Index: /trunk/src/VBox/VMM/VMMAll/GICAll.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/GICAll.cpp	(revision 103373)
+++ /trunk/src/VBox/VMM/VMMAll/GICAll.cpp	(revision 103374)
@@ -1126,4 +1126,5 @@
                 VMCPUID idCpu = 0;
                 uint16_t uTgtList = ARMV8_ICC_SGI1R_EL1_AARCH64_TARGET_LIST_GET(u64Value);
+                /** @todo rewrite using ASMBitFirstSetU16. */
                 while (uTgtList)
                 {
@@ -1131,5 +1132,8 @@
                     {
                         PVMCPUCC pVCpuDst = VMMGetCpuById(pVCpu->CTX_SUFF(pVM), idCpu);
-                        GICSgiSet(pVCpuDst, uIntId, true /*fAsserted*/);
+                        if (pVCpuDst)
+                            GICSgiSet(pVCpuDst, uIntId, true /*fAsserted*/);
+                        else
+                            AssertFailed();
                     }
                     uTgtList >>= 1;
Index: /trunk/src/VBox/VMM/VMMAll/PGMAll.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/PGMAll.cpp	(revision 103373)
+++ /trunk/src/VBox/VMM/VMMAll/PGMAll.cpp	(revision 103374)
@@ -1480,4 +1480,5 @@
         const unsigned     iPml4  = (GCPtr >> X86_PML4_SHIFT) & X86_PML4_MASK;
         PX86PML4E          pPml4e = pgmShwGetLongModePML4EPtr(pVCpu, iPml4);
+        AssertReturn(pPml4e, VERR_PGM_PML4_MAPPING);
         X86PGPAEUINT const uPml4e = pPml4e->u;
 
Index: /trunk/src/VBox/VMM/VMMAll/PGMAllBth.h
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/PGMAllBth.h	(revision 103373)
+++ /trunk/src/VBox/VMM/VMMAll/PGMAllBth.h	(revision 103374)
@@ -1420,4 +1420,5 @@
     const unsigned  iPDDst    = (uint32_t)GCPtrPage >> SHW_PD_SHIFT;
     PX86PDE         pPdeDst   = pgmShwGet32BitPDEPtr(pVCpu, GCPtrPage);
+    AssertReturn(pPdeDst, VERR_INTERNAL_ERROR_3);
 
     /* Fetch the pgm pool shadow descriptor. */
@@ -2137,4 +2138,5 @@
     const unsigned  iPDDst   = (GCPtrPage >> SHW_PD_SHIFT) & SHW_PD_MASK;
     PX86PDE         pPdeDst  = pgmShwGet32BitPDEPtr(pVCpu, GCPtrPage);
+    AssertReturn(pPdeDst, VERR_INTERNAL_ERROR_3);
 
     /* Fetch the pgm pool shadow descriptor. */
@@ -3403,4 +3405,5 @@
     const unsigned  iPDDst   = GCPtrPage >> SHW_PD_SHIFT;
     PSHWPDE         pPdeDst  = pgmShwGet32BitPDEPtr(pVCpu, GCPtrPage);
+    AssertReturn(pPdeDst, VERR_INTERNAL_ERROR_3);
 
     /* Fetch the pgm pool shadow descriptor. */
@@ -3801,4 +3804,5 @@
     const unsigned  iPDDst  = (GCPtrPage >> SHW_PD_SHIFT) & SHW_PD_MASK;
     PSHWPDE         pPdeDst = pgmShwGet32BitPDEPtr(pVCpu, GCPtrPage);
+    AssertReturn(pPdeDst, VERR_INTERNAL_ERROR_3);
 
     /* Fetch the pgm pool shadow descriptor. */
@@ -4210,4 +4214,5 @@
 # if PGM_SHW_TYPE == PGM_TYPE_32BIT
     PX86PDE         pPdeDst = pgmShwGet32BitPDEPtr(pVCpu, GCPtrPage);
+    AssertReturn(pPdeDst, VERR_INTERNAL_ERROR_3);
 
 # elif PGM_SHW_TYPE == PGM_TYPE_PAE
@@ -4459,11 +4464,9 @@
     for (; iPml4 < X86_PG_PAE_ENTRIES; iPml4++)
     {
-        PPGMPOOLPAGE    pShwPdpt = NULL;
-        PX86PML4E       pPml4eSrc;
-        PX86PML4E       pPml4eDst;
-        RTGCPHYS        GCPhysPdptSrc;
-
-        pPml4eSrc     = pgmGstGetLongModePML4EPtr(pVCpu, iPml4);
-        pPml4eDst     = pgmShwGetLongModePML4EPtr(pVCpu, iPml4);
+        PX86PML4E const pPml4eSrc = pgmGstGetLongModePML4EPtr(pVCpu, iPml4);
+        AssertContinueStmt(pPml4eSrc, cErrors++);
+
+        PX86PML4E const pPml4eDst = pgmShwGetLongModePML4EPtr(pVCpu, iPml4);
+        AssertContinueStmt(pPml4eDst, cErrors++);
 
         /* Fetch the pgm pool shadow descriptor if the shadow pml4e is present. */
@@ -4474,6 +4477,6 @@
         }
 
-        pShwPdpt = pgmPoolGetPage(pPool, pPml4eDst->u & X86_PML4E_PG_MASK);
-        GCPhysPdptSrc = PGM_A20_APPLY(pVCpu, pPml4eSrc->u & X86_PML4E_PG_MASK);
+        PPGMPOOLPAGE pShwPdpt = pgmPoolGetPage(pPool, pPml4eDst->u & X86_PML4E_PG_MASK);
+        RTGCPHYS GCPhysPdptSrc = PGM_A20_APPLY(pVCpu, pPml4eSrc->u & X86_PML4E_PG_MASK);
 
         if ((pPml4eSrc->u & X86_PML4E_P) != (pPml4eDst->u & X86_PML4E_P))
Index: /trunk/src/VBox/VMM/VMMAll/PGMAllHandler.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/PGMAllHandler.cpp	(revision 103373)
+++ /trunk/src/VBox/VMM/VMMAll/PGMAllHandler.cpp	(revision 103374)
@@ -1508,8 +1508,9 @@
             STAM_COUNTER_INC(&pVM->pgm.s.Stats.CTX_MID_Z(Stat,PhysHandlerReset));
 
-            PPGMRAMRANGE pRam = pgmPhysGetRange(pVM, GCPhys);
-            Assert(pRam);
-            Assert(pRam->GCPhys     <= pCur->Key);
-            Assert(pRam->GCPhysLast >= pCur->KeyLast);
+#ifdef VBOX_STRICT
+            PPGMRAMRANGE const pRamStrict = pgmPhysGetRange(pVM, GCPhys);
+            Assert(pRamStrict && pRamStrict->GCPhys     <= pCur->Key);
+            Assert(pRamStrict && pRamStrict->GCPhysLast >= pCur->KeyLast);
+#endif
 
             /*
@@ -1518,5 +1519,9 @@
             if (pCur->cTmpOffPages > 0)
             {
-                rc = pgmHandlerPhysicalSetRamFlagsAndFlushShadowPTs(pVM, pCur, pRam, pvBitmap, offBitmap);
+                PPGMRAMRANGE const pRam = pgmPhysGetRange(pVM, GCPhys);
+                if (pRam) /* paranoia */
+                    rc = pgmHandlerPhysicalSetRamFlagsAndFlushShadowPTs(pVM, pCur, pRam, pvBitmap, offBitmap);
+                else
+                    AssertFailed();
                 pCur->cTmpOffPages  = 0;
             }
@@ -1914,6 +1919,11 @@
              * Get and validate the pages.
              */
-            PPGMPAGE pPage;
+            PPGMPAGE     pPage = NULL;
+#ifdef VBOX_WITH_NATIVE_NEM
+            PPGMRAMRANGE pRam  = NULL;
+            rc = pgmPhysGetPageAndRangeEx(pVM, GCPhysPage, &pPage, &pRam);
+#else
             rc = pgmPhysGetPageEx(pVM, GCPhysPage, &pPage);
+#endif
             AssertReturnStmt(RT_SUCCESS_NP(rc), PGM_UNLOCK(pVM), rc);
             if (PGM_PAGE_GET_TYPE(pPage) != PGMPAGETYPE_MMIO)
@@ -1954,6 +1964,5 @@
             if (VM_IS_NEM_ENABLED(pVM))
             {
-                PPGMRAMRANGE pRam    = pgmPhysGetRange(pVM, GCPhysPage);
-                uint8_t      u2State = PGM_PAGE_GET_NEM_STATE(pPage);
+                uint8_t u2State = PGM_PAGE_GET_NEM_STATE(pPage);
                 NEMHCNotifyPhysPageChanged(pVM, GCPhysPage, pVM->pgm.s.HCPhysZeroPg, PGM_PAGE_GET_HCPHYS(pPage),
                                            PGM_RAMRANGE_CALC_PAGE_R3PTR(pRam, GCPhysPage),
Index: /trunk/src/VBox/VMM/VMMAll/PGMAllPhys.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/PGMAllPhys.cpp	(revision 103373)
+++ /trunk/src/VBox/VMM/VMMAll/PGMAllPhys.cpp	(revision 103374)
@@ -658,6 +658,7 @@
 VMMDECL(bool) PGMPhysIsA20Enabled(PVMCPU pVCpu)
 {
-    LogFlow(("PGMPhysIsA20Enabled %d\n", pVCpu->pgm.s.fA20Enabled));
-    return pVCpu->pgm.s.fA20Enabled;
+    /* Must check that pVCpu isn't NULL here because PDM device helper are a little lazy. */
+    LogFlow(("PGMPhysIsA20Enabled %d\n", pVCpu && pVCpu->pgm.s.fA20Enabled));
+    return pVCpu && pVCpu->pgm.s.fA20Enabled;
 }
 
Index: /trunk/src/VBox/VMM/VMMR3/DBGFStack.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR3/DBGFStack.cpp	(revision 103373)
+++ /trunk/src/VBox/VMM/VMMR3/DBGFStack.cpp	(revision 103374)
@@ -848,6 +848,6 @@
         else
         {
-            PVMCPU pVCpu = VMMGetCpuById(pUVM->pVM, idCpu);
-            CPUMMODE enmCpuMode = CPUMGetGuestMode(pVCpu);
+            PVMCPU const   pVCpu      = pUVM->pVM->apCpusR3[idCpu];
+            CPUMMODE const enmCpuMode = CPUMGetGuestMode(pVCpu);
             if (enmCpuMode == CPUMMODE_REAL)
             {
@@ -1029,9 +1029,9 @@
     {
         case DBGFCODETYPE_GUEST:
-            pCtx = CPUMQueryGuestCtxPtr(VMMGetCpuById(pVM, idCpu));
+            pCtx = CPUMQueryGuestCtxPtr(pVM->apCpusR3[idCpu]);
             hAs  = DBGF_AS_GLOBAL;
             break;
         case DBGFCODETYPE_HYPER:
-            pCtx = CPUMQueryGuestCtxPtr(VMMGetCpuById(pVM, idCpu));
+            pCtx = CPUMQueryGuestCtxPtr(pVM->apCpusR3[idCpu]);
             hAs  = DBGF_AS_RC_AND_GC_GLOBAL;
             break;
Index: /trunk/src/VBox/VMM/VMMR3/VMM.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR3/VMM.cpp	(revision 103373)
+++ /trunk/src/VBox/VMM/VMMR3/VMM.cpp	(revision 103374)
@@ -1296,4 +1296,5 @@
 
 #if defined(VBOX_VMM_TARGET_ARMV8)
+
 /**
  * VCPU worker for VMMR3CpuOn.
@@ -1306,5 +1307,5 @@
 static DECLCALLBACK(int) vmmR3CpuOn(PVM pVM, VMCPUID idCpu, RTGCPHYS GCPhysExecAddr, uint64_t u64CtxId)
 {
-    PVMCPU pVCpu = VMMGetCpuById(pVM, idCpu);
+    PVMCPU pVCpu = pVM->apCpusR3[idCpu];
     VMCPU_ASSERT_EMT(pVCpu);
 
@@ -1346,5 +1347,7 @@
     AssertRC(rc);
 }
-#else
+
+#else /* !VBOX_VMM_TARGET_ARMV8 */
+
 /**
  * VCPU worker for VMMR3SendStartupIpi.
@@ -1356,5 +1359,5 @@
 static DECLCALLBACK(int) vmmR3SendStartupIpi(PVM pVM, VMCPUID idCpu, uint32_t uVector)
 {
-    PVMCPU pVCpu = VMMGetCpuById(pVM, idCpu);
+    PVMCPU pVCpu = pVM->apCpusR3[idCpu];
     VMCPU_ASSERT_EMT(pVCpu);
 
@@ -1411,5 +1414,5 @@
 static DECLCALLBACK(int) vmmR3SendInitIpi(PVM pVM, VMCPUID idCpu)
 {
-    PVMCPU pVCpu = VMMGetCpuById(pVM, idCpu);
+    PVMCPU pVCpu = pVM->apCpusR3[idCpu];
     VMCPU_ASSERT_EMT(pVCpu);
 
@@ -1420,9 +1423,9 @@
 
     /* If the CPU is in VMX non-root mode, INIT signals cause VM-exits. */
-#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
+# ifdef VBOX_WITH_NESTED_HWVIRT_VMX
     PCCPUMCTX pCtx = CPUMQueryGuestCtxPtr(pVCpu);
     if (CPUMIsGuestInVmxNonRootMode(pCtx))
         return VBOXSTRICTRC_TODO(IEMExecVmxVmexit(pVCpu, VMX_EXIT_INIT_SIGNAL, 0 /* uExitQual */));
-#endif
+# endif
 
     /** @todo Figure out how to handle a SVM nested-guest intercepts here for INIT
@@ -1431,7 +1434,7 @@
     PGMR3ResetCpu(pVM, pVCpu);
     PDMR3ResetCpu(pVCpu);   /* Only clears pending interrupts force flags */
-#if !defined(VBOX_VMM_TARGET_ARMV8)
+# if !defined(VBOX_VMM_TARGET_ARMV8)
     APICR3InitIpi(pVCpu);
-#endif
+# endif
     TRPMR3ResetCpu(pVCpu);
     CPUMR3ResetCpu(pVM, pVCpu);
@@ -1475,6 +1478,6 @@
     AssertRC(rc);
 }
-#endif
-
+
+#endif /* !VBOX_VMM_TARGET_ARMV8 */
 
 /**
Index: /trunk/src/VBox/VMM/include/PGMInline.h
===================================================================
--- /trunk/src/VBox/VMM/include/PGMInline.h	(revision 103373)
+++ /trunk/src/VBox/VMM/include/PGMInline.h	(revision 103374)
@@ -373,6 +373,6 @@
 }
 
-
 #ifndef VBOX_VMM_TARGET_ARMV8
+
 /**
  * Checks if the no-execute (NX) feature is active (EFER.NXE=1).
@@ -979,6 +979,6 @@
     return NULL;
 }
+
 #endif /* !VBOX_VMM_TARGET_ARMV8 */
-
 
 /**
