Index: trunk/src/VBox/VMM/VMMAll/PGMAllBth.h
===================================================================
--- trunk/src/VBox/VMM/VMMAll/PGMAllBth.h	(revision 23249)
+++ trunk/src/VBox/VMM/VMMAll/PGMAllBth.h	(revision 23250)
@@ -2250,5 +2250,5 @@
                     PGM_INVL_BIG_PG(pVCpu, GCPtrPage);
                     STAM_PROFILE_STOP(&pVCpu->pgm.s.CTX_MID_Z(Stat,DirtyBitTracking), a);
-                    return VINF_PGM_HANDLED_DIRTY_BIT_FAULT;
+                    return VINF_PGM_HANDLED_DIRTY_BIT_FAULT;    /* restarts the instruction. */
                 }
 # ifdef IN_RING0
@@ -2272,5 +2272,5 @@
 
                             STAM_PROFILE_STOP(&pVCpu->pgm.s.CTX_MID_Z(Stat,DirtyBitTracking), a);
-                            return VINF_PGM_HANDLED_DIRTY_BIT_FAULT;
+                            return VINF_PGM_HANDLED_DIRTY_BIT_FAULT;    /* restarts the instruction. */
                         }
                     }
@@ -2369,11 +2369,8 @@
                         if (pPteDst->u & PGM_PTFLAGS_TRACK_DIRTY)
                         {
+                            PPGMPAGE pPage = pgmPhysGetPage(&pVM->pgm.s, pPteSrc->u & GST_PTE_PG_MASK);
+
                             LogFlow(("DIRTY page trap addr=%RGv\n", GCPtrPage));
-#  ifdef VBOX_STRICT
-                            PPGMPAGE pPage = pgmPhysGetPage(&pVM->pgm.s, pPteSrc->u & GST_PTE_PG_MASK);
-                            if (pPage)
-                                AssertMsg(!PGM_PAGE_HAS_ACTIVE_HANDLERS(pPage),
-                                        ("Unexpected dirty bit tracking on monitored page %RGv (phys %RGp)!!!!!!\n", GCPtrPage, pPteSrc->u & X86_PTE_PAE_PG_MASK));
-#  endif
+
                             STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_MID_Z(Stat,DirtyPageTrap));
 
@@ -2383,5 +2380,13 @@
                              *       fault again and take this path to only invalidate the entry.
                              */
-                            pPteDst->n.u1Write    = 1;
+                            if (    pPage
+                                &&  PGM_PAGE_HAS_ACTIVE_HANDLERS(pPage))
+                            {
+                                /* Assuming write handlers here as the PTE is present (otherwise it wouldn't be). */
+                                pPteDst->n.u1Write    = 0;
+                            }
+                            else
+                                pPteDst->n.u1Write    = 1;
+
                             pPteDst->n.u1Dirty    = 1;
                             pPteDst->n.u1Accessed = 1;
@@ -2390,5 +2395,5 @@
 
                             STAM_PROFILE_STOP(&pVCpu->pgm.s.CTX_MID_Z(Stat,DirtyBitTracking), a);
-                            return VINF_PGM_HANDLED_DIRTY_BIT_FAULT;
+                            return VINF_PGM_HANDLED_DIRTY_BIT_FAULT;    /* restarts the instruction. */
                         }
 # ifdef IN_RING0
@@ -2404,5 +2409,5 @@
 
                             STAM_PROFILE_STOP(&pVCpu->pgm.s.CTX_MID_Z(Stat,DirtyBitTracking), a);
-                            return VINF_PGM_HANDLED_DIRTY_BIT_FAULT;
+                            return VINF_PGM_HANDLED_DIRTY_BIT_FAULT;    /* restarts the instruction. */
                         }
 # endif
Index: trunk/src/VBox/VMM/VMMAll/PGMAllPool.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMAll/PGMAllPool.cpp	(revision 23249)
+++ trunk/src/VBox/VMM/VMMAll/PGMAllPool.cpp	(revision 23250)
@@ -3197,4 +3197,7 @@
                     Log4(("pgmPoolTrackFlushGCPhysPTs: i=%d pte=%RX32 cRefs=%#x\n", i, pPT->a[i], cRefs));
                     pPT->a[i].u = (pPT->a[i].u & u32AndMask) | u32OrMask;
+                    if (pPT->a[i].u & PGM_PTFLAGS_TRACK_DIRTY)
+                        pPT->a[i].n.u1Write = 0;    /* need to disallow writes when dirty bit tracking is still active. */
+
                     cRefs--;
                     if (!cRefs)
@@ -3257,4 +3260,7 @@
                     Log4(("pgmPoolTrackFlushGCPhysPTs: i=%d pte=%RX64 cRefs=%#x\n", i, pPT->a[i], cRefs));
                     pPT->a[i].u = (pPT->a[i].u & u64AndMask) | u64OrMask;
+                    if (pPT->a[i].u & PGM_PTFLAGS_TRACK_DIRTY)
+                        pPT->a[i].n.u1Write = 0;    /* need to disallow writes when dirty bit tracking is still active. */
+
                     cRefs--;
                     if (!cRefs)
