Index: trunk/src/VBox/VMM/VMMAll/IEMAllN8veRecompiler.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMAll/IEMAllN8veRecompiler.cpp	(revision 102557)
+++ trunk/src/VBox/VMM/VMMAll/IEMAllN8veRecompiler.cpp	(revision 102558)
@@ -2980,10 +2980,10 @@
             uint32_t const idxVar = ASMBitFirstSetU32(fVars) - 1;
             uint8_t const  idxReg = pReNative->Core.aVars[idxVar].idxReg;
-/** @todo Prevent active variables from changing here... */
             if (   idxReg < RT_ELEMENTS(pReNative->Core.aHstRegs)
                 && (RT_BIT_32(idxReg) & fRegMask)
                 && (  iLoop == 0
                     ? pReNative->Core.aVars[idxVar].enmKind != kIemNativeVarKind_Stack
-                    : pReNative->Core.aVars[idxVar].enmKind == kIemNativeVarKind_Stack))
+                    : pReNative->Core.aVars[idxVar].enmKind == kIemNativeVarKind_Stack)
+                && !pReNative->Core.aVars[idxVar].fRegAcquired)
             {
                 Assert(pReNative->Core.bmHstRegs & RT_BIT_32(idxReg));
@@ -3080,6 +3080,7 @@
                                                 uint32_t fForbiddenRegs = IEMNATIVE_CALL_VOLATILE_GREG_MASK)
 {
-    Assert(idxVar < RT_ELEMENTS(pReNative->Core.aVars));
+    IEMNATIVE_ASSERT_VAR_IDX(pReNative, idxVar);
     Assert(pReNative->Core.aVars[idxVar].enmKind == kIemNativeVarKind_Stack);
+    Assert(!pReNative->Core.aVars[idxVar].fRegAcquired);
 
     uint8_t const idxRegOld = pReNative->Core.aVars[idxVar].idxReg;
@@ -5971,4 +5972,5 @@
     pReNative->Core.aVars[idxVar].idxReferrerVar = UINT8_MAX;
     pReNative->Core.aVars[idxVar].enmGstReg      = kIemNativeGstReg_End;
+    pReNative->Core.aVars[idxVar].fRegAcquired   = false;
     pReNative->Core.aVars[idxVar].u.uValue       = 0;
     return idxVar;
@@ -6260,5 +6262,21 @@
 
 /**
- * Makes sure variable @a idxVar has a register assigned to it.
+ * Releases the variable's register.
+ *
+ * The register must have been previously acquired calling
+ * iemNativeVarRegisterAcquire(), iemNativeVarRegisterAcquireForGuestReg() or
+ * iemNativeVarRegisterSetAndAcquire().
+ */
+DECL_INLINE_THROW(void) iemNativeVarRegisterRelease(PIEMRECOMPILERSTATE pReNative, uint8_t idxVar)
+{
+    IEMNATIVE_ASSERT_VAR_IDX(pReNative, idxVar);
+    Assert(pReNative->Core.aVars[idxVar].fRegAcquired);
+    pReNative->Core.aVars[idxVar].fRegAcquired = false;
+}
+
+
+/**
+ * Makes sure variable @a idxVar has a register assigned to it and that it stays
+ * fixed till we call iemNativeVarRegisterRelease.
  *
  * @returns The host register number.
@@ -6272,12 +6290,10 @@
  *                      the case.
  */
-DECL_HIDDEN_THROW(uint8_t) iemNativeVarAllocRegister(PIEMRECOMPILERSTATE pReNative, uint8_t idxVar,
-                                                     uint32_t *poff, bool fInitialized = false)
+DECL_HIDDEN_THROW(uint8_t) iemNativeVarRegisterAcquire(PIEMRECOMPILERSTATE pReNative, uint8_t idxVar,
+                                                       uint32_t *poff, bool fInitialized = false)
 {
     IEMNATIVE_ASSERT_VAR_IDX(pReNative, idxVar);
     Assert(pReNative->Core.aVars[idxVar].cbVar <= 8);
-/** @todo we must mark the variable as active and add a release function to
- *        mark it as inactive, otherwise temporary register allocations may
- *        cause the variable to be spilled onto the stack. */
+    Assert(!pReNative->Core.aVars[idxVar].fRegAcquired);
 
     uint8_t idxReg = pReNative->Core.aVars[idxVar].idxReg;
@@ -6286,4 +6302,5 @@
         Assert(   pReNative->Core.aVars[idxVar].enmKind > kIemNativeVarKind_Invalid
                && pReNative->Core.aVars[idxVar].enmKind < kIemNativeVarKind_End);
+        pReNative->Core.aVars[idxVar].fRegAcquired = true;
         return idxReg;
     }
@@ -6321,5 +6338,5 @@
         idxReg = g_aidxIemNativeCallRegs[uArgNo];
         iemNativeRegClearGstRegShadowing(pReNative, idxReg, *poff);
-        Log11(("iemNativeVarAllocRegister: idxVar=%u idxReg=%u (matching arg %u)\n", idxVar, idxReg, uArgNo));
+        Log11(("iemNativeVarRegisterAcquire: idxVar=%u idxReg=%u (matching arg %u)\n", idxVar, idxReg, uArgNo));
     }
     else
@@ -6337,5 +6354,5 @@
             Assert(pReNative->Core.aHstRegs[idxReg].fGstRegShadows == 0);
             Assert(!(pReNative->Core.bmHstRegsWithGstShadow & RT_BIT_32(idxReg)));
-            Log11(("iemNativeVarAllocRegister: idxVar=%u idxReg=%u (uArgNo=%u)\n", idxVar, idxReg, uArgNo));
+            Log11(("iemNativeVarRegisterAcquire: idxVar=%u idxReg=%u (uArgNo=%u)\n", idxVar, idxReg, uArgNo));
         }
         else
@@ -6344,5 +6361,5 @@
                                                IEMNATIVE_HST_GREG_MASK & ~IEMNATIVE_REG_FIXED_MASK & fNotArgsMask);
             AssertStmt(idxReg != UINT8_MAX, IEMNATIVE_DO_LONGJMP(pReNative, VERR_IEM_REG_ALLOCATOR_NO_FREE_VAR));
-            Log11(("iemNativeVarAllocRegister: idxVar=%u idxReg=%u (slow, uArgNo=%u)\n", idxVar, idxReg, uArgNo));
+            Log11(("iemNativeVarRegisterAcquire: idxVar=%u idxReg=%u (slow, uArgNo=%u)\n", idxVar, idxReg, uArgNo));
         }
     }
@@ -6372,4 +6389,5 @@
         AssertStmt(!fInitialized, IEMNATIVE_DO_LONGJMP(pReNative, VERR_IEM_VAR_NOT_INITIALIZED));
     }
+    pReNative->Core.aVars[idxVar].fRegAcquired = true;
     return idxReg;
 }
@@ -6397,7 +6415,8 @@
  */
 DECL_HIDDEN_THROW(uint8_t)
-iemNativeVarAllocRegisterForGuestReg(PIEMRECOMPILERSTATE pReNative, uint8_t idxVar, IEMNATIVEGSTREG enmGstReg, uint32_t *poff)
+iemNativeVarRegisterAcquireForGuestReg(PIEMRECOMPILERSTATE pReNative, uint8_t idxVar, IEMNATIVEGSTREG enmGstReg, uint32_t *poff)
 {
     IEMNATIVE_ASSERT_VAR_IDX(pReNative, idxVar);
+    Assert(!pReNative->Core.aVars[idxVar].fRegAcquired);
     AssertMsgStmt(   pReNative->Core.aVars[idxVar].cbVar <= 8
                   && (   pReNative->Core.aVars[idxVar].enmKind == kIemNativeVarKind_Immediate
@@ -6415,5 +6434,5 @@
      * ensure we get a register suitable for the intended argument number.
      */
-    AssertStmt(pReNative->Core.aVars[idxVar].uArgNo == UINT8_MAX, iemNativeVarAllocRegister(pReNative, idxVar, poff));
+    AssertStmt(pReNative->Core.aVars[idxVar].uArgNo == UINT8_MAX, iemNativeVarRegisterAcquire(pReNative, idxVar, poff));
 
     /*
@@ -6428,5 +6447,5 @@
             uint8_t const idxRegOld = pReNative->Core.aidxGstRegShadows[enmGstReg];
             iemNativeRegTransferGstRegShadowing(pReNative, idxRegOld, idxReg, enmGstReg, *poff);
-            Log12(("iemNativeVarAllocRegisterForGuestReg: Moved %s for guest %s into %s for full write\n",
+            Log12(("iemNativeVarRegisterAcquireForGuestReg: Moved %s for guest %s into %s for full write\n",
                    g_apszIemNativeHstRegNames[idxRegOld], g_aGstShadowInfo[enmGstReg].pszName, g_apszIemNativeHstRegNames[idxReg]));
         }
@@ -6434,10 +6453,11 @@
         {
             iemNativeRegMarkAsGstRegShadow(pReNative, idxReg, enmGstReg, *poff);
-            Log12(("iemNativeVarAllocRegisterForGuestReg: Marking %s as copy of guest %s (full write)\n",
+            Log12(("iemNativeVarRegisterAcquireForGuestReg: Marking %s as copy of guest %s (full write)\n",
                    g_apszIemNativeHstRegNames[idxReg], g_aGstShadowInfo[enmGstReg].pszName));
         }
         /** @todo figure this one out. We need some way of making sure the register isn't
          * modified after this point, just in case we start writing crappy MC code. */
-        pReNative->Core.aVars[idxVar].enmGstReg = enmGstReg;
+        pReNative->Core.aVars[idxVar].enmGstReg    = enmGstReg;
+        pReNative->Core.aVars[idxVar].fRegAcquired = true;
         return idxReg;
     }
@@ -6483,4 +6503,5 @@
     }
 
+    pReNative->Core.aVars[idxVar].fRegAcquired = true;
     return idxReg;
 }
@@ -6505,7 +6526,8 @@
  * @throws  VERR_IEM_VAR_IPE_10, VERR_IEM_VAR_IPE_11
  */
-DECL_INLINE_THROW(uint8_t) iemNativeVarSetRegister(PIEMRECOMPILERSTATE pReNative, uint8_t idxVar, uint8_t idxReg, uint32_t off)
+DECL_INLINE_THROW(uint8_t) iemNativeVarRegisterSet(PIEMRECOMPILERSTATE pReNative, uint8_t idxVar, uint8_t idxReg, uint32_t off)
 {
     IEMNATIVE_ASSERT_VAR_IDX(pReNative, idxVar);
+    Assert(!pReNative->Core.aVars[idxVar].fRegAcquired);
     Assert(idxReg < RT_ELEMENTS(pReNative->Core.aHstRegs));
     AssertStmt(pReNative->Core.aVars[idxVar].idxReg == UINT8_MAX, IEMNATIVE_DO_LONGJMP(pReNative, VERR_IEM_VAR_IPE_10));
@@ -6518,4 +6540,16 @@
     pReNative->Core.aVars[idxVar].idxReg = idxReg;
 
+    return idxReg;
+}
+
+
+/**
+ * A convenient helper function.
+ */
+DECL_INLINE_THROW(uint8_t) iemNativeVarRegisterSetAndAcquire(PIEMRECOMPILERSTATE pReNative, uint8_t idxVar,
+                                                             uint8_t idxReg, uint32_t *poff)
+{
+    idxReg = iemNativeVarRegisterSet(pReNative, idxVar, idxReg, *poff);
+    pReNative->Core.aVars[idxVar].fRegAcquired = true;
     return idxReg;
 }
@@ -6694,6 +6728,6 @@
          *        variable passed to IEM_MC_ASSIGN_TO_SMALLER is not used after the
          *        statement.   Then we could just transfer the register assignments. */
-        uint8_t const idxRegDst = iemNativeVarAllocRegister(pReNative, idxVarDst, &off);
-        uint8_t const idxRegSrc = iemNativeVarAllocRegister(pReNative, idxVarSrc, &off);
+        uint8_t const idxRegDst = iemNativeVarRegisterAcquire(pReNative, idxVarDst, &off);
+        uint8_t const idxRegSrc = iemNativeVarRegisterAcquire(pReNative, idxVarSrc, &off);
         switch (pReNative->Core.aVars[idxVarDst].cbVar)
         {
@@ -6706,4 +6740,6 @@
             default: AssertFailed(); break;
         }
+        iemNativeVarRegisterRelease(pReNative, idxVarSrc);
+        iemNativeVarRegisterRelease(pReNative, idxVarDst);
     }
     return off;
@@ -7293,5 +7329,5 @@
     {
 pReNative->pInstrBuf[off++] = 0xcc; /** @todo test IEM_MC_CALL_AIMPL_3 and IEM_MC_CALL_AIMPL_4 return codes. */
-        iemNativeVarSetRegister(pReNative, idxVarRc, IEMNATIVE_CALL_RET_GREG, off);
+        iemNativeVarRegisterSet(pReNative, idxVarRc, IEMNATIVE_CALL_RET_GREG, off);
     }
 
@@ -7416,5 +7452,5 @@
 
     iemNativeVarSetKindToStack(pReNative, idxDstVar);
-    uint8_t const idxVarReg = iemNativeVarAllocRegister(pReNative, idxDstVar, &off);
+    uint8_t const idxVarReg = iemNativeVarRegisterAcquire(pReNative, idxDstVar, &off);
 
     /* The value is zero-extended to the full 64-bit host register width. */
@@ -7424,4 +7460,5 @@
         off = iemNativeEmitLoadGprFromGpr8Hi(pReNative, off, idxVarReg, idxGstFullReg);
 
+    iemNativeVarRegisterRelease(pReNative, idxDstVar);
     iemNativeRegFreeTmp(pReNative, idxGstFullReg);
     return off;
@@ -7451,5 +7488,5 @@
 
     iemNativeVarSetKindToStack(pReNative, idxDstVar);
-    uint8_t const idxVarReg = iemNativeVarAllocRegister(pReNative, idxDstVar, &off);
+    uint8_t const idxVarReg = iemNativeVarRegisterAcquire(pReNative, idxDstVar, &off);
 
     if (iGRegEx < 16)
@@ -7487,4 +7524,5 @@
     }
 
+    iemNativeVarRegisterRelease(pReNative, idxDstVar);
     iemNativeRegFreeTmp(pReNative, idxGstFullReg);
     return off;
@@ -7521,6 +7559,7 @@
 
     iemNativeVarSetKindToStack(pReNative, idxDstVar);
-    uint8_t const idxVarReg = iemNativeVarAllocRegister(pReNative, idxDstVar, &off);
+    uint8_t const idxVarReg = iemNativeVarRegisterAcquire(pReNative, idxDstVar, &off);
     off = iemNativeEmitLoadGprFromGpr16(pReNative, off, idxVarReg, idxGstFullReg);
+    iemNativeVarRegisterRelease(pReNative, idxDstVar);
 
     iemNativeRegFreeTmp(pReNative, idxGstFullReg);
@@ -7554,5 +7593,5 @@
 
     iemNativeVarSetKindToStack(pReNative, idxDstVar);
-    uint8_t const idxVarReg = iemNativeVarAllocRegister(pReNative, idxDstVar, &off);
+    uint8_t const idxVarReg = iemNativeVarRegisterAcquire(pReNative, idxDstVar, &off);
     if (cbSignExtended == sizeof(uint32_t))
         off = iemNativeEmitLoadGpr32SignExtendedFromGpr16(pReNative, off, idxVarReg, idxGstFullReg);
@@ -7562,4 +7601,5 @@
         off = iemNativeEmitLoadGprSignExtendedFromGpr16(pReNative, off, idxVarReg, idxGstFullReg);
     }
+    iemNativeVarRegisterRelease(pReNative, idxDstVar);
 
     iemNativeRegFreeTmp(pReNative, idxGstFullReg);
@@ -7593,6 +7633,7 @@
 
     iemNativeVarSetKindToStack(pReNative, idxDstVar);
-    uint8_t const idxVarReg = iemNativeVarAllocRegister(pReNative, idxDstVar, &off);
+    uint8_t const idxVarReg = iemNativeVarRegisterAcquire(pReNative, idxDstVar, &off);
     off = iemNativeEmitLoadGprFromGpr32(pReNative, off, idxVarReg, idxGstFullReg);
+    iemNativeVarRegisterRelease(pReNative, idxDstVar);
 
     iemNativeRegFreeTmp(pReNative, idxGstFullReg);
@@ -7623,6 +7664,7 @@
 
     iemNativeVarSetKindToStack(pReNative, idxDstVar);
-    uint8_t const idxVarReg = iemNativeVarAllocRegister(pReNative, idxDstVar, &off);
+    uint8_t const idxVarReg = iemNativeVarRegisterAcquire(pReNative, idxDstVar, &off);
     off = iemNativeEmitLoadGprSignExtendedFromGpr32(pReNative, off, idxVarReg, idxGstFullReg);
+    iemNativeVarRegisterRelease(pReNative, idxDstVar);
 
     iemNativeRegFreeTmp(pReNative, idxGstFullReg);
@@ -7650,7 +7692,8 @@
 
     iemNativeVarSetKindToStack(pReNative, idxDstVar);
-    uint8_t const idxVarReg = iemNativeVarAllocRegister(pReNative, idxDstVar, &off);
+    uint8_t const idxVarReg = iemNativeVarRegisterAcquire(pReNative, idxDstVar, &off);
     off = iemNativeEmitLoadGprFromGpr(pReNative, off, idxVarReg, idxGstFullReg);
     /** @todo name the register a shadow one already? */
+    iemNativeVarRegisterRelease(pReNative, idxDstVar);
 
     iemNativeRegFreeTmp(pReNative, idxGstFullReg);
@@ -7765,5 +7808,5 @@
     uint8_t const idxGstTmpReg = iemNativeRegAllocTmpForGuestReg(pReNative, &off, IEMNATIVEGSTREG_GPR(iGRegEx & 15),
                                                                  kIemNativeGstRegUse_ForUpdate);
-    uint8_t const    idxVarReg = iemNativeVarAllocRegister(pReNative, idxValueVar, &off, true /*fInitialized*/);
+    uint8_t const    idxVarReg = iemNativeVarRegisterAcquire(pReNative, idxValueVar, &off, true /*fInitialized*/);
 
 #ifdef RT_ARCH_AMD64
@@ -7825,6 +7868,7 @@
 # error "Port me!"
 #endif
-
     IEMNATIVE_ASSERT_INSTR_BUF_ENSURE(pReNative, off);
+
+    iemNativeVarRegisterRelease(pReNative, idxValueVar);
 
     off = iemNativeEmitStoreGprToVCpuU64(pReNative, off, idxGstTmpReg, RT_UOFFSETOF_DYN(VMCPU, cpum.GstCtx.aGRegs[iGRegEx & 15]));
@@ -7922,7 +7966,8 @@
 #elif defined(RT_ARCH_ARM64)
     /* bfi w1, w2, 0, 16 - moves bits 15:0 from idxVarReg to idxGstTmpReg bits 15:0. */
-    uint8_t const    idxVarReg   = iemNativeVarAllocRegister(pReNative, idxValueVar, &off, true /*fInitialized*/);
+    uint8_t const    idxVarReg   = iemNativeVarRegisterAcquire(pReNative, idxValueVar, &off, true /*fInitialized*/);
     uint32_t * const pu32CodeBuf = iemNativeInstrBufEnsure(pReNative, off, 1);
     pu32CodeBuf[off++] = Armv8A64MkInstrBfi(idxGstTmpReg, idxVarReg, 0, 16);
+    iemNativeVarRegisterRelease(pReNative, idxValueVar);
 
 #else
@@ -7982,9 +8027,10 @@
      * it to the CPUMCTX structure.
      */
-    uint8_t const idxVarReg = iemNativeVarAllocRegisterForGuestReg(pReNative, idxValueVar, IEMNATIVEGSTREG_GPR(iGReg), &off);
+    uint8_t const idxVarReg = iemNativeVarRegisterAcquireForGuestReg(pReNative, idxValueVar, IEMNATIVEGSTREG_GPR(iGReg), &off);
     off = iemNativeEmitStoreGprToVCpuU64(pReNative, off, idxVarReg, RT_UOFFSETOF_DYN(VMCPU, cpum.GstCtx.aGRegs[iGReg]));
 #ifdef VBOX_STRICT
     off = iemNativeEmitTop32BitsClearCheck(pReNative, off, idxVarReg);
 #endif
+    iemNativeVarRegisterRelease(pReNative, idxValueVar);
     return off;
 }
@@ -8035,6 +8081,7 @@
      * it to the CPUMCTX structure.
      */
-    uint8_t const idxVarReg = iemNativeVarAllocRegisterForGuestReg(pReNative, idxValueVar, IEMNATIVEGSTREG_GPR(iGReg), &off);
+    uint8_t const idxVarReg = iemNativeVarRegisterAcquireForGuestReg(pReNative, idxValueVar, IEMNATIVEGSTREG_GPR(iGReg), &off);
     off = iemNativeEmitStoreGprToVCpuU64(pReNative, off, idxVarReg, RT_UOFFSETOF_DYN(VMCPU, cpum.GstCtx.aGRegs[iGReg]));
+    iemNativeVarRegisterRelease(pReNative, idxValueVar);
     return off;
 }
@@ -8184,7 +8231,9 @@
     Assert(pReNative->Core.aVars[idxVarEFlags].cbVar == sizeof(uint32_t));
 
-    uint8_t const idxReg = iemNativeVarAllocRegister(pReNative, idxVarEFlags, &off, false /*fInitialized*/);
+    uint8_t const idxReg = iemNativeVarRegisterAcquire(pReNative, idxVarEFlags, &off, false /*fInitialized*/);
     iemNativeRegClearAndMarkAsGstRegShadow(pReNative, idxReg, kIemNativeGstReg_EFlags, off);
-    return iemNativeEmitLoadGprFromVCpuU32(pReNative, off, idxReg, RT_UOFFSETOF(VMCPUCC, cpum.GstCtx.eflags));
+    off = iemNativeEmitLoadGprFromVCpuU32(pReNative, off, idxReg, RT_UOFFSETOF(VMCPUCC, cpum.GstCtx.eflags));
+    iemNativeVarRegisterRelease(pReNative, idxVarEFlags);
+    return off;
 }
 
@@ -8200,5 +8249,5 @@
     Assert(pReNative->Core.aVars[idxVarEFlags].cbVar == sizeof(uint32_t));
 
-    uint8_t const idxReg = iemNativeVarAllocRegister(pReNative, idxVarEFlags, &off, true /*fInitialized*/);
+    uint8_t const idxReg = iemNativeVarRegisterAcquire(pReNative, idxVarEFlags, &off, true /*fInitialized*/);
 
 #ifdef VBOX_STRICT
@@ -8213,5 +8262,7 @@
 
     iemNativeRegClearAndMarkAsGstRegShadow(pReNative, idxReg, kIemNativeGstReg_EFlags, off);
-    return iemNativeEmitStoreGprToVCpuU32(pReNative, off, idxReg, RT_UOFFSETOF_DYN(VMCPUCC, cpum.GstCtx.eflags));
+    off = iemNativeEmitStoreGprToVCpuU32(pReNative, off, idxReg, RT_UOFFSETOF_DYN(VMCPUCC, cpum.GstCtx.eflags));
+    iemNativeVarRegisterRelease(pReNative, idxVarEFlags);
+    return off;
 }
 
@@ -8406,5 +8457,5 @@
      * Now emit code that calculates: idxRegRet = (uint16_t)(u16EffAddr + idxGstRegBase [+ idxGstRegIndex])
      */
-    uint8_t const idxRegRet   = iemNativeVarAllocRegister(pReNative, idxVarRet, &off);
+    uint8_t const idxRegRet   = iemNativeVarRegisterAcquire(pReNative, idxVarRet, &off);
     uint8_t const idxRegBase  = iemNativeRegAllocTmpForGuestReg(pReNative, &off, IEMNATIVEGSTREG_GPR(idxGstRegBase),
                                                                kIemNativeGstRegUse_ReadOnly);
@@ -8505,4 +8556,5 @@
         iemNativeRegFreeTmp(pReNative, idxRegIndex);
     iemNativeRegFreeTmp(pReNative, idxRegBase);
+    iemNativeVarRegisterRelease(pReNative, idxVarRet);
     return off;
 }
@@ -8612,5 +8664,5 @@
      * Now emit code that calculates: idxRegRet = (uint32_t)(u32EffAddr [+ idxGstRegBase] [+ (idxGstRegIndex << cShiftIndex)])
      */
-    uint8_t const idxRegRet   = iemNativeVarAllocRegister(pReNative, idxVarRet, &off);
+    uint8_t const idxRegRet   = iemNativeVarRegisterAcquire(pReNative, idxVarRet, &off);
     uint8_t       idxRegBase  = idxGstRegBase == UINT8_MAX ? UINT8_MAX
                               : iemNativeRegAllocTmpForGuestReg(pReNative, &off, IEMNATIVEGSTREG_GPR(idxGstRegBase),
@@ -8765,4 +8817,5 @@
     if (idxRegBase != UINT8_MAX)
         iemNativeRegFreeTmp(pReNative, idxRegBase);
+    iemNativeVarRegisterRelease(pReNative, idxVarRet);
     return off;
 }
@@ -8815,5 +8868,5 @@
     if ((bRmEx & (X86_MODRM_MOD_MASK | X86_MODRM_RM_MASK)) == 5)
     {
-        uint8_t const idxRegRet = iemNativeVarAllocRegister(pReNative, idxVarRet, &off);
+        uint8_t const idxRegRet = iemNativeVarRegisterAcquire(pReNative, idxVarRet, &off);
         uint8_t const idxRegPc  = iemNativeRegAllocTmpForGuestReg(pReNative, &off, kIemNativeGstReg_Pc,
                                                                   kIemNativeGstRegUse_ReadOnly);
@@ -8845,4 +8898,5 @@
 #endif
         iemNativeRegFreeTmp(pReNative, idxRegPc);
+        iemNativeVarRegisterRelease(pReNative, idxVarRet);
         return off;
     }
@@ -8913,5 +8967,5 @@
      *      idxRegRet = (uint32_t)(i64EffAddr [+ idxGstRegBase] [+ (idxGstRegIndex << cShiftIndex)])
      */
-    uint8_t const idxRegRet   = iemNativeVarAllocRegister(pReNative, idxVarRet, &off);
+    uint8_t const idxRegRet   = iemNativeVarRegisterAcquire(pReNative, idxVarRet, &off);
     uint8_t       idxRegBase  = idxGstRegBase == UINT8_MAX ? UINT8_MAX
                               : iemNativeRegAllocTmpForGuestReg(pReNative, &off, IEMNATIVEGSTREG_GPR(idxGstRegBase),
@@ -9099,4 +9153,5 @@
     if (idxRegBase != UINT8_MAX)
         iemNativeRegFreeTmp(pReNative, idxRegBase);
+    iemNativeVarRegisterRelease(pReNative, idxVarRet);
     return off;
 }
@@ -9267,6 +9322,6 @@
     uint8_t  const idxRegValueFetch = enmOp == kIemNativeEmitMemOp_Store ? UINT8_MAX /* special case value storing below */
                                     : !(pReNative->Core.bmHstRegs & RT_BIT_32(IEMNATIVE_CALL_RET_GREG))
-                                    ? iemNativeVarSetRegister(pReNative, idxVarValue, IEMNATIVE_CALL_RET_GREG, off)
-                                    : iemNativeVarAllocRegister(pReNative, idxVarValue, &off);
+                                    ? iemNativeVarRegisterSetAndAcquire(pReNative, idxVarValue, IEMNATIVE_CALL_RET_GREG, &off)
+                                    : iemNativeVarRegisterAcquire(pReNative, idxVarValue, &off);
 
     /*
@@ -9363,4 +9418,5 @@
         if (idxRegValueFetch != IEMNATIVE_CALL_RET_GREG)
             off = iemNativeEmitLoadGprFromGpr(pReNative, off, idxRegValueFetch, IEMNATIVE_CALL_RET_GREG);
+        iemNativeVarRegisterRelease(pReNative, idxVarValue);
     }
 
@@ -10002,6 +10058,6 @@
     uint32_t const idxLabelTlbDone  = iemNativeLabelCreate(pReNative, kIemNativeLabelType_TlbDone, UINT32_MAX, uTlbSeqNo);
     uint8_t  const idxRegMemResult  = !(pReNative->Core.bmHstRegs & RT_BIT_32(IEMNATIVE_CALL_RET_GREG))
-                                    ? iemNativeVarSetRegister(pReNative, idxVarMem, IEMNATIVE_CALL_RET_GREG, off)
-                                    : iemNativeVarAllocRegister(pReNative, idxVarMem, &off);
+                                    ? iemNativeVarRegisterSetAndAcquire(pReNative, idxVarMem, IEMNATIVE_CALL_RET_GREG, &off)
+                                    : iemNativeVarRegisterAcquire(pReNative, idxVarMem, &off);
 
     /*
@@ -10050,4 +10106,5 @@
     if (idxRegMemResult != IEMNATIVE_CALL_RET_GREG)
         off = iemNativeEmitLoadGprFromGpr(pReNative, off, idxRegMemResult, IEMNATIVE_CALL_RET_GREG);
+    iemNativeVarRegisterRelease(pReNative, idxVarMem);
 
     iemNativeLabelDefine(pReNative, idxLabelTlbDone, off);
@@ -10128,6 +10185,7 @@
 #endif
     {
-        uint8_t const idxVarReg = iemNativeVarAllocRegister(pReNative, idxVarUnmapInfo, &off);
+        uint8_t const idxVarReg = iemNativeVarRegisterAcquire(pReNative, idxVarUnmapInfo, &off);
         off = iemNativeEmitTestAnyBitsInGpr8(pReNative, off, idxVarReg, 0xff);
+        iemNativeVarRegisterRelease(pReNative, idxVarUnmapInfo);
     }
     uint32_t const offJmpFixup = off;
