ARG(uint16_t,        offSeg,                                  1);
+                IEM_MC_FETCH_MEM_U16(offSeg, pVCpu->iem.s.iEffSeg, GCPtrEff); /** @todo check memory access pattern */
+                IEM_MC_ARG(uint16_t,        uSel,                                    0);
+                IEM_MC_FETCH_MEM_U16_DISP(uSel, pVCpu->iem.s.iEffSeg, GCPtrEff, 2);
+                IEM_MC_ARG_CONST(uint8_t,   iSegRegArg,/*=*/iSegReg,                 2);
+                IEM_MC_ARG_CONST(uint8_t,   iGRegArg,  /*=*/iGReg,                   3);
+                IEM_MC_ARG_CONST(IEMMODE,   enmEffOpSize,/*=*/pVCpu->iem.s.enmEffOpSize, 4);
+                IEM_MC_HINT_FLUSH_GUEST_SHADOW_GREG(iGReg);
+                IEM_MC_HINT_FLUSH_GUEST_SHADOW_SREG(iSegReg);
+                IEM_MC_CALL_CIMPL_5(               0, iemCImpl_load_SReg_Greg, uSel, offSeg, iSegRegArg, iGRegArg, enmEffOpSize);
+                IEM_MC_END();
+            }
+            else
+            {
+                IEM_MC_BEGIN(5, 1, 0, 0);
+                IEM_MC_LOCAL(RTGCPTR,       GCPtrEff);
+                IEM_MC_CALC_RM_EFF_ADDR(GCPtrEff, bRm, 0);
+                IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX();
+                IEM_MC_ARG(uint16_t,        offSeg,                                  1);
+                IEM_MC_FETCH_MEM_U16(offSeg, pVCpu->iem.s.iEffSeg, GCPtrEff); /** @todo check memory access pattern */
+                IEM_MC_ARG(uint16_t,        uSel,                                    0);
+                IEM_MC_FETCH_MEM_U16_DISP(uSel, pVCpu->iem.s.iEffSeg, GCPtrEff, 2);
+                IEM_MC_ARG_CONST(uint8_t,   iSegRegArg,/*=*/iSegReg,                 2);
+                IEM_MC_ARG_CONST(uint8_t,   iGRegArg,  /*=*/iGReg,                   3);
+                IEM_MC_ARG_CONST(IEMMODE,   enmEffOpSize,/*=*/pVCpu->iem.s.enmEffOpSize, 4);
+                IEM_MC_HINT_FLUSH_GUEST_SHADOW_GREG(iGReg);
+                IEM_MC_HINT_FLUSH_GUEST_SHADOW_SREG(iSegReg);
+                IEM_MC_CALL_CIMPL_5(IEM_CIMPL_F_MODE, iemCImpl_load_SReg_Greg, uSel, offSeg, iSegRegArg, iGRegArg, enmEffOpSize);
+                IEM_MC_END();
+            }
+
+        case IEMMODE_32BIT:
             if (iSegReg >= X86_SREG_FS || !IEM_IS_32BIT_CODE(pVCpu))
+            {
+                IEM_MC_BEGIN(5, 1, IEM_MC_F_MIN_386, 0);
+                IEM_MC_LOCAL(RTGCPTR,       GCPtrEff);
+                IEM_MC_CALC_RM_EFF_ADDR(GCPtrEff, bRm, 0);
+                IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX();
+                IEM_MC_ARG(uint32_t,        offSeg,                                  1);    /** @todo check memory access pattern */
+                IEM_MC_FETCH_MEM_U32(offSeg, pVCpu->iem.s.iEffSeg, GCPtrEff);
+                IEM_MC_ARG(uint16_t,        uSel,                                    0);
+                IEM_MC_FETCH_MEM_U16_DISP(uSel, pVCpu->iem.s.iEffSeg, GCPtrEff, 4);
+                IEM_MC_ARG_CONST(uint8_t,   iSegRegArg,/*=*/iSegReg,                 2);
+                IEM_MC_ARG_CONST(uint8_t,   iGRegArg,  /*=*/iGReg,                   3);
+                IEM_MC_ARG_CONST(IEMMODE,   enmEffOpSize,/*=*/pVCpu->iem.s.enmEffOpSize, 4);
+                IEM_MC_HINT_FLUSH_GUEST_SHADOW_GREG(iGReg);
+                IEM_MC_HINT_FLUSH_GUEST_SHADOW_SREG(iSegReg);
                 IEM_MC_CALL_CIMPL_5(               0, iemCImpl_load_SReg_Greg, uSel, offSeg, iSegRegArg, iGRegArg, enmEffOpSize);
+                IEM_MC_END();
+            }
             else
+            {
+                IEM_MC_BEGIN(5, 1, IEM_MC_F_MIN_386, 0);
+                IEM_MC_LOCAL(RTGCPTR,       GCPtrEff);
+                IEM_MC_CALC_RM_EFF_ADDR(GCPtrEff, bRm, 0);
+                IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX();
+                IEM_MC_ARG(uint32_t,        offSeg,                                  1);    /** @todo check memory access pattern */
+                IEM_MC_FETCH_MEM_U32(offSeg, pVCpu->iem.s.iEffSeg, GCPtrEff);
+                IEM_MC_ARG(uint16_t,        uSel,                                    0);
+                IEM_MC_FETCH_MEM_U16_DISP(uSel, pVCpu->iem.s.iEffSeg, GCPtrEff, 4);
+                IEM_MC_ARG_CONST(uint8_t,   iSegRegArg,/*=*/iSegReg,                 2);
+                IEM_MC_ARG_CONST(uint8_t,   iGRegArg,  /*=*/iGReg,                   3);
+                IEM_MC_ARG_CONST(IEMMODE,   enmEffOpSize,/*=*/pVCpu->iem.s.enmEffOpSize, 4);
+                IEM_MC_HINT_FLUSH_GUEST_SHADOW_GREG(iGReg);
+                IEM_MC_HINT_FLUSH_GUEST_SHADOW_SREG(iSegReg);
                 IEM_MC_CALL_CIMPL_5(IEM_CIMPL_F_MODE, iemCImpl_load_SReg_Greg, uSel, offSeg, iSegRegArg, iGRegArg, enmEffOpSize);
-            IEM_MC_END();
-
-        case IEMMODE_32BIT:
-            IEM_MC_BEGIN(5, 1, IEM_MC_F_MIN_386, 0);
-            IEM_MC_ARG(uint16_t,        uSel,                                    0);
-            IEM_MC_ARG(uint32_t,        offSeg,                                  1);
-            IEM_MC_ARG_CONST(uint8_t,   iSegRegArg,/*=*/iSegReg,                 2);
-            IEM_MC_ARG_CONST(uint8_t,   iGRegArg,  /*=*/iGReg,                   3);
-            IEM_MC_ARG_CONST(IEMMODE,   enmEffOpSize,/*=*/pVCpu->iem.s.enmEffOpSize, 4);
-            IEM_MC_LOCAL(RTGCPTR,       GCPtrEff);
-            IEM_MC_CALC_RM_EFF_ADDR(GCPtrEff, bRm, 0);
-            IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX();
-            IEM_MC_FETCH_MEM_U32(offSeg, pVCpu->iem.s.iEffSeg, GCPtrEff);
-            IEM_MC_FETCH_MEM_U16_DISP(uSel, pVCpu->iem.s.iEffSeg, GCPtrEff, 4);
-            if (iSegReg >= X86_SREG_FS || !IEM_IS_32BIT_CODE(pVCpu))
-                IEM_MC_CALL_CIMPL_5(               0, iemCImpl_load_SReg_Greg, uSel, offSeg, iSegRegArg, iGRegArg, enmEffOpSize);
-            else
-                IEM_MC_CALL_CIMPL_5(IEM_CIMPL_F_MODE, iemCImpl_load_SReg_Greg, uSel, offSeg, iSegRegArg, iGRegArg, enmEffOpSize);
-            IEM_MC_END();
+                IEM_MC_END();
+            }
 
         case IEMMODE_64BIT:
@@ -978,7 +1018,4 @@
             IEM_MC_ARG(uint16_t,        uSel,                                    0);
             IEM_MC_ARG(uint64_t,        offSeg,                                  1);
-            IEM_MC_ARG_CONST(uint8_t,   iSegRegArg,/*=*/iSegReg,                 2);
-            IEM_MC_ARG_CONST(uint8_t,   iGRegArg,  /*=*/iGReg,                   3);
-            IEM_MC_ARG_CONST(IEMMODE,   enmEffOpSize,/*=*/pVCpu->iem.s.enmEffOpSize, 4);
             IEM_MC_LOCAL(RTGCPTR,       GCPtrEff);
             IEM_MC_CALC_RM_EFF_ADDR(GCPtrEff, bRm, 0);
@@ -989,4 +1026,9 @@
                 IEM_MC_FETCH_MEM_U64(offSeg, pVCpu->iem.s.iEffSeg, GCPtrEff);
             IEM_MC_FETCH_MEM_U16_DISP(uSel, pVCpu->iem.s.iEffSeg, GCPtrEff, 8);
+            IEM_MC_ARG_CONST(uint8_t,   iSegRegArg,/*=*/iSegReg,                 2);
+            IEM_MC_ARG_CONST(uint8_t,   iGRegArg,  /*=*/iGReg,                   3);
+            IEM_MC_ARG_CONST(IEMMODE,   enmEffOpSize,/*=*/pVCpu->iem.s.enmEffOpSize, 4);
+            IEM_MC_HINT_FLUSH_GUEST_SHADOW_GREG(iGReg);
+            IEM_MC_HINT_FLUSH_GUEST_SHADOW_SREG(iSegReg);
             IEM_MC_CALL_CIMPL_5(0, iemCImpl_load_SReg_Greg, uSel, offSeg, iSegRegArg, iGRegArg, enmEffOpSize);
             IEM_MC_END();
Index: /trunk/src/VBox/VMM/VMMAll/IEMAllInstOneByte.cpp.h
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/IEMAllInstOneByte.cpp.h	(revision 101957)
+++ /trunk/src/VBox/VMM/VMMAll/IEMAllInstOneByte.cpp.h	(revision 101958)
@@ -5798,4 +5798,5 @@
             IEM_MC_ARG(uint16_t,      u16Value,          1); \
             IEM_MC_FETCH_GREG_U16(u16Value, IEM_GET_MODRM_RM(pVCpu, bRm)); \
+            IEM_MC_HINT_FLUSH_GUEST_SHADOW_SREG(iSegReg); \
             IEM_MC_CALL_CIMPL_2(a_fCImplFlags, iemCImpl_load_SReg, iSRegArg, u16Value); \
             IEM_MC_END()
@@ -5836,4 +5837,5 @@
             IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX(); \
             IEM_MC_FETCH_MEM_U16(u16Value, pVCpu->iem.s.iEffSeg, GCPtrEffDst); \
+            IEM_MC_HINT_FLUSH_GUEST_SHADOW_SREG(iSegReg); \
             IEM_MC_CALL_CIMPL_2(a_fCImplFlags, iemCImpl_load_SReg, iSRegArg, u16Value); \
             IEM_MC_END()
@@ -5904,4 +5906,5 @@
             IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX();
             IEM_MC_ARG_CONST(uint8_t,   iEffSeg,    pVCpu->iem.s.iEffSeg,   0);
+            IEM_MC_HINT_FLUSH_GUEST_SHADOW_GREG(X86_GREG_xSP);
             IEM_MC_CALL_CIMPL_2(0, iemCImpl_pop_mem16, iEffSeg, GCPtrEffDst);
             IEM_MC_END();
@@ -5914,4 +5917,5 @@
             IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX();
             IEM_MC_ARG_CONST(uint8_t,   iEffSeg,    pVCpu->iem.s.iEffSeg,   0);
+            IEM_MC_HINT_FLUSH_GUEST_SHADOW_GREG(X86_GREG_xSP);
             IEM_MC_CALL_CIMPL_2(0, iemCImpl_pop_mem32, iEffSeg, GCPtrEffDst);
             IEM_MC_END();
@@ -5924,4 +5928,5 @@
             IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX();
             IEM_MC_ARG_CONST(uint8_t,   iEffSeg,    pVCpu->iem.s.iEffSeg,   0);
+            IEM_MC_HINT_FLUSH_GUEST_SHADOW_GREG(X86_GREG_xSP);
             IEM_MC_CALL_CIMPL_2(0, iemCImpl_pop_mem64, iEffSeg, GCPtrEffDst);
             IEM_MC_END();
@@ -13410,4 +13415,5 @@
             IEM_MC_FETCH_MEM_U16(offSeg, pVCpu->iem.s.iEffSeg, GCPtrEffSrc); \
             IEM_MC_FETCH_MEM_U16_DISP(u16Sel, pVCpu->iem.s.iEffSeg, GCPtrEffSrc, 2); \
+            IEM_MC_HINT_FLUSH_GUEST_SHADOW_GREG(X86_GREG_xSP); \
             IEM_MC_CALL_CIMPL_3(IEM_CIMPL_F_BRANCH_INDIRECT | IEM_CIMPL_F_BRANCH_FAR \
                                 | IEM_CIMPL_F_MODE | IEM_CIMPL_F_RFLAGS | IEM_CIMPL_F_VMEXIT, \
@@ -13426,4 +13432,5 @@
             IEM_MC_FETCH_MEM_U32(offSeg, pVCpu->iem.s.iEffSeg, GCPtrEffSrc); \
             IEM_MC_FETCH_MEM_U16_DISP(u16Sel, pVCpu->iem.s.iEffSeg, GCPtrEffSrc, 4); \
+            IEM_MC_HINT_FLUSH_GUEST_SHADOW_GREG(X86_GREG_xSP); \
             IEM_MC_CALL_CIMPL_3(IEM_CIMPL_F_BRANCH_INDIRECT | IEM_CIMPL_F_BRANCH_FAR \
                                 | IEM_CIMPL_F_MODE | IEM_CIMPL_F_RFLAGS | IEM_CIMPL_F_VMEXIT, \
@@ -13443,4 +13450,5 @@
             IEM_MC_FETCH_MEM_U64(offSeg, pVCpu->iem.s.iEffSeg, GCPtrEffSrc); \
             IEM_MC_FETCH_MEM_U16_DISP(u16Sel, pVCpu->iem.s.iEffSeg, GCPtrEffSrc, 8); \
+            IEM_MC_HINT_FLUSH_GUEST_SHADOW_GREG(X86_GREG_xSP); \
             IEM_MC_CALL_CIMPL_3(IEM_CIMPL_F_BRANCH_INDIRECT | IEM_CIMPL_F_BRANCH_FAR | IEM_CIMPL_F_MODE /* no gates */, \
                                 a_fnCImpl, u16Sel, offSeg, enmEffOpSize); \
Index: /trunk/src/VBox/VMM/VMMAll/IEMAllInstPython.py
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/IEMAllInstPython.py	(revision 101957)
+++ /trunk/src/VBox/VMM/VMMAll/IEMAllInstPython.py	(revision 101958)
@@ -2896,4 +2896,6 @@
     'IEM_MC_FPU_STACK_UNDERFLOW_THEN_POP_POP':                   (McBlock.parseMcGeneric,           True,  False, ),
     'IEM_MC_FPU_TO_MMX_MODE':                                    (McBlock.parseMcGeneric,           True,  False, ),
+    'IEM_MC_HINT_FLUSH_GUEST_SHADOW_GREG':                       (McBlock.parseMcGeneric,           True,  True,  ),
+    'IEM_MC_HINT_FLUSH_GUEST_SHADOW_SREG':                       (McBlock.parseMcGeneric,           True,  True,  ),
     'IEM_MC_IF_CX_IS_NZ':                                        (McBlock.parseMcGenericCond,       True,  True,  ),
     'IEM_MC_IF_CX_IS_NZ_AND_EFL_BIT_NOT_SET':                    (McBlock.parseMcGenericCond,       True,  True,  ),
Index: /trunk/src/VBox/VMM/VMMAll/IEMAllInstTwoByte0f.cpp.h
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/IEMAllInstTwoByte0f.cpp.h	(revision 101957)
+++ /trunk/src/VBox/VMM/VMMAll/IEMAllInstTwoByte0f.cpp.h	(revision 101958)
@@ -1861,6 +1861,7 @@
                 IEM_MC_ARG_CONST(bool,  fIsLarArg, fIsLar, 2);
 
+                IEM_MC_FETCH_GREG_U16(u16Sel, IEM_GET_MODRM_RM(pVCpu, bRm));
                 IEM_MC_REF_GREG_U16(pu16Dst, IEM_GET_MODRM_REG(pVCpu, bRm));
-                IEM_MC_FETCH_GREG_U16(u16Sel, IEM_GET_MODRM_RM(pVCpu, bRm));
+                IEM_MC_HINT_FLUSH_GUEST_SHADOW_GREG(IEM_GET_MODRM_REG(pVCpu, bRm));
                 IEM_MC_CALL_CIMPL_3(IEM_CIMPL_F_STATUS_FLAGS, iemCImpl_LarLsl_u16, pu16Dst, u16Sel, fIsLarArg);
 
@@ -1876,6 +1877,7 @@
                 IEM_MC_ARG_CONST(bool,  fIsLarArg, fIsLar, 2);
 
+                IEM_MC_FETCH_GREG_U16(u16Sel, IEM_GET_MODRM_RM(pVCpu, bRm));
                 IEM_MC_REF_GREG_U64(pu64Dst, IEM_GET_MODRM_REG(pVCpu, bRm));
-                IEM_MC_FETCH_GREG_U16(u16Sel, IEM_GET_MODRM_RM(pVCpu, bRm));
+                IEM_MC_HINT_FLUSH_GUEST_SHADOW_GREG(IEM_GET_MODRM_REG(pVCpu, bRm));
                 IEM_MC_CALL_CIMPL_3(IEM_CIMPL_F_STATUS_FLAGS, iemCImpl_LarLsl_u64, pu64Dst, u16Sel, fIsLarArg);
 
@@ -1902,4 +1904,5 @@
                 IEM_MC_FETCH_MEM_U16(u16Sel, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
                 IEM_MC_REF_GREG_U16(pu16Dst, IEM_GET_MODRM_REG(pVCpu, bRm));
+                IEM_MC_HINT_FLUSH_GUEST_SHADOW_GREG(IEM_GET_MODRM_REG(pVCpu, bRm));
                 IEM_MC_CALL_CIMPL_3(IEM_CIMPL_F_STATUS_FLAGS, iemCImpl_LarLsl_u16, pu16Dst, u16Sel, fIsLarArg);
 
@@ -1921,4 +1924,5 @@
                 IEM_MC_FETCH_MEM_U16(u16Sel, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
                 IEM_MC_REF_GREG_U64(pu64Dst, IEM_GET_MODRM_REG(pVCpu, bRm));
+                IEM_MC_HINT_FLUSH_GUEST_SHADOW_GREG(IEM_GET_MODRM_REG(pVCpu, bRm));
                 IEM_MC_CALL_CIMPL_3(IEM_CIMPL_F_STATUS_FLAGS, iemCImpl_LarLsl_u64, pu64Dst, u16Sel, fIsLarArg);
 
@@ -7104,4 +7108,5 @@
             IEM_MC_FETCH_GREG_U64(u64Enc, IEM_GET_MODRM_REG(pVCpu, bRm));
             IEM_MC_REF_GREG_U64(pu64Dst, IEM_GET_MODRM_RM(pVCpu, bRm));
+            IEM_MC_HINT_FLUSH_GUEST_SHADOW_GREG(IEM_GET_MODRM_RM(pVCpu, bRm));
             IEM_MC_CALL_CIMPL_2(IEM_CIMPL_F_VMEXIT | IEM_CIMPL_F_STATUS_FLAGS, iemCImpl_vmread_reg64, pu64Dst, u64Enc);
             IEM_MC_END();
@@ -7115,4 +7120,5 @@
             IEM_MC_FETCH_GREG_U32(u32Enc, IEM_GET_MODRM_REG(pVCpu, bRm));
             IEM_MC_REF_GREG_U64(pu64Dst, IEM_GET_MODRM_RM(pVCpu, bRm));
+            IEM_MC_HINT_FLUSH_GUEST_SHADOW_GREG(IEM_GET_MODRM_RM(pVCpu, bRm));
             IEM_MC_CALL_CIMPL_2(IEM_CIMPL_F_VMEXIT | IEM_CIMPL_F_STATUS_FLAGS, iemCImpl_vmread_reg32, pu64Dst, u32Enc);
             IEM_MC_END();
@@ -12450,5 +12456,7 @@
             IEM_MC_REF_LOCAL(pu128RbxRcx, u128RbxRcx); \
             \
-            IEM_MC_FETCH_EFLAGS(EFlags)
+            IEM_MC_FETCH_EFLAGS(EFlags); \
+            IEM_MC_HINT_FLUSH_GUEST_SHADOW_GREG(X86_GREG_xAX); \
+            IEM_MC_HINT_FLUSH_GUEST_SHADOW_GREG(X86_GREG_xDX)
 
 #define BODY_CMPXCHG16B_TAIL \
@@ -12556,6 +12564,7 @@
         IEM_MC_BEGIN(2, 0, IEM_MC_F_NOT_286_OR_OLDER, 0);
         IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX();
-        IEM_MC_ARG_CONST(uint8_t, iReg,        /*=*/IEM_GET_MODRM_RM(pVCpu, bRm), 0);
-        IEM_MC_ARG_CONST(IEMMODE, enmEffOpSize,/*=*/pVCpu->iem.s.enmEffOpSize,    1);
+        IEM_MC_ARG_CONST(uint8_t, iReg,        /*=*/ IEM_GET_MODRM_RM(pVCpu, bRm), 0);
+        IEM_MC_ARG_CONST(IEMMODE, enmEffOpSize,/*=*/ pVCpu->iem.s.enmEffOpSize,    1);
+        IEM_MC_HINT_FLUSH_GUEST_SHADOW_GREG(IEM_GET_MODRM_RM(pVCpu, bRm));
         IEM_MC_CALL_CIMPL_2(IEM_CIMPL_F_RFLAGS | IEM_CIMPL_F_VMEXIT, iemCImpl_rdrand, iReg, enmEffOpSize);
         IEM_MC_END();
@@ -12652,6 +12661,7 @@
         IEM_MC_BEGIN(2, 0, IEM_MC_F_NOT_286_OR_OLDER, 0);
         IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX();
-        IEM_MC_ARG_CONST(uint8_t, iReg,        /*=*/IEM_GET_MODRM_RM(pVCpu, bRm), 0);
-        IEM_MC_ARG_CONST(IEMMODE, enmEffOpSize,/*=*/pVCpu->iem.s.enmEffOpSize,    1);
+        IEM_MC_ARG_CONST(uint8_t, iReg,        /*=*/ IEM_GET_MODRM_RM(pVCpu, bRm), 0);
+        IEM_MC_ARG_CONST(IEMMODE, enmEffOpSize,/*=*/ pVCpu->iem.s.enmEffOpSize,    1);
+        IEM_MC_HINT_FLUSH_GUEST_SHADOW_GREG(IEM_GET_MODRM_RM(pVCpu, bRm));
         IEM_MC_CALL_CIMPL_2(IEM_CIMPL_F_RFLAGS | IEM_CIMPL_F_VMEXIT, iemCImpl_rdseed, iReg, enmEffOpSize);
         IEM_MC_END();
Index: /trunk/src/VBox/VMM/VMMAll/IEMAllN8veRecompiler.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/IEMAllN8veRecompiler.cpp	(revision 101957)
+++ /trunk/src/VBox/VMM/VMMAll/IEMAllN8veRecompiler.cpp	(revision 101958)
@@ -3067,5 +3067,5 @@
                 uint64_t const fInThisHstReg = (pReNative->Core.aHstRegs[idxHstReg].fGstRegShadows & fGstRegs) | RT_BIT_64(idxGstReg);
                 fGstRegs &= ~fInThisHstReg;
-                pReNative->Core.aHstRegs[idxHstReg].fGstRegShadows &= fInThisHstReg;
+                pReNative->Core.aHstRegs[idxHstReg].fGstRegShadows &= ~fInThisHstReg;
                 if (!pReNative->Core.aHstRegs[idxHstReg].fGstRegShadows)
                     pReNative->Core.bmHstRegsWithGstShadow &= ~RT_BIT_32(idxHstReg);
@@ -5525,4 +5525,9 @@
     /*
      * Make the call and check the return code.
+     *
+     * Shadow PC copies are always flushed here, other stuff depends on flags.
+     * Segment and general purpose registers are explictily flushed via the
+     * IEM_MC_HINT_FLUSH_GUEST_SHADOW_GREG and IEM_MC_HINT_FLUSH_GUEST_SHADOW_SREG
+     * macros.
      */
     off = iemNativeEmitCallImm(pReNative, off, (uintptr_t)pfnCImpl);
@@ -5530,4 +5535,13 @@
     off = iemNativeEmitLoadGprByBpU32(pReNative, off, X86_GREG_xAX, IEMNATIVE_FP_OFF_IN_SHADOW_ARG0); /* rcStrict (see above) */
 #endif
+/** @todo Always flush EFLAGS if this is an xxF variation. */
+    iemNativeRegFlushGuestShadows(pReNative,
+                                    RT_BIT_64(kIemNativeGstReg_Pc)
+                                  | (pReNative->fCImpl & (  IEM_CIMPL_F_RFLAGS
+                                                          | IEM_CIMPL_F_STATUS_FLAGS
+                                                          | IEM_CIMPL_F_INHIBIT_SHADOW)
+                                     ? RT_BIT_64(kIemNativeGstReg_EFlags) : 0)
+                                  );
+
     return iemNativeEmitCheckCallRetAndPassUp(pReNative, off, idxInstr);
 }
@@ -5655,4 +5669,16 @@
     return iemNativeEmitCallCImplCommon(pReNative, off, cbInstr, idxInstr, pfnCImpl, 5);
 }
+
+
+/** Flush guest GPR shadow copy. */
+#define IEM_MC_HINT_FLUSH_GUEST_SHADOW_GREG(a_iGReg) \
+    iemNativeRegFlushGuestShadows(pReNative, RT_BIT_64(kIemNativeGstReg_GprFirst + (a_iGReg)) )
+
+/** Flush guest segment register (hidden and non-hidden bits) shadow copy. */
+#define IEM_MC_HINT_FLUSH_GUEST_SHADOW_SREG(a_iSReg) \
+    iemNativeRegFlushGuestShadows(pReNative, \
+                                    RT_BIT_64(kIemNativeGstReg_SegSelFirst   + (a_iSReg)) \
+                                  | RT_BIT_64(kIemNativeGstReg_SegBaseFirst  + (a_iSReg)) \
+                                  | RT_BIT_64(kIemNativeGstReg_SegLimitFirst + (a_iSReg)) )
 
 
Index: /trunk/src/VBox/VMM/include/IEMMc.h
===================================================================
--- /trunk/src/VBox/VMM/include/IEMMc.h	(revision 101957)
+++ /trunk/src/VBox/VMM/include/IEMMc.h	(revision 101958)
@@ -2494,4 +2494,10 @@
 #define IEM_MC_ENDIF()                                  } do {} while (0)
 
+
+/** Native recompiler GREG shadow copy flush hint related to CIMPL calls. */
+#define IEM_MC_HINT_FLUSH_GUEST_SHADOW_GREG(a_iGReg)    ((void)0)
+/** Native recompiler SREG shadow copy flush hint related to CIMPL calls. */
+#define IEM_MC_HINT_FLUSH_GUEST_SHADOW_SREG(a_iSReg)    ((void)0)
+
 /** @}  */
 
Index: /trunk/src/VBox/VMM/testcase/tstIEMCheckMc.cpp
===================================================================
--- /trunk/src/VBox/VMM/testcase/tstIEMCheckMc.cpp	(revision 101957)
+++ /trunk/src/VBox/VMM/testcase/tstIEMCheckMc.cpp	(revision 101958)
@@ -1043,4 +1043,7 @@
 #define IEM_MC_ENDIF()                                                  } do { (void)fMcBegin; } while (0)
 
+#define IEM_MC_HINT_FLUSH_GUEST_SHADOW_GREG(a_iGReg)                    ((void)fMcBegin)
+#define IEM_MC_HINT_FLUSH_GUEST_SHADOW_SREG(a_iSReg)                    ((void)fMcBegin)
+
 /** @}  */
 
