Index: /trunk/include/VBox/vmm/pdmdev.h
===================================================================
--- /trunk/include/VBox/vmm/pdmdev.h	(revision 105351)
+++ /trunk/include/VBox/vmm/pdmdev.h	(revision 105352)
@@ -3437,5 +3437,6 @@
      * @remarks See remarks on VMR3ReqCallVU.
      */
-    DECLR3CALLBACKMEMBER(int, pfnVMReqCallNoWaitV,(PPDMDEVINS pDevIns, VMCPUID idDstCpu, PFNRT pfnFunction, unsigned cArgs, va_list Args));
+    DECLR3CALLBACKMEMBER(int, pfnVMReqCallNoWaitV,(PPDMDEVINS pDevIns, VMCPUID idDstCpu, PFNRT pfnFunction, unsigned cArgs,
+                                                   va_list Args)) RT_IPRT_CALL_ATTR(3, 4, 0);
 
     /**
@@ -3458,5 +3459,6 @@
      * @remarks See remarks on VMR3ReqCallVU.
      */
-    DECLR3CALLBACKMEMBER(int, pfnVMReqPriorityCallWaitV,(PPDMDEVINS pDevIns, VMCPUID idDstCpu, PFNRT pfnFunction, unsigned cArgs, va_list Args));
+    DECLR3CALLBACKMEMBER(int, pfnVMReqPriorityCallWaitV,(PPDMDEVINS pDevIns, VMCPUID idDstCpu, PFNRT pfnFunction, unsigned cArgs,
+                                                         va_list Args)) RT_IPRT_CALL_ATTR(3, 4, 0);
 
     /**
@@ -7612,5 +7614,6 @@
  * @remarks See remarks on VMR3ReqCallVU.
  */
-DECLINLINE(int) PDMDevHlpVMReqCallNoWait(PPDMDEVINS pDevIns, VMCPUID idDstCpu, PFNRT pfnFunction, unsigned cArgs, ...)
+DECLINLINE(int) RT_IPRT_CALL_ATTR(3, 4, 5)
+PDMDevHlpVMReqCallNoWait(PPDMDEVINS pDevIns, VMCPUID idDstCpu, PFNRT pfnFunction, unsigned cArgs, ...)
 {
     va_list Args;
@@ -7640,5 +7643,6 @@
  * @remarks See remarks on VMR3ReqCallVU.
  */
-DECLINLINE(int) PDMDevHlpVMReqPriorityCallWait(PPDMDEVINS pDevIns, VMCPUID idDstCpu, PFNRT pfnFunction, unsigned cArgs, ...)
+DECLINLINE(int) RT_IPRT_CALL_ATTR(3, 4, 5)
+PDMDevHlpVMReqPriorityCallWait(PPDMDEVINS pDevIns, VMCPUID idDstCpu, PFNRT pfnFunction, unsigned cArgs, ...)
 {
     va_list Args;
Index: /trunk/include/VBox/vmm/vmapi.h
===================================================================
--- /trunk/include/VBox/vmm/vmapi.h	(revision 105351)
+++ /trunk/include/VBox/vmm/vmapi.h	(revision 105352)
@@ -435,16 +435,27 @@
 VMMR3_INT_DECL(uint32_t) VMR3GetRuntimeErrorCount(PUVM pUVM);
 
-VMMR3DECL(int)          VMR3ReqCallU(PUVM pUVM, VMCPUID idDstCpu, PVMREQ *ppReq, RTMSINTERVAL cMillies, uint32_t fFlags, PFNRT pfnFunction, unsigned cArgs, ...);
-VMMR3DECL(int)          VMR3ReqCallVU(PUVM pUVM, VMCPUID idDstCpu, PVMREQ *ppReq, RTMSINTERVAL cMillies, uint32_t fFlags, PFNRT pfnFunction, unsigned cArgs, va_list Args);
-VMMR3_INT_DECL(int)     VMR3ReqCallWait(PVM pVM, VMCPUID idDstCpu, PFNRT pfnFunction, unsigned cArgs, ...);
-VMMR3DECL(int)          VMR3ReqCallWaitU(PUVM pUVM, VMCPUID idDstCpu, PFNRT pfnFunction, unsigned cArgs, ...);
-VMMR3DECL(int)          VMR3ReqCallNoWait(PVM pVM, VMCPUID idDstCpu, PFNRT pfnFunction, unsigned cArgs, ...);
-VMMR3DECL(int)          VMR3ReqCallNoWaitU(PUVM pUVM, VMCPUID idDstCpu, PFNRT pfnFunction, unsigned cArgs, ...);
-VMMR3_INT_DECL(int)     VMR3ReqCallVoidWait(PVM pVM, VMCPUID idDstCpu, PFNRT pfnFunction, unsigned cArgs, ...);
-VMMR3DECL(int)          VMR3ReqCallVoidWaitU(PUVM pUVM, VMCPUID idDstCpu, PFNRT pfnFunction, unsigned cArgs, ...);
-VMMR3DECL(int)          VMR3ReqCallVoidNoWait(PVM pVM, VMCPUID idDstCpu, PFNRT pfnFunction, unsigned cArgs, ...);
-VMMR3DECL(int)          VMR3ReqPriorityCallWait(PVM pVM, VMCPUID idDstCpu, PFNRT pfnFunction, unsigned cArgs, ...);
-VMMR3DECL(int)          VMR3ReqPriorityCallWaitU(PUVM pUVM, VMCPUID idDstCpu, PFNRT pfnFunction, unsigned cArgs, ...);
-VMMR3DECL(int)          VMR3ReqPriorityCallVoidWaitU(PUVM pUVM, VMCPUID idDstCpu, PFNRT pfnFunction, unsigned cArgs, ...);
+/** Maximum argument count for VMR3ReqCallU and friends. */
+#define VMREQ_MAX_ARGS              9
+/** Maximum argument count for VMR3ReqCallU and friends when
+ *  VMREQ_F_EXTRA_ARGS_ALL_PTRS is used. */
+#define VMREQ_MAX_ARGS_EXTENDED     15
+/** Flag to OR into the argumnet count to indicate that all arguments
+ * starting with VMREQ_MAX_ARGS are pointer size and won't cause trouble.
+ * @see @bugref{10725} and VMR3ReqCallVU caveats.  */
+#define VMREQ_F_EXTRA_ARGS_ALL_PTRS 0x00008000U
+VMMR3DECL(int)          VMR3ReqCallU(PUVM pUVM, VMCPUID idDstCpu, PVMREQ *ppReq, RTMSINTERVAL cMillies, uint32_t fFlags,
+                                     PFNRT pfnFunction, unsigned cArgs, ...) RT_IPRT_CALL_ATTR(6, 7, 8);
+VMMR3DECL(int)          VMR3ReqCallVU(PUVM pUVM, VMCPUID idDstCpu, PVMREQ *ppReq, RTMSINTERVAL cMillies, uint32_t fFlags,
+                                      PFNRT pfnFunction, unsigned cArgs, va_list Args) RT_IPRT_CALL_ATTR(6, 7, 0);
+VMMR3_INT_DECL(int)     VMR3ReqCallWait(PVM pVM, VMCPUID idDstCpu, PFNRT pfnFunction, unsigned cArgs, ...) RT_IPRT_CALL_ATTR(3, 4, 5);
+VMMR3DECL(int)          VMR3ReqCallWaitU(PUVM pUVM, VMCPUID idDstCpu, PFNRT pfnFunction, unsigned cArgs, ...) RT_IPRT_CALL_ATTR(3, 4, 5);
+VMMR3DECL(int)          VMR3ReqCallNoWait(PVM pVM, VMCPUID idDstCpu, PFNRT pfnFunction, unsigned cArgs, ...) RT_IPRT_CALL_ATTR(3, 4, 5);
+VMMR3DECL(int)          VMR3ReqCallNoWaitU(PUVM pUVM, VMCPUID idDstCpu, PFNRT pfnFunction, unsigned cArgs, ...) RT_IPRT_CALL_ATTR(3, 4, 5);
+VMMR3_INT_DECL(int)     VMR3ReqCallVoidWait(PVM pVM, VMCPUID idDstCpu, PFNRT pfnFunction, unsigned cArgs, ...) RT_IPRT_CALL_ATTR(3, 4, 5);
+VMMR3DECL(int)          VMR3ReqCallVoidWaitU(PUVM pUVM, VMCPUID idDstCpu, PFNRT pfnFunction, unsigned cArgs, ...) RT_IPRT_CALL_ATTR(3, 4, 5);
+VMMR3DECL(int)          VMR3ReqCallVoidNoWait(PVM pVM, VMCPUID idDstCpu, PFNRT pfnFunction, unsigned cArgs, ...) RT_IPRT_CALL_ATTR(3, 4, 5);
+VMMR3DECL(int)          VMR3ReqPriorityCallWait(PVM pVM, VMCPUID idDstCpu, PFNRT pfnFunction, unsigned cArgs, ...) RT_IPRT_CALL_ATTR(3, 4, 5);
+VMMR3DECL(int)          VMR3ReqPriorityCallWaitU(PUVM pUVM, VMCPUID idDstCpu, PFNRT pfnFunction, unsigned cArgs, ...) RT_IPRT_CALL_ATTR(3, 4, 5);
+VMMR3DECL(int)          VMR3ReqPriorityCallVoidWaitU(PUVM pUVM, VMCPUID idDstCpu, PFNRT pfnFunction, unsigned cArgs, ...) RT_IPRT_CALL_ATTR(3, 4, 5);
 VMMR3DECL(int)          VMR3ReqAlloc(PUVM pUVM, PVMREQ *ppReq, VMREQTYPE enmType, VMCPUID idDstCpu);
 VMMR3DECL(int)          VMR3ReqFree(PVMREQ pReq);
Index: /trunk/include/iprt/cdefs.h
===================================================================
--- /trunk/include/iprt/cdefs.h	(revision 105351)
+++ /trunk/include/iprt/cdefs.h	(revision 105352)
@@ -1511,4 +1511,17 @@
 #else
 # define RT_IPRT_FORMAT_ATTR_MAYBE_NULL(a_iFmt, a_iArgs)
+#endif
+
+/** @def RT_IPRT_CALL_ATTR
+ * Identifies a function taking an IPRT format string.
+ * @param   a_iFn   The index (1-based) of the function pointer argument.
+ * @param   a_iArgc The index (1-based) of the argument count.
+ * @param   a_iArgs The index (1-based) of the first argument, use 0 for
+ *                  va_list.
+ */
+#if defined(__GNUC__) && defined(WITH_IPRT_CALL_ATTRIBUTE)
+# define RT_IPRT_CALL_ATTR(a_iFn, a_iArgc, a_iArgs)   __attribute__((__iprt_call__(a_iFn, a_iArgc, a_iArgs)))
+#else
+# define RT_IPRT_CALL_ATTR(a_iFn, a_iArgc, a_iArgs)
 #endif
 
Index: /trunk/src/VBox/Main/include/ConsoleImpl.h
===================================================================
--- /trunk/src/VBox/Main/include/ConsoleImpl.h	(revision 105351)
+++ /trunk/src/VBox/Main/include/ConsoleImpl.h	(revision 105352)
@@ -812,18 +812,24 @@
                        HRESULT *phrc);
     int i_configMediumProperties(PCFGMNODE pCur, IMedium *pMedium, bool *pfHostIP, bool *pfEncrypted);
+    /** i_reconfigureMediumAttachment has too many problematic arguments for
+     * passing directly to VMR3ReqCallUV, so we pack them up. @bugref{10725} */
+    struct ReconfigureMediumAttachmentArgs
+    {
+        const char *pcszDevice;         /**< The name of the controller type. */
+        unsigned uInstance;             /**< The instance of the controller. */
+        StorageBus_T enmBus;            /**< The storage bus type of the controller. */
+        bool fUseHostIOCache;           /**< Use the host I/O cache (disable async I/O). */
+        bool fBuiltinIOCache;           /**< Use the builtin I/O cache. */
+        bool fInsertDiskIntegrityDrv;   /**< Flag whether to insert the disk integrity driver into the chain for additionalk debugging aids. */
+        bool fSetupMerge;               /**< Whether to set up a medium merge */
+        unsigned uMergeSource;          /**< Merge source image index */
+        unsigned uMergeTarget;          /**< Merge target image index */
+        IMediumAttachment *aMediumAtt;  /**< The medium attachment. */
+        MachineState_T aMachineState;   /**< The current machine state. */
+    };
     static DECLCALLBACK(int) i_reconfigureMediumAttachment(Console *pThis,
                                                            PUVM pUVM,
                                                            PCVMMR3VTABLE pVMM,
-                                                           const char *pcszDevice,
-                                                           unsigned uInstance,
-                                                           StorageBus_T enmBus,
-                                                           bool fUseHostIOCache,
-                                                           bool fBuiltinIoCache,
-                                                           bool fInsertDiskIntegrityDrv,
-                                                           bool fSetupMerge,
-                                                           unsigned uMergeSource,
-                                                           unsigned uMergeTarget,
-                                                           IMediumAttachment *aMediumAtt,
-                                                           MachineState_T aMachineState,
+                                                           ReconfigureMediumAttachmentArgs const *pArgs,
                                                            HRESULT *phrc);
     static DECLCALLBACK(int) i_changeRemovableMedium(Console *pThis,
@@ -892,6 +898,6 @@
 
     static DECLCALLBACK(int) i_usbAttachCallback(Console *that, PUVM pUVM, PCVMMR3VTABLE pVMM, IUSBDevice *aHostDevice,
-                                                 PCRTUUID aUuid, const char *aBackend, const char *aAddress,
-                                                 PCFGMNODE pRemoteCfg, USBConnectionSpeed_T enmSpeed, ULONG aMaskedIfs,
+                                                 PCRTUUID aUuid, const char *aBackend, const char *aAddress, PCFGMNODE pRemoteCfg,
+                                                 USBConnectionSpeed_T *penmSpeed, ULONG *pfMaskedIfs,
                                                  const char *pszCaptureFilename);
     static DECLCALLBACK(int) i_usbDetachCallback(Console *that, PUVM pUVM, PCVMMR3VTABLE pVMM, PCRTUUID aUuid);
Index: /trunk/src/VBox/Main/src-client/ConsoleImpl.cpp
===================================================================
--- /trunk/src/VBox/Main/src-client/ConsoleImpl.cpp	(revision 105351)
+++ /trunk/src/VBox/Main/src-client/ConsoleImpl.cpp	(revision 105352)
@@ -2531,6 +2531,5 @@
          */
         PVMREQ pReq;
-        vrc = pVMM->pfnVMR3ReqCallU(pUVM, 0, &pReq, 0 /* no wait! */, VMREQFLAGS_VBOX_STATUS,
-                                    (PFNRT)i_unplugCpu, 4,
+        vrc = pVMM->pfnVMR3ReqCallU(pUVM, 0, &pReq, 0 /* no wait! */, VMREQFLAGS_VBOX_STATUS, (PFNRT)i_unplugCpu, 4,
                                     this, pUVM, pVMM, (VMCPUID)aCpu);
 
@@ -2636,6 +2635,5 @@
      */
     PVMREQ pReq;
-    int vrc = pVMM->pfnVMR3ReqCallU(pUVM, 0, &pReq, 0 /* no wait! */, VMREQFLAGS_VBOX_STATUS,
-                                    (PFNRT)i_plugCpu, 4,
+    int vrc = pVMM->pfnVMR3ReqCallU(pUVM, 0, &pReq, 0 /* no wait! */, VMREQFLAGS_VBOX_STATUS, (PFNRT)i_plugCpu, 4,
                                     this, pUVM, pVMM, aCpu);
 
@@ -3805,6 +3803,5 @@
      */
     PVMREQ pReq;
-    int vrc = pVMM->pfnVMR3ReqCallU(pUVM, 0, &pReq, 0 /* no wait! */, VMREQFLAGS_VBOX_STATUS,
-                                    (PFNRT)i_changeRemovableMedium, 9,
+    int vrc = pVMM->pfnVMR3ReqCallU(pUVM, 0, &pReq, 0 /* no wait! */, VMREQFLAGS_VBOX_STATUS, (PFNRT)i_changeRemovableMedium, 9,
                                     this, pUVM, pVMM, pszDevice, uInstance, enmBus, fUseHostIOCache, aMediumAttachment, fForce);
 
@@ -3984,6 +3981,5 @@
      */
     PVMREQ pReq;
-    int vrc = pVMM->pfnVMR3ReqCallU(pUVM, 0, &pReq, 0 /* no wait! */, VMREQFLAGS_VBOX_STATUS,
-                                    (PFNRT)i_attachStorageDevice, 9,
+    int vrc = pVMM->pfnVMR3ReqCallU(pUVM, 0, &pReq, 0 /* no wait! */, VMREQFLAGS_VBOX_STATUS, (PFNRT)i_attachStorageDevice, 9,
                                     this, pUVM, pVMM, pszDevice, uInstance, enmBus, fUseHostIOCache, aMediumAttachment, fSilent);
 
@@ -4159,6 +4155,5 @@
      */
     PVMREQ pReq;
-    int vrc = pVMM->pfnVMR3ReqCallU(pUVM, 0, &pReq, 0 /* no wait! */, VMREQFLAGS_VBOX_STATUS,
-                                    (PFNRT)i_detachStorageDevice, 8,
+    int vrc = pVMM->pfnVMR3ReqCallU(pUVM, 0, &pReq, 0 /* no wait! */, VMREQFLAGS_VBOX_STATUS, (PFNRT)i_detachStorageDevice, 8,
                                     this, pUVM, pVMM, pszDevice, uInstance, enmBus, aMediumAttachment, fSilent);
 
@@ -5212,6 +5207,5 @@
      * here to make requests from under the lock in order to serialize them.
      */
-    int vrc = pVMM->pfnVMR3ReqCallWaitU(pUVM, 0 /*idDstCpu*/,
-                                        (PFNRT)i_changeNetworkAttachment, 7,
+    int vrc = pVMM->pfnVMR3ReqCallWaitU(pUVM, 0 /*idDstCpu*/, (PFNRT)i_changeNetworkAttachment, 7,
                                         this, pUVM, pVMM, pszDevice, uInstance, uLun, aNetworkAdapter);
 
@@ -6922,9 +6916,19 @@
 
     alock.release();
-    vrc = ptrVM.vtable()->pfnVMR3ReqCallWaitU(ptrVM.rawUVM(), VMCPUID_ANY,
-                                              (PFNRT)i_reconfigureMediumAttachment, 15,
-                                              this, ptrVM.rawUVM(), ptrVM.vtable(), pcszDevice, uInstance, enmBus,
-                                              fUseHostIOCache, fBuiltinIOCache, fInsertDiskIntegrityDrv, true /* fSetupMerge */,
-                                              aSourceIdx, aTargetIdx, aMediumAttachment, mMachineState, &hrc);
+
+    Console::ReconfigureMediumAttachmentArgs Args1;
+    Args1.pcszDevice                = pcszDevice;
+    Args1.uInstance                 = uInstance;
+    Args1.enmBus                    = enmBus;
+    Args1.fUseHostIOCache           = fUseHostIOCache;
+    Args1.fBuiltinIOCache           = fBuiltinIOCache;
+    Args1.fInsertDiskIntegrityDrv   = fInsertDiskIntegrityDrv;
+    Args1.fSetupMerge               = true;
+    Args1.uMergeSource              = aSourceIdx;
+    Args1.uMergeTarget              = aTargetIdx;
+    Args1.aMediumAtt                = aMediumAttachment;
+    Args1.aMachineState             = mMachineState;
+    vrc = ptrVM.vtable()->pfnVMR3ReqCallWaitU(ptrVM.rawUVM(), VMCPUID_ANY, (PFNRT)i_reconfigureMediumAttachment, 5,
+                                              this, ptrVM.rawUVM(), ptrVM.vtable(), &Args1, &hrc);
     /* error handling is after resuming the VM */
 
@@ -6967,9 +6971,18 @@
     hrc = mControl->FinishOnlineMergeMedium();
 
-    vrc = ptrVM.vtable()->pfnVMR3ReqCallWaitU(ptrVM.rawUVM(), VMCPUID_ANY,
-                                              (PFNRT)i_reconfigureMediumAttachment, 15,
-                                              this, ptrVM.rawUVM(), ptrVM.vtable(), pcszDevice, uInstance, enmBus,
-                                              fUseHostIOCache, fBuiltinIOCache, fInsertDiskIntegrityDrv, false /* fSetupMerge */,
-                                              0 /* uMergeSource */, 0 /* uMergeTarget */, aMediumAttachment, mMachineState, &hrc);
+    Console::ReconfigureMediumAttachmentArgs Args2;
+    Args2.pcszDevice                = pcszDevice;
+    Args2.uInstance                 = uInstance;
+    Args2.enmBus                    = enmBus;
+    Args2.fUseHostIOCache           = fUseHostIOCache;
+    Args2.fBuiltinIOCache           = fBuiltinIOCache;
+    Args2.fInsertDiskIntegrityDrv   = fInsertDiskIntegrityDrv;
+    Args2.fSetupMerge               = false;
+    Args2.uMergeSource              = 0;
+    Args2.uMergeTarget              = 0;
+    Args2.aMediumAtt                = aMediumAttachment;
+    Args2.aMachineState             = mMachineState;
+    vrc = ptrVM.vtable()->pfnVMR3ReqCallWaitU(ptrVM.rawUVM(), VMCPUID_ANY, (PFNRT)i_reconfigureMediumAttachment, 5,
+                                              this, ptrVM.rawUVM(), ptrVM.vtable(), &Args2, &hrc);
     /* error handling is after resuming the VM */
 
@@ -7053,11 +7066,18 @@
 
         hrc = S_OK;
-        IMediumAttachment *pAttachment = aAttachments[i];
-        int vrc = ptrVM.vtable()->pfnVMR3ReqCallWaitU(ptrVM.rawUVM(), VMCPUID_ANY,
-                                                      (PFNRT)i_reconfigureMediumAttachment, 15,
-                                                      this, ptrVM.rawUVM(), ptrVM.vtable(), pcszDevice, lInstance, enmBus,
-                                                      fUseHostIOCache, fBuiltinIOCache, fInsertDiskIntegrityDrv,
-                                                      false /* fSetupMerge */, 0 /* uMergeSource */, 0 /* uMergeTarget */,
-                                                      pAttachment, mMachineState, &hrc);
+        Console::ReconfigureMediumAttachmentArgs Args;
+        Args.pcszDevice                 = pcszDevice;
+        Args.uInstance                  = lInstance;
+        Args.enmBus                     = enmBus;
+        Args.fUseHostIOCache            = fUseHostIOCache;
+        Args.fBuiltinIOCache            = fBuiltinIOCache;
+        Args.fInsertDiskIntegrityDrv    = fInsertDiskIntegrityDrv;
+        Args.fSetupMerge                = false;
+        Args.uMergeSource               = 0;
+        Args.uMergeTarget               = 0;
+        Args.aMediumAtt                 = aAttachments[i];
+        Args.aMachineState              = mMachineState;
+        int vrc = ptrVM.vtable()->pfnVMR3ReqCallWaitU(ptrVM.rawUVM(), VMCPUID_ANY, (PFNRT)i_reconfigureMediumAttachment, 5,
+                                                      this, ptrVM.rawUVM(), ptrVM.vtable(), &Args, &hrc);
         if (RT_FAILURE(vrc))
             throw setErrorBoth(E_FAIL, vrc, "%Rrc", vrc);
@@ -10346,8 +10366,9 @@
 
     int vrc = ptrVM.vtable()->pfnVMR3ReqCallWaitU(ptrVM.rawUVM(), 0 /* idDstCpu (saved state, see #6232) */,
-                                                  (PFNRT)i_usbAttachCallback, 11,
+                                                  (PFNRT)i_usbAttachCallback, 11 | VMREQ_F_EXTRA_ARGS_ALL_PTRS,
                                                   this, ptrVM.rawUVM(), ptrVM.vtable(), aHostDevice, uuid.raw(),
-                                                  strBackend.c_str(), Address.c_str(), pRemoteCfg, enmSpeed, aMaskedIfs,
-                                                  aCaptureFilename.isEmpty() ? NULL : aCaptureFilename.c_str());
+                                                  strBackend.c_str(), Address.c_str(), pRemoteCfg, /* extra arg (ptrs only): */
+                                                  &enmSpeed, &aMaskedIfs, aCaptureFilename.isEmpty()
+                                                                        ? (const char *)NULL : aCaptureFilename.c_str());
     if (RT_SUCCESS(vrc))
     {
@@ -10398,6 +10419,6 @@
 DECLCALLBACK(int)
 Console::i_usbAttachCallback(Console *that, PUVM pUVM, PCVMMR3VTABLE pVMM, IUSBDevice *aHostDevice, PCRTUUID aUuid,
-                             const char *pszBackend, const char *aAddress, PCFGMNODE pRemoteCfg, USBConnectionSpeed_T aEnmSpeed,
-                             ULONG aMaskedIfs, const char *pszCaptureFilename)
+                             const char *pszBackend, const char *aAddress, PCFGMNODE pRemoteCfg,
+                             USBConnectionSpeed_T *penmSpeed, ULONG *pfMaskedIfs, const char *pszCaptureFilename)
 {
     RT_NOREF(aHostDevice);
@@ -10409,5 +10430,5 @@
 
     VUSBSPEED enmSpeed = VUSB_SPEED_UNKNOWN;
-    switch (aEnmSpeed)
+    switch (*penmSpeed)
     {
         case USBConnectionSpeed_Low:        enmSpeed = VUSB_SPEED_LOW;          break;
@@ -10420,5 +10441,5 @@
 
     int vrc = pVMM->pfnPDMR3UsbCreateProxyDevice(pUVM, aUuid, pszBackend, aAddress, pRemoteCfg,
-                                                 enmSpeed, aMaskedIfs, pszCaptureFilename);
+                                                 enmSpeed, *pfMaskedIfs, pszCaptureFilename);
     LogFlowFunc(("vrc=%Rrc\n", vrc));
     LogFlowFuncLeave();
@@ -10469,6 +10490,5 @@
     alock.release();
     int vrc = ptrVM.vtable()->pfnVMR3ReqCallWaitU(ptrVM.rawUVM(), 0 /* idDstCpu (saved state, see #6232) */,
-                                                  (PFNRT)i_usbDetachCallback, 4,
-                                                  this, ptrVM.rawUVM(), ptrVM.vtable(), pUuid);
+                                                  (PFNRT)i_usbDetachCallback, 4, this, ptrVM.rawUVM(), ptrVM.vtable(), pUuid);
     if (RT_SUCCESS(vrc))
     {
@@ -11642,16 +11662,5 @@
  * @param   pUVM                    The VM handle.
  * @param   pVMM                    The VMM vtable.
- * @param   pcszDevice              The name of the controller type.
- * @param   uInstance               The instance of the controller.
- * @param   enmBus                  The storage bus type of the controller.
- * @param   fUseHostIOCache         Use the host I/O cache (disable async I/O).
- * @param   fBuiltinIOCache         Use the builtin I/O cache.
- * @param   fInsertDiskIntegrityDrv Flag whether to insert the disk integrity driver into the chain
- *                                  for additionalk debugging aids.
- * @param   fSetupMerge             Whether to set up a medium merge
- * @param   uMergeSource            Merge source image index
- * @param   uMergeTarget            Merge target image index
- * @param   aMediumAtt              The medium attachment.
- * @param   aMachineState           The current machine state.
+ * @param   pArgs                   Argument package.
  * @param   phrc                    Where to store com error - only valid if we return VERR_GENERAL_FAILURE.
  * @return  VBox status code.
@@ -11661,18 +11670,8 @@
                                                          PUVM pUVM,
                                                          PCVMMR3VTABLE pVMM,
-                                                         const char *pcszDevice,
-                                                         unsigned uInstance,
-                                                         StorageBus_T enmBus,
-                                                         bool fUseHostIOCache,
-                                                         bool fBuiltinIOCache,
-                                                         bool fInsertDiskIntegrityDrv,
-                                                         bool fSetupMerge,
-                                                         unsigned uMergeSource,
-                                                         unsigned uMergeTarget,
-                                                         IMediumAttachment *aMediumAtt,
-                                                         MachineState_T aMachineState,
+                                                         Console::ReconfigureMediumAttachmentArgs const *pArgs,
                                                          HRESULT *phrc)
 {
-    LogFlowFunc(("pUVM=%p aMediumAtt=%p phrc=%p\n", pUVM, aMediumAtt, phrc));
+    LogFlowFunc(("pUVM=%p aMediumAtt=%p phrc=%p\n", pUVM, pArgs->aMediumAtt, phrc));
 
     HRESULT         hrc;
@@ -11684,20 +11683,20 @@
      * not subject to snapshotting in general. */
     DeviceType_T lType;
-    hrc = aMediumAtt->COMGETTER(Type)(&lType);                                  H();
+    hrc = pArgs->aMediumAtt->COMGETTER(Type)(&lType); H();
     if (lType != DeviceType_HardDisk)
         return VINF_SUCCESS;
 
     /* Update the device instance configuration. */
-    int vrc = pThis->i_configMediumAttachment(pcszDevice,
-                                              uInstance,
-                                              enmBus,
-                                              fUseHostIOCache,
-                                              fBuiltinIOCache,
-                                              fInsertDiskIntegrityDrv,
-                                              fSetupMerge,
-                                              uMergeSource,
-                                              uMergeTarget,
-                                              aMediumAtt,
-                                              aMachineState,
+    int vrc = pThis->i_configMediumAttachment(pArgs->pcszDevice,
+                                              pArgs->uInstance,
+                                              pArgs->enmBus,
+                                              pArgs->fUseHostIOCache,
+                                              pArgs->fBuiltinIOCache,
+                                              pArgs->fInsertDiskIntegrityDrv,
+                                              pArgs->fSetupMerge,
+                                              pArgs->uMergeSource,
+                                              pArgs->uMergeTarget,
+                                              pArgs->aMediumAtt,
+                                              pArgs->aMachineState,
                                               phrc,
                                               true /* fAttachDetach */,
Index: /trunk/src/VBox/Main/src-client/DisplayImpl.cpp
===================================================================
--- /trunk/src/VBox/Main/src-client/DisplayImpl.cpp	(revision 105351)
+++ /trunk/src/VBox/Main/src-client/DisplayImpl.cpp	(revision 105352)
@@ -1595,6 +1595,6 @@
     Console::SafeVMPtrQuiet ptrVM(mParent);
     if (ptrVM.isOk()) /** @todo r=andy This apparently *never* is true at this point? */
-        ptrVM.vtable()->pfnVMR3ReqCallNoWaitU(ptrVM.rawUVM(), VMCPUID_ANY, (PFNRT)Display::i_InvalidateAndUpdateEMT,
-                                              3, this, aScreenId, false);
+        ptrVM.vtable()->pfnVMR3ReqCallNoWaitU(ptrVM.rawUVM(), VMCPUID_ANY, (PFNRT)Display::i_InvalidateAndUpdateEMT, 3,
+                                              this, aScreenId, false);
 
     LogRelFlowFunc(("Attached to %d %RTuuid\n", aScreenId, aId.raw()));
@@ -2677,6 +2677,6 @@
         alock.release();
 
-        int vrc = ptrVM.vtable()->pfnVMR3ReqCallNoWaitU(ptrVM.rawUVM(), VMCPUID_ANY, (PFNRT)Display::i_InvalidateAndUpdateEMT,
-                                                        3, this, 0, true);
+        int vrc = ptrVM.vtable()->pfnVMR3ReqCallNoWaitU(ptrVM.rawUVM(), VMCPUID_ANY, (PFNRT)Display::i_InvalidateAndUpdateEMT, 3,
+                                                        this, 0, true);
         alock.acquire();
 
@@ -2697,6 +2697,6 @@
     if (SUCCEEDED(hrc))
     {
-        int vrc = ptrVM.vtable()->pfnVMR3ReqCallNoWaitU(ptrVM.rawUVM(), VMCPUID_ANY, (PFNRT)Display::i_InvalidateAndUpdateEMT,
-                                                        3, this, aScreenId, false);
+        int vrc = ptrVM.vtable()->pfnVMR3ReqCallNoWaitU(ptrVM.rawUVM(), VMCPUID_ANY, (PFNRT)Display::i_InvalidateAndUpdateEMT, 3,
+                                                        this, aScreenId, false);
         if (RT_FAILURE(vrc))
             hrc = setErrorBoth(VBOX_E_IPRT_ERROR, vrc, tr("Could not invalidate and update the screen %d (%Rrc)"), aScreenId, vrc);
Index: /trunk/src/VBox/Main/src-client/EmulatedUSBImpl.cpp
===================================================================
--- /trunk/src/VBox/Main/src-client/EmulatedUSBImpl.cpp	(revision 105351)
+++ /trunk/src/VBox/Main/src-client/EmulatedUSBImpl.cpp	(revision 105352)
@@ -288,6 +288,5 @@
 HRESULT EUSBWEBCAM::Attach(Console *pConsole, PUVM pUVM, PCVMMR3VTABLE pVMM, const char *pszDriver)
 {
-    int vrc = pVMM->pfnVMR3ReqCallWaitU(pUVM, 0 /* idDstCpu (saved state, see #6232) */,
-                                        (PFNRT)emulatedWebcamAttach, 4,
+    int vrc = pVMM->pfnVMR3ReqCallWaitU(pUVM, 0 /* idDstCpu (saved state, see #6232) */, (PFNRT)emulatedWebcamAttach, 4,
                                         pUVM, pVMM, this, pszDriver);
     if (RT_SUCCESS(vrc))
@@ -299,6 +298,5 @@
 HRESULT EUSBWEBCAM::Detach(Console *pConsole, PUVM pUVM, PCVMMR3VTABLE pVMM)
 {
-    int vrc = pVMM->pfnVMR3ReqCallWaitU(pUVM, 0 /* idDstCpu (saved state, see #6232) */,
-                                        (PFNRT)emulatedWebcamDetach, 3,
+    int vrc = pVMM->pfnVMR3ReqCallWaitU(pUVM, 0 /* idDstCpu (saved state, see #6232) */, (PFNRT)emulatedWebcamDetach, 3,
                                         pUVM, pVMM, this);
     if (RT_SUCCESS(vrc))
Index: /trunk/src/VBox/VMM/VMMAll/VMAll.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/VMAll.cpp	(revision 105351)
+++ /trunk/src/VBox/VMM/VMMAll/VMAll.cpp	(revision 105352)
@@ -275,6 +275,6 @@
         va_list va2;
         va_copy(va2, va); /* Have to make a copy here or GCC will break. */
-        rc = VMR3ReqPriorityCallWait(pVM, VMCPUID_ANY,
-                                     (PFNRT)vmR3SetRuntimeErrorV, 5, pVM, fFlags, pszErrorId, pszFormat, &va2);
+        rc = VMR3ReqPriorityCallWait(pVM, VMCPUID_ANY, (PFNRT)vmR3SetRuntimeErrorV, 5,
+                                     pVM, fFlags, pszErrorId, pszFormat, &va2);
         va_end(va2);
     }
@@ -282,6 +282,6 @@
     {
         char *pszMessage = MMR3HeapAPrintfV(pVM, MM_TAG_VM, pszFormat, va);
-        rc = VMR3ReqCallNoWait(pVM, VMCPUID_ANY,
-                               (PFNRT)vmR3SetRuntimeError, 4, pVM, fFlags, pszErrorId, pszMessage);
+        rc = VMR3ReqCallNoWait(pVM, VMCPUID_ANY, (PFNRT)vmR3SetRuntimeError, 4,
+                               pVM, fFlags, pszErrorId, pszMessage);
         if (RT_FAILURE(rc))
             MMR3HeapFree(pszMessage);
Index: /trunk/src/VBox/VMM/VMMR3/DBGFAddr.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR3/DBGFAddr.cpp	(revision 105351)
+++ /trunk/src/VBox/VMM/VMMR3/DBGFAddr.cpp	(revision 105352)
@@ -296,6 +296,6 @@
             rc = dbgfR3AddrToPhysOnVCpu(pVCpu, pAddress, pGCPhys);
         else
-            rc = VMR3ReqPriorityCallWaitU(pUVM, pVCpu->idCpu,
-                                          (PFNRT)dbgfR3AddrToPhysOnVCpu, 3, pVCpu, pAddress, pGCPhys);
+            rc = VMR3ReqPriorityCallWaitU(pUVM, pVCpu->idCpu, (PFNRT)dbgfR3AddrToPhysOnVCpu, 3,
+                                          pVCpu, pAddress, pGCPhys);
     }
     return rc;
Index: /trunk/src/VBox/VMM/VMMR3/DBGFDisas.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR3/DBGFDisas.cpp	(revision 105351)
+++ /trunk/src/VBox/VMM/VMMR3/DBGFDisas.cpp	(revision 105352)
@@ -662,5 +662,6 @@
     else
         rc = VMR3ReqPriorityCallWait(pVM, idCpu, (PFNRT)dbgfR3DisasInstrExOnVCpu, 9,
-                                     pVM, VMMGetCpuById(pVM, idCpu), pAddr->Sel, &pAddr->off, fFlags, pszOutput, cbOutput, NULL, pDisState);
+                                     pVM, VMMGetCpuById(pVM, idCpu), pAddr->Sel, &pAddr->off, fFlags,
+                                     pszOutput, cbOutput, NULL, pDisState);
     return rc;
 }
Index: /trunk/src/VBox/VMM/VMMR3/DBGFInfo.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR3/DBGFInfo.cpp	(revision 105351)
+++ /trunk/src/VBox/VMM/VMMR3/DBGFInfo.cpp	(revision 105352)
@@ -1202,6 +1202,5 @@
     if (idCpu == NIL_VMCPUID)
         return dbgfR3Info(pUVM, NIL_VMCPUID, pszName, pszArgs, pHlp);
-    return VMR3ReqPriorityCallWaitU(pUVM, idCpu,
-                                    (PFNRT)dbgfR3Info, 5, pUVM, idCpu, pszName, pszArgs, pHlp);
+    return VMR3ReqPriorityCallWaitU(pUVM, idCpu, (PFNRT)dbgfR3Info, 5, pUVM, idCpu, pszName, pszArgs, pHlp);
 }
 
Index: /trunk/src/VBox/VMM/VMMR3/DBGFMem.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR3/DBGFMem.cpp	(revision 105351)
+++ /trunk/src/VBox/VMM/VMMR3/DBGFMem.cpp	(revision 105352)
@@ -661,5 +661,6 @@
      */
     return VMR3ReqPriorityCallWaitU(pUVM, idCpu, (PFNRT)dbgfR3PagingDumpEx, 8,
-                                    pUVM, idCpu, fFlags, &cr3, &u64FirstAddr, &u64LastAddr, cMaxDepth, pHlp ? pHlp : DBGFR3InfoLogHlp());
-}
-
+                                    pUVM, idCpu, fFlags, &cr3, &u64FirstAddr, &u64LastAddr, cMaxDepth,
+                                    pHlp ? pHlp : DBGFR3InfoLogHlp());
+}
+
Index: /trunk/src/VBox/VMM/VMMR3/DBGFOS.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR3/DBGFOS.cpp	(revision 105351)
+++ /trunk/src/VBox/VMM/VMMR3/DBGFOS.cpp	(revision 105352)
@@ -520,6 +520,6 @@
      * Pass it on to EMT(0).
      */
-    return VMR3ReqPriorityCallWaitU(pUVM, 0 /*idDstCpu*/,
-                                   (PFNRT)dbgfR3OSQueryNameAndVersion, 5, pUVM, pszName, cchName, pszVersion, cchVersion);
+    return VMR3ReqPriorityCallWaitU(pUVM, 0 /*idDstCpu*/, (PFNRT)dbgfR3OSQueryNameAndVersion, 5,
+                                    pUVM, pszName, cchName, pszVersion, cchVersion);
 }
 
Index: /trunk/src/VBox/VMM/VMMR3/DBGFStack.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR3/DBGFStack.cpp	(revision 105351)
+++ /trunk/src/VBox/VMM/VMMR3/DBGFStack.cpp	(revision 105352)
@@ -803,8 +803,9 @@
                                                 PCDBGFADDRESS pAddrStack,
                                                 PCDBGFADDRESS pAddrPC,
-                                                RTDBGRETURNTYPE enmReturnType,
+                                                RTDBGRETURNTYPE const *penmReturnType,
                                                 PCDBGFSTACKFRAME *ppFirstFrame)
 {
-    DBGFUNWINDCTX UnwindCtx(pUVM, idCpu, pCtx, hAs);
+    RTDBGRETURNTYPE const enmReturnType = *penmReturnType; /* darwin/arm64 fun, see @bugref{10725} */
+    DBGFUNWINDCTX         UnwindCtx(pUVM, idCpu, pCtx, hAs);
 
     /* alloc first frame. */
@@ -1043,7 +1044,7 @@
             AssertFailedReturn(VERR_INVALID_PARAMETER);
     }
-    return VMR3ReqPriorityCallWaitU(pUVM, idCpu, (PFNRT)dbgfR3StackWalkCtxFull, 10,
-                                    pUVM, idCpu, pCtx, hAs, enmCodeType,
-                                    pAddrFrame, pAddrStack, pAddrPC, enmReturnType, ppFirstFrame);
+    return VMR3ReqPriorityCallWaitU(pUVM, idCpu, (PFNRT)dbgfR3StackWalkCtxFull, 10 | VMREQ_F_EXTRA_ARGS_ALL_PTRS,
+                                    pUVM, idCpu, pCtx, hAs, enmCodeType, pAddrFrame, pAddrStack, pAddrPC,
+                                    &enmReturnType, ppFirstFrame);
 }
 
Index: /trunk/src/VBox/VMM/VMMR3/PDMDevHlp.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR3/PDMDevHlp.cpp	(revision 105351)
+++ /trunk/src/VBox/VMM/VMMR3/PDMDevHlp.cpp	(revision 105352)
@@ -1519,6 +1519,6 @@
 
     PVMREQ pReq;
-    int rc = VMR3ReqCallVU(pDevIns->Internal.s.pVMR3->pUVM, idDstCpu, &pReq, RT_INDEFINITE_WAIT, VMREQFLAGS_VBOX_STATUS | VMREQFLAGS_PRIORITY,
-                           pfnFunction, cArgs, Args);
+    int rc = VMR3ReqCallVU(pDevIns->Internal.s.pVMR3->pUVM, idDstCpu, &pReq, RT_INDEFINITE_WAIT,
+                           VMREQFLAGS_VBOX_STATUS | VMREQFLAGS_PRIORITY, pfnFunction, cArgs, Args);
     if (RT_SUCCESS(rc))
         rc = pReq->iStatus;
Index: /trunk/src/VBox/VMM/VMMR3/PGMPhys.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR3/PGMPhys.cpp	(revision 105351)
+++ /trunk/src/VBox/VMM/VMMR3/PGMPhys.cpp	(revision 105352)
@@ -5552,5 +5552,6 @@
         memcpy(paPhysPageCopy, paPhysPage, cbPhysPage);
 
-        rc = VMR3ReqCallNoWait(pVM, VMCPUID_ANY_QUEUE, (PFNRT)pgmR3PhysChangeMemBalloonHelper, 4, pVM, fInflate, cPages, paPhysPageCopy);
+        rc = VMR3ReqCallNoWait(pVM, VMCPUID_ANY_QUEUE, (PFNRT)pgmR3PhysChangeMemBalloonHelper, 4,
+                               pVM, fInflate, cPages, paPhysPageCopy);
         AssertRC(rc);
     }
Index: /trunk/src/VBox/VMM/VMMR3/VMReq.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR3/VMReq.cpp	(revision 105351)
+++ /trunk/src/VBox/VMM/VMMR3/VMReq.cpp	(revision 105352)
@@ -71,4 +71,7 @@
  * @param   pfnFunction     Pointer to the function to call.
  * @param   cArgs           Number of arguments following in the ellipsis.
+ *                          The max is VMREQ_MAX_ARGS (9) (ARM64/darwin
+ *                          peculiarities), unless VMREQ_F_EXTRA_ARGS_ALL_PTRS
+ *                          is ORed in.
  * @param   ...             Function arguments.
  *
@@ -108,4 +111,7 @@
  * @param   pfnFunction     Pointer to the function to call.
  * @param   cArgs           Number of arguments following in the ellipsis.
+ *                          The max is VMREQ_MAX_ARGS (9) (ARM64/darwin
+ *                          peculiarities), unless VMREQ_F_EXTRA_ARGS_ALL_PTRS
+ *                          is ORed in.
  * @param   ...             Function arguments.
  *
@@ -142,4 +148,7 @@
  * @param   pfnFunction     Pointer to the function to call.
  * @param   cArgs           Number of arguments following in the ellipsis.
+ *                          The max is VMREQ_MAX_ARGS (9) (ARM64/darwin
+ *                          peculiarities), unless VMREQ_F_EXTRA_ARGS_ALL_PTRS
+ *                          is ORed in.
  * @param   ...             Function arguments.
  *
@@ -172,4 +181,7 @@
  * @param   pfnFunction     Pointer to the function to call.
  * @param   cArgs           Number of arguments following in the ellipsis.
+ *                          The max is VMREQ_MAX_ARGS (9) (ARM64/darwin
+ *                          peculiarities), unless VMREQ_F_EXTRA_ARGS_ALL_PTRS
+ *                          is ORed in.
  * @param   ...             Function arguments.
  *
@@ -201,4 +213,7 @@
  * @param   pfnFunction     Pointer to the function to call.
  * @param   cArgs           Number of arguments following in the ellipsis.
+ *                          The max is VMREQ_MAX_ARGS (9) (ARM64/darwin
+ *                          peculiarities), unless VMREQ_F_EXTRA_ARGS_ALL_PTRS
+ *                          is ORed in.
  * @param   ...             Function arguments.
  *
@@ -233,4 +248,7 @@
  * @param   pfnFunction     Pointer to the function to call.
  * @param   cArgs           Number of arguments following in the ellipsis.
+ *                          The max is VMREQ_MAX_ARGS (9) (ARM64/darwin
+ *                          peculiarities), unless VMREQ_F_EXTRA_ARGS_ALL_PTRS
+ *                          is ORed in.
  * @param   ...             Function arguments.
  *
@@ -264,4 +282,7 @@
  * @param   pfnFunction     Pointer to the function to call.
  * @param   cArgs           Number of arguments following in the ellipsis.
+ *                          The max is VMREQ_MAX_ARGS (9) (ARM64/darwin
+ *                          peculiarities), unless VMREQ_F_EXTRA_ARGS_ALL_PTRS
+ *                          is ORed in.
  * @param   ...             Function arguments.
  *
@@ -300,4 +321,7 @@
  * @param   pfnFunction     Pointer to the function to call.
  * @param   cArgs           Number of arguments following in the ellipsis.
+ *                          The max is VMREQ_MAX_ARGS (9) (ARM64/darwin
+ *                          peculiarities), unless VMREQ_F_EXTRA_ARGS_ALL_PTRS
+ *                          is ORed in.
  * @param   ...             Function arguments.
  *
@@ -338,4 +362,7 @@
  * @param   pfnFunction     Pointer to the function to call.
  * @param   cArgs           Number of arguments following in the ellipsis.
+ *                          The max is VMREQ_MAX_ARGS (9) (ARM64/darwin
+ *                          peculiarities), unless VMREQ_F_EXTRA_ARGS_ALL_PTRS
+ *                          is ORed in.
  * @param   ...             Function arguments.
  *
@@ -372,4 +399,7 @@
  * @param   pfnFunction     Pointer to the function to call.
  * @param   cArgs           Number of arguments following in the ellipsis.
+ *                          The max is VMREQ_MAX_ARGS (9) (ARM64/darwin
+ *                          peculiarities), unless VMREQ_F_EXTRA_ARGS_ALL_PTRS
+ *                          is ORed in.
  * @param   ...             Function arguments.
  *
@@ -414,4 +444,7 @@
  * @param   pfnFunction     Pointer to the function to call.
  * @param   cArgs           Number of arguments following in the ellipsis.
+ *                          The max is VMREQ_MAX_ARGS (9) (ARM64/darwin
+ *                          peculiarities), unless VMREQ_F_EXTRA_ARGS_ALL_PTRS
+ *                          is ORed in.
  * @param   ...             Function arguments.
  *
@@ -454,4 +487,7 @@
  * @param   fFlags          A combination of the VMREQFLAGS values.
  * @param   cArgs           Number of arguments following in the ellipsis.
+ *                          The max is VMREQ_MAX_ARGS (9) (ARM64/darwin
+ *                          peculiarities), unless VMREQ_F_EXTRA_ARGS_ALL_PTRS
+ *                          is ORed in.
  *                          Stuff which differs in size from uintptr_t is gonna make trouble, so don't try!
  * @param   Args            Argument vector.
@@ -465,9 +501,17 @@
  *                hosts because 'int' is 32-bit.
  *                Use (void *)NULL or (uintptr_t)0 instead of NULL.
+ *              - The max number of arguments is currently limited to 9, because
+ *                on macOS/arm64 arguments passed on the stack that are 32-bit
+ *                or smaller will not get a full 64-bit stack slot.  So,
+ *                we cannot pretend @a pfnFunction takes a list of @a cArgs
+ *                uintptr_t parameters, unless all parameters above 9 actually
+ *                are more than 32 bits wide.   (This would've kind of worked
+ *                iff the variadict functions didn't use different size round up
+ *                and alignment rules.)  See @bugref{10725}.
  */
 VMMR3DECL(int) VMR3ReqCallVU(PUVM pUVM, VMCPUID idDstCpu, PVMREQ *ppReq, RTMSINTERVAL cMillies, uint32_t fFlags,
                              PFNRT pfnFunction, unsigned cArgs, va_list Args)
 {
-    LogFlow(("VMR3ReqCallV: idDstCpu=%u cMillies=%d fFlags=%#x pfnFunction=%p cArgs=%d\n", idDstCpu, cMillies, fFlags, pfnFunction, cArgs));
+    LogFlow(("VMR3ReqCallV: idDstCpu=%u cMillies=%d fFlags=%#x pfnFunction=%p cArgs=%#x\n", idDstCpu, cMillies, fFlags, pfnFunction, cArgs));
 
     /*
@@ -482,12 +526,16 @@
         *ppReq = NULL;
     }
+    AssertMsgReturn(   cArgs <= VMREQ_MAX_ARGS
+                    || (   (cArgs & VMREQ_F_EXTRA_ARGS_ALL_PTRS)
+                        && (cArgs & ~(unsigned)VMREQ_F_EXTRA_ARGS_ALL_PTRS) <= VMREQ_MAX_ARGS_EXTENDED),
+                    ("cArgs=%#x\n", cArgs),
+                    VERR_TOO_MUCH_DATA);
+    cArgs &= ~(unsigned)VMREQ_F_EXTRA_ARGS_ALL_PTRS;
+
+    /*
+     * Allocate request
+     */
     PVMREQ pReq = NULL;
-    AssertMsgReturn(cArgs * sizeof(uintptr_t) <= sizeof(pReq->u.Internal.aArgs),
-                    ("cArg=%d\n", cArgs),
-                    VERR_TOO_MUCH_DATA);
-
-    /*
-     * Allocate request
-     */
+    AssertCompile(VMREQ_MAX_ARGS_EXTENDED * sizeof(uintptr_t) <= sizeof(pReq->u.Internal.aArgs));
     int rc = VMR3ReqAlloc(pUVM, &pReq, VMREQTYPE_INTERNAL, idDstCpu);
     if (RT_FAILURE(rc))
@@ -497,7 +545,7 @@
      * Initialize the request data.
      */
-    pReq->fFlags         = fFlags;
-    pReq->u.Internal.pfn = pfnFunction;
-    pReq->u.Internal.cArgs = cArgs;
+    pReq->fFlags            = fFlags;
+    pReq->u.Internal.pfn    = pfnFunction;
+    pReq->u.Internal.cArgs  = cArgs;
     for (unsigned iArg = 0; iArg < cArgs; iArg++)
         pReq->u.Internal.aArgs[iArg] = va_arg(Args, uintptr_t);
Index: /trunk/src/VBox/VMM/testcase/tstAnimate.cpp
===================================================================
--- /trunk/src/VBox/VMM/testcase/tstAnimate.cpp	(revision 105351)
+++ /trunk/src/VBox/VMM/testcase/tstAnimate.cpp	(revision 105352)
@@ -848,6 +848,6 @@
             rc = VMR3ReqCallWaitU(pUVM, VMCPUID_ANY, (PFNRT)loadMem, 3, pVM, FileRawMem, &offRawMem);
         else
-            rc = VMR3ReqCallWaitU(pUVM, VMCPUID_ANY, (PFNRT)SSMR3Load,
-                                  7, pVM, pszSavedState, (uintptr_t)NULL /*pStreamOps*/, (uintptr_t)NULL /*pvUser*/,
+            rc = VMR3ReqCallWaitU(pUVM, VMCPUID_ANY, (PFNRT)SSMR3Load, 7,
+                                  pVM, pszSavedState, (uintptr_t)NULL /*pStreamOps*/, (uintptr_t)NULL /*pvUser*/,
                                   SSMAFTER_DEBUG_IT, (uintptr_t)NULL /*pfnProgress*/, (uintptr_t)NULL /*pvProgressUser*/);
         if (RT_SUCCESS(rc))
Index: /trunk/src/VBox/VMM/testcase/tstVMREQ.cpp
===================================================================
--- /trunk/src/VBox/VMM/testcase/tstVMREQ.cpp	(revision 105351)
+++ /trunk/src/VBox/VMM/testcase/tstVMREQ.cpp	(revision 105352)
@@ -330,7 +330,7 @@
     CHECK_ARG_EX(8, uArg8, a_Type); \
     return VINF_SUCCESS; \
-} \
-\
-\
+}
+
+/* The max is now 9. See @bugref{10725}.
 static DECLCALLBACK(int) a_BaseName##_10Args(a_Type uArg0, a_Type uArg1, a_Type uArg2, a_Type uArg3, a_Type uArg4, \
                                              a_Type uArg5, a_Type uArg6, a_Type uArg7, a_Type uArg8, a_Type uArg9) \
@@ -458,5 +458,5 @@
     CHECK_ARG_EX(14, uArg14, a_Type); \
     return VINF_SUCCESS; \
-}
+} */
 
 #if ARCH_BITS == 64
@@ -561,5 +561,5 @@
     cCalled += 1; \
     RTTEST_CHECK(g_hTest, g_cCalled == cCalled); \
-    \
+/* The max is now 9. See @bugref{10725}.
     rc = VMR3ReqCallWaitU(pUVM, VMCPUID_ANY, (PFNRT)a_CallbackBaseName##_10Args, 10, \
                           a_fnRandArg(a_Type, 0), a_fnRandArg(a_Type, 1), a_fnRandArg(a_Type, 2), a_fnRandArg(a_Type, 3), \
@@ -611,5 +611,5 @@
     RTTEST_CHECK_RC(g_hTest, rc, VINF_SUCCESS); \
     cCalled += 1; \
-    RTTEST_CHECK(g_hTest, g_cCalled == cCalled)
+    RTTEST_CHECK(g_hTest, g_cCalled == cCalled) */
 
 
Index: /trunk/src/bldprogs/VBoxCompilerPlugInsGcc.cpp
===================================================================
--- /trunk/src/bldprogs/VBoxCompilerPlugInsGcc.cpp	(revision 105351)
+++ /trunk/src/bldprogs/VBoxCompilerPlugInsGcc.cpp	(revision 105352)
@@ -244,5 +244,5 @@
 
 /** Attribute specifications. */
-static const struct attribute_spec g_AttribSpecs[] =
+static const struct attribute_spec g_aAttribSpecs[] =
 {
     {
@@ -809,6 +809,6 @@
     dprintf("RegisterAttributesEvent: pvEventData=%p\n", pvEventData);
 
-    register_attribute(&g_AttribSpecs[0]);
-    register_attribute(&g_AttribSpecs[1]);
+    for (unsigned i = 0; i < RT_ELEMENTS(g_aAttribSpecs); i++)
+        register_attribute(&g_aAttribSpecs[i]);
 }
 
