Index: /trunk/src/VBox/VMM/VMMAll/IEMAll.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/IEMAll.cpp	(revision 47290)
+++ /trunk/src/VBox/VMM/VMMAll/IEMAll.cpp	(revision 47291)
@@ -3583,5 +3583,5 @@
 DECLINLINE(RTGCPTR) iemRegGetEffRsp(PCCPUMCTX pCtx)
 {
-    if (pCtx->ss.Attr.n.u1Long)
+    if (pCtx->ss.Attr.n.u1Long || pCtx->ss.Attr.n.u1Unusable)
         return pCtx->rsp;
     if (pCtx->ss.Attr.n.u1DefBig)
@@ -3641,5 +3641,5 @@
 DECLINLINE(void) iemRegAddToRsp(PCPUMCTX pCtx, uint8_t cbToAdd)
 {
-    if (pCtx->ss.Attr.n.u1Long)
+    if (pCtx->ss.Attr.n.u1Long || pCtx->ss.Attr.n.u1Unusable)
         pCtx->rsp += cbToAdd;
     else if (pCtx->ss.Attr.n.u1DefBig)
@@ -3659,5 +3659,5 @@
 DECLINLINE(void) iemRegSubFromRsp(PCPUMCTX pCtx, uint8_t cbToSub)
 {
-    if (pCtx->ss.Attr.n.u1Long)
+    if (pCtx->ss.Attr.n.u1Long || pCtx->ss.Attr.n.u1Unusable)
         pCtx->rsp -= cbToSub;
     else if (pCtx->ss.Attr.n.u1DefBig)
@@ -3677,5 +3677,5 @@
 DECLINLINE(void) iemRegAddToRspEx(PRTUINT64U pTmpRsp, uint16_t cbToAdd, PCCPUMCTX pCtx)
 {
-    if (pCtx->ss.Attr.n.u1Long)
+    if (pCtx->ss.Attr.n.u1Long || pCtx->ss.Attr.n.u1Unusable)
         pTmpRsp->u           += cbToAdd;
     else if (pCtx->ss.Attr.n.u1DefBig)
@@ -3697,5 +3697,5 @@
 DECLINLINE(void) iemRegSubFromRspEx(PRTUINT64U pTmpRsp, uint16_t cbToSub, PCCPUMCTX pCtx)
 {
-    if (pCtx->ss.Attr.n.u1Long)
+    if (pCtx->ss.Attr.n.u1Long || pCtx->ss.Attr.n.u1Unusable)
         pTmpRsp->u          -= cbToSub;
     else if (pCtx->ss.Attr.n.u1DefBig)
@@ -3721,5 +3721,5 @@
     uTmpRsp.u = pCtx->rsp;
 
-    if (pCtx->ss.Attr.n.u1Long)
+    if (pCtx->ss.Attr.n.u1Long || pCtx->ss.Attr.n.u1Unusable)
         GCPtrTop = uTmpRsp.u            -= cbItem;
     else if (pCtx->ss.Attr.n.u1DefBig)
@@ -3747,5 +3747,5 @@
     uTmpRsp.u = pCtx->rsp;
 
-    if (pCtx->ss.Attr.n.u1Long)
+    if (pCtx->ss.Attr.n.u1Long || pCtx->ss.Attr.n.u1Unusable)
     {
         GCPtrTop = uTmpRsp.u;
@@ -3780,5 +3780,5 @@
     RTGCPTR GCPtrTop;
 
-    if (pCtx->ss.Attr.n.u1Long)
+    if (pCtx->ss.Attr.n.u1Long || pCtx->ss.Attr.n.u1Unusable)
         GCPtrTop = pTmpRsp->u          -= cbItem;
     else if (pCtx->ss.Attr.n.u1DefBig)
@@ -3802,5 +3802,5 @@
 {
     RTGCPTR GCPtrTop;
-    if (pCtx->ss.Attr.n.u1Long)
+    if (pCtx->ss.Attr.n.u1Long || pCtx->ss.Attr.n.u1Unusable)
     {
         GCPtrTop = pTmpRsp->u;
@@ -8545,5 +8545,5 @@
             iemVerifyAssertRecord(pIemCpu, pIemRec, "Extra IEM record!");
         else if (pOtherRec != NULL)
-            iemVerifyAssertRecord(pIemCpu, pIemRec, "Extra Other record!");
+            iemVerifyAssertRecord(pIemCpu, pOtherRec, "Extra Other record!");
     }
     pIemCpu->CTX_SUFF(pCtx) = pOrgCtx;
Index: /trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp.h
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp.h	(revision 47290)
+++ /trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp.h	(revision 47291)
@@ -3347,5 +3347,5 @@
      */
     void *pvDesc;
-    rcStrict = iemMemMap(pIemCpu, &pvDesc, 8, UINT8_MAX, pCtx->gdtr.pGdt, IEM_ACCESS_DATA_RW);
+    rcStrict = iemMemMap(pIemCpu, &pvDesc, 8, UINT8_MAX, pCtx->gdtr.pGdt + (uNewTr & X86_SEL_MASK_OFF_RPL), IEM_ACCESS_DATA_RW);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
Index: /trunk/src/VBox/VMM/VMMAll/IEMAllInstructions.cpp.h
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/IEMAllInstructions.cpp.h	(revision 47290)
+++ /trunk/src/VBox/VMM/VMMAll/IEMAllInstructions.cpp.h	(revision 47291)
@@ -130,5 +130,6 @@
                 IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU32, pu32Dst, u32Src, pEFlags);
 
-                IEM_MC_CLEAR_HIGH_GREG_U64_BY_REF(pu32Dst);
+                if (pImpl != &g_iemAImpl_test)
+                    IEM_MC_CLEAR_HIGH_GREG_U64_BY_REF(pu32Dst);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -483,5 +484,6 @@
             IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU32, pu32Dst, u32Src, pEFlags);
 
-            IEM_MC_CLEAR_HIGH_GREG_U64_BY_REF(pu32Dst);
+            if (pImpl != &g_iemAImpl_test)
+                IEM_MC_CLEAR_HIGH_GREG_U64_BY_REF(pu32Dst);
             IEM_MC_ADVANCE_RIP();
             IEM_MC_END();
@@ -15662,5 +15664,5 @@
     else
     {
-        /* The new RIP is taken from a register. */
+        /* The new RIP is taken from a memory location. */
         switch (pIemCpu->enmEffOpSize)
         {
@@ -15687,9 +15689,9 @@
             case IEMMODE_64BIT:
                 IEM_MC_BEGIN(0, 2);
-                IEM_MC_LOCAL(uint32_t, u32Target);
+                IEM_MC_LOCAL(uint64_t, u64Target);
                 IEM_MC_LOCAL(RTGCPTR, GCPtrEffSrc);
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffSrc, bRm, 0);
-                IEM_MC_FETCH_MEM_U32(u32Target, pIemCpu->iEffSeg, GCPtrEffSrc);
-                IEM_MC_SET_RIP_U32(u32Target);
+                IEM_MC_FETCH_MEM_U64(u64Target, pIemCpu->iEffSeg, GCPtrEffSrc);
+                IEM_MC_SET_RIP_U64(u64Target);
                 IEM_MC_END()
                 return VINF_SUCCESS;
