Index: /trunk/src/recompiler/VBoxRecompiler.c
===================================================================
--- /trunk/src/recompiler/VBoxRecompiler.c	(revision 47708)
+++ /trunk/src/recompiler/VBoxRecompiler.c	(revision 47709)
@@ -4614,4 +4614,5 @@
     uint32_t u32 = 0;
     int rc = IOMIOPortRead(env->pVM, env->pVCpu, (RTIOPORT)addr, &u32, 1);
+if (addr == 0x01f0) RTLogPrintf("ins: %#06x -> %#04x %d\n", addr, u32, rc);
     if (RT_LIKELY(rc == VINF_SUCCESS))
     {
@@ -4634,4 +4635,5 @@
     uint32_t u32 = 0;
     int rc = IOMIOPortRead(env->pVM, env->pVCpu, (RTIOPORT)addr, &u32, 2);
+if (addr == 0x01f0) RTLogPrintf("ins: %#06x -> %#06x %d\n", addr, u32, rc);
     if (RT_LIKELY(rc == VINF_SUCCESS))
     {
@@ -4653,4 +4655,5 @@
     uint32_t u32 = 0;
     int rc = IOMIOPortRead(env->pVM, env->pVCpu, (RTIOPORT)addr, &u32, 4);
+if (addr == 0x01f0) RTLogPrintf("ins: %#06x -> %#010x %d\n", addr, u32, rc);
     if (RT_LIKELY(rc == VINF_SUCCESS))
     {
Index: /trunk/src/recompiler/target-i386/cpu.h
===================================================================
--- /trunk/src/recompiler/target-i386/cpu.h	(revision 47708)
+++ /trunk/src/recompiler/target-i386/cpu.h	(revision 47709)
@@ -117,5 +117,6 @@
 #define DESC_TSS_BUSY_MASK (1 << 9)
 #ifdef VBOX
-# define DESC_INTEL_UNUSABLE    RT_BIT_32(16+8) /**< Internal VT-x bit for NULL sectors. */
+# define DESC_INTEL_UNUSABLE    RT_BIT_32(16+8)      /**< Internal VT-x bit for NULL sectors. */
+# define DESC_RAW_FLAG_BITS     UINT32_C(0x00ffffff) /**< Flag bits we load from the descriptor. */
 #endif
 
@@ -934,4 +935,5 @@
 /* this function must always be used to load data in the segment
    cache: it synchronizes the hflags with the segment cache values */
+#ifndef VBOX
 static inline void cpu_x86_load_seg_cache(CPUX86State *env,
                                           int seg_reg, unsigned int selector,
@@ -939,4 +941,11 @@
                                           unsigned int limit,
                                           unsigned int flags)
+#else
+static inline void cpu_x86_load_seg_cache_with_clean_flags(CPUX86State *env,
+                                                           int seg_reg, unsigned int selector,
+                                                           target_ulong base,
+                                                           unsigned int limit,
+                                                           unsigned int flags)
+#endif
 {
     SegmentCache *sc;
@@ -947,17 +956,6 @@
     sc->base = base;
     sc->limit = limit;
-#ifndef VBOX
     sc->flags = flags;
-#else
-    if (flags & DESC_P_MASK)
-    {
-        flags |= DESC_A_MASK;           /* Make sure the A bit is set to avoid trouble. */
-        flags &= ~DESC_INTEL_UNUSABLE;
-    }
-    else if (selector < 4U)
-        flags |= DESC_INTEL_UNUSABLE;
-    else
-        flags &= ~DESC_INTEL_UNUSABLE;
-    sc->flags = flags;
+#ifdef VBOX
     sc->newselector = 0;
     sc->fVBoxFlags  = CPUMSELREG_FLAGS_VALID;
@@ -1006,4 +1004,21 @@
 }
 
+#ifdef VBOX
+/* Raw input, adjust the flags adding the stupid intel flag when applicable. */
+static inline void cpu_x86_load_seg_cache(CPUX86State *env,
+                                          int seg_reg, unsigned int selector,
+                                          target_ulong base,
+                                          unsigned int limit,
+                                          unsigned int flags)
+{
+    flags &= DESC_RAW_FLAG_BITS;
+    if (flags & DESC_P_MASK)
+        flags |= DESC_A_MASK;           /* Make sure the A bit is set to avoid trouble. */
+    else if (selector < 4U)
+        flags |= DESC_INTEL_UNUSABLE;
+    cpu_x86_load_seg_cache_with_clean_flags(env, seg_reg, selector, base, limit, flags);
+}
+#endif
+
 static inline void cpu_x86_load_seg_cache_sipi(CPUX86State *env,
                                                int sipi_vector)
Index: /trunk/src/recompiler/target-i386/op_helper.c
===================================================================
--- /trunk/src/recompiler/target-i386/op_helper.c	(revision 47708)
+++ /trunk/src/recompiler/target-i386/op_helper.c	(revision 47709)
@@ -272,7 +272,8 @@
     sc->base = get_seg_base(e1, e2);
     sc->limit = get_seg_limit(e1, e2);
+#ifndef VBOX
     sc->flags = e2;
-#ifdef VBOX
-    sc->flags &= ~DESC_INTEL_UNUSABLE;
+#else
+    sc->flags = e2 & DESC_RAW_FLAG_BITS;
     sc->newselector = 0;
     sc->fVBoxFlags  = CPUMSELREG_FLAGS_VALID;
@@ -2583,5 +2584,5 @@
         env->tr.limit = 0;
         env->tr.flags = 0;
-#ifdef VBOX
+#ifdef VBOX /** @todo can TR really be 0? If so, what're the hidden attributes? */
         env->tr.flags = DESC_INTEL_UNUSABLE;
         env->tr.fVBoxFlags  = CPUMSELREG_FLAGS_VALID;
@@ -2677,5 +2678,5 @@
             e2 = DESC_INTEL_UNUSABLE;
         }
-        cpu_x86_load_seg_cache(env, seg_reg, selector, 0, 0, e2);
+        cpu_x86_load_seg_cache_with_clean_flags(env, seg_reg, selector, 0, 0, e2);
 #endif
     } else {
@@ -3355,7 +3356,7 @@
                 if (!(e2 & DESC_A_MASK))
                     e2 = set_segment_accessed(new_cs, e2);
-                cpu_x86_load_seg_cache(env, R_SS, new_ss,
-                                       0, 0xffffffff,
-                                       DESC_INTEL_UNUSABLE | (rpl << DESC_DPL_SHIFT) );
+                cpu_x86_load_seg_cache_with_clean_flags(env, R_SS, new_ss,
+                                                        0, 0xffffffff,
+                                                        DESC_INTEL_UNUSABLE | (rpl << DESC_DPL_SHIFT) );
                 ss_e2 = DESC_B_MASK; /* not really used */
             } else
