Index: trunk/src/VBox/VMM/REMInternal.h
===================================================================
--- trunk/src/VBox/VMM/REMInternal.h	(revision 20746)
+++ trunk/src/VBox/VMM/REMInternal.h	(revision 20747)
@@ -110,5 +110,7 @@
     uint32_t                    idxSelf;
     uint32_t volatile           idxNext;
-} REMHANDLERNOTIFICATION, *PREMHANDLERNOTIFICATION;
+} REMHANDLERNOTIFICATION;
+/** Pointer to a handler notification record. */
+typedef REMHANDLERNOTIFICATION *PREMHANDLERNOTIFICATION;
 
 /**
Index: trunk/src/VBox/VMM/VMMAll/REMAll.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMAll/REMAll.cpp	(revision 20746)
+++ trunk/src/VBox/VMM/VMMAll/REMAll.cpp	(revision 20747)
@@ -93,9 +93,10 @@
 static void remNotifyHandlerInsert(PVM pVM, PREMHANDLERNOTIFICATION pRec)
 {
-    uint32_t idxFree;
-    uint32_t idxNext;
+    /*
+     * Fetch a free record.
+     */
+    uint32_t                cFlushes = 0;
+    uint32_t                idxFree;
     PREMHANDLERNOTIFICATION pFree;
-
-    /* Fetch a free record. */
     do
     {
@@ -103,23 +104,25 @@
         if (idxFree == (uint32_t)-1)
         {
-            pFree = NULL;
-            break;
+            do
+            {
+                Assert(cFlushes++ != 128);
+                AssertFatal(cFlushes < _1M);
+                remFlushHandlerNotifications(pVM);
+                idxFree = ASMAtomicUoReadU32(&pVM->rem.s.idxFreeList);
+            } while (idxFree == (uint32_t)-1);
         }
         pFree = &pVM->rem.s.aHandlerNotifications[idxFree];
     } while (!ASMAtomicCmpXchgU32(&pVM->rem.s.idxFreeList, pFree->idxNext, idxFree));
 
-    if (!pFree)
-    {
-        remFlushHandlerNotifications(pVM);
-        /** @todo why are we dropping the pReq here without a fight? If we can drop
-         *        one, we can drop all... */
-        return;
-    }
-
-    /* Copy the record. */
-    *pFree = *pRec;
-    pFree->idxSelf = idxFree; /* was trashed */
-
-    /* Insert it into the pending list. */
+    /*
+     * Copy the record.
+     */
+    pFree->enmKind = pRec->enmKind;
+    pFree->u = pRec->u;
+
+    /*
+     * Insert it into the pending list.
+     */
+    uint32_t idxNext;
     do
     {
Index: trunk/src/VBox/VMM/testcase/tstVMStructGC.cpp
===================================================================
--- trunk/src/VBox/VMM/testcase/tstVMStructGC.cpp	(revision 20746)
+++ trunk/src/VBox/VMM/testcase/tstVMStructGC.cpp	(revision 20747)
@@ -739,4 +739,25 @@
     GEN_CHECK_OFF(REM, Env);
 
+    GEN_CHECK_SIZE(REMHANDLERNOTIFICATION);
+    GEN_CHECK_OFF(REMHANDLERNOTIFICATION, enmKind);
+    GEN_CHECK_OFF(REMHANDLERNOTIFICATION, u);
+    GEN_CHECK_OFF(REMHANDLERNOTIFICATION, u.PhysicalRegister.GCPhys);
+    GEN_CHECK_OFF(REMHANDLERNOTIFICATION, u.PhysicalRegister.cb);
+    GEN_CHECK_OFF(REMHANDLERNOTIFICATION, u.PhysicalRegister.enmType);
+    GEN_CHECK_OFF(REMHANDLERNOTIFICATION, u.PhysicalRegister.fHasHCHandler);
+    GEN_CHECK_OFF(REMHANDLERNOTIFICATION, u.PhysicalDeregister.GCPhys);
+    GEN_CHECK_OFF(REMHANDLERNOTIFICATION, u.PhysicalDeregister.cb);
+    GEN_CHECK_OFF(REMHANDLERNOTIFICATION, u.PhysicalDeregister.enmType);
+    GEN_CHECK_OFF(REMHANDLERNOTIFICATION, u.PhysicalDeregister.fHasHCHandler);
+    GEN_CHECK_OFF(REMHANDLERNOTIFICATION, u.PhysicalDeregister.fRestoreAsRAM);
+    GEN_CHECK_OFF(REMHANDLERNOTIFICATION, u.PhysicalModify.GCPhysOld);
+    GEN_CHECK_OFF(REMHANDLERNOTIFICATION, u.PhysicalModify.GCPhysNew);
+    GEN_CHECK_OFF(REMHANDLERNOTIFICATION, u.PhysicalModify.cb);
+    GEN_CHECK_OFF(REMHANDLERNOTIFICATION, u.PhysicalModify.enmType);
+    GEN_CHECK_OFF(REMHANDLERNOTIFICATION, u.PhysicalModify.fHasHCHandler);
+    GEN_CHECK_OFF(REMHANDLERNOTIFICATION, u.PhysicalModify.fRestoreAsRAM);
+    GEN_CHECK_OFF(REMHANDLERNOTIFICATION, idxSelf);
+    GEN_CHECK_OFF(REMHANDLERNOTIFICATION, idxNext);
+
     GEN_CHECK_SIZE(SELM);
     GEN_CHECK_OFF(SELM, offVM);
Index: trunk/src/VBox/VMM/testcase/tstVMStructSize.cpp
===================================================================
--- trunk/src/VBox/VMM/testcase/tstVMStructSize.cpp	(revision 20746)
+++ trunk/src/VBox/VMM/testcase/tstVMStructSize.cpp	(revision 20747)
@@ -278,10 +278,14 @@
     CHECK_MEMBER_ALIGNMENT(PGMMMIO2RANGE, RamRange, 16);
 
-    /* misc */
+    /* rem */
     CHECK_MEMBER_ALIGNMENT(REM, aGCPtrInvalidatedPages, 8);
-    CHECK_PADDING3(EMCPU, u.FatalLongJump, u.achPaddingFatalLongJump);
     CHECK_PADDING3(REMHANDLERNOTIFICATION, u.PhysicalRegister, u.padding);
     CHECK_PADDING3(REMHANDLERNOTIFICATION, u.PhysicalDeregister, u.padding);
     CHECK_PADDING3(REMHANDLERNOTIFICATION, u.PhysicalModify, u.padding);
+    CHECK_SIZE_ALIGNMENT(REMHANDLERNOTIFICATION, 8);
+    CHECK_MEMBER_ALIGNMENT(REMHANDLERNOTIFICATION, u.PhysicalDeregister.GCPhys, 8);
+
+    /* misc */
+    CHECK_PADDING3(EMCPU, u.FatalLongJump, u.achPaddingFatalLongJump);
     CHECK_SIZE_ALIGNMENT(VMMR0JMPBUF, 8);
     CHECK_SIZE_ALIGNMENT(PATCHINFO, 8);
