Index: /trunk/src/VBox/Devices/Graphics/DevVGA.h
===================================================================
--- /trunk/src/VBox/Devices/Graphics/DevVGA.h	(revision 49433)
+++ /trunk/src/VBox/Devices/Graphics/DevVGA.h	(revision 49434)
@@ -434,5 +434,5 @@
 
     struct {
-        uint32_t cPending;
+        volatile uint32_t cPending;
         uint32_t Padding1;
         union
Index: /trunk/src/VBox/Devices/Graphics/DevVGA_VBVA.cpp
===================================================================
--- /trunk/src/VBox/Devices/Graphics/DevVGA_VBVA.cpp	(revision 49433)
+++ /trunk/src/VBox/Devices/Graphics/DevVGA_VBVA.cpp	(revision 49434)
@@ -813,8 +813,11 @@
 static void vbvaVHWACommandCompleteAllPending(PVGASTATE pVGAState, int rc)
 {
-    if (!pVGAState->pendingVhwaCommands.cPending)
+    if (!ASMAtomicUoReadU32(&pVGAState->pendingVhwaCommands.cPending))
         return;
 
     VBOX_VHWA_PENDINGCMD *pIter, *pNext;
+
+    PDMCritSectEnter(&pVGAState->lock, VERR_SEM_BUSY);
+
     RTListForEachSafe(&pVGAState->pendingVhwaCommands.PendingList, pIter, pNext, VBOX_VHWA_PENDINGCMD, Node)
     {
@@ -824,21 +827,28 @@
         /* the command is submitted/processed, remove from the pend list */
         RTListNodeRemove(&pIter->Node);
-        --pVGAState->pendingVhwaCommands.cPending;
+        ASMAtomicDecU32(&pVGAState->pendingVhwaCommands.cPending);
         RTMemFree(pIter);
     }
-}
-
-static void vbvaVHWACommandCClearAllPending(PVGASTATE pVGAState)
-{
-    if (!pVGAState->pendingVhwaCommands.cPending)
+
+    PDMCritSectLeave(&pVGAState->lock);
+}
+
+static void vbvaVHWACommandClearAllPending(PVGASTATE pVGAState)
+{
+    if (!ASMAtomicUoReadU32(&pVGAState->pendingVhwaCommands.cPending))
         return;
 
     VBOX_VHWA_PENDINGCMD *pIter, *pNext;
+
+    PDMCritSectEnter(&pVGAState->lock, VERR_SEM_BUSY);
+
     RTListForEachSafe(&pVGAState->pendingVhwaCommands.PendingList, pIter, pNext, VBOX_VHWA_PENDINGCMD, Node)
     {
         RTListNodeRemove(&pIter->Node);
-        --pVGAState->pendingVhwaCommands.cPending;
+        ASMAtomicDecU32(&pVGAState->pendingVhwaCommands.cPending);
         RTMemFree(pIter);
     }
+
+    PDMCritSectLeave(&pVGAState->lock);
 }
 
@@ -847,5 +857,5 @@
     int rc = VERR_BUFFER_OVERFLOW;
 
-    if (pVGAState->pendingVhwaCommands.cPending < VBOX_VHWA_MAX_PENDING_COMMANDS)
+    if (ASMAtomicUoReadU32(&pVGAState->pendingVhwaCommands.cPending) < VBOX_VHWA_MAX_PENDING_COMMANDS)
     {
         VBOX_VHWA_PENDINGCMD *pPend = (VBOX_VHWA_PENDINGCMD*)RTMemAlloc(sizeof (*pPend));
@@ -854,7 +864,15 @@
             pCommand->Flags |= VBOXVHWACMD_FLAG_HG_ASYNCH;
             pPend->pCommand = pCommand;
-            RTListAppend(&pVGAState->pendingVhwaCommands.PendingList, &pPend->Node);
-            ++pVGAState->pendingVhwaCommands.cPending;
-            return;
+            PDMCritSectEnter(&pVGAState->lock, VERR_SEM_BUSY);
+            if (ASMAtomicUoReadU32(&pVGAState->pendingVhwaCommands.cPending) < VBOX_VHWA_MAX_PENDING_COMMANDS)
+            {
+                RTListAppend(&pVGAState->pendingVhwaCommands.PendingList, &pPend->Node);
+                ASMAtomicIncU32(&pVGAState->pendingVhwaCommands.cPending);
+                PDMCritSectLeave(&pVGAState->lock);
+                return;
+            }
+            PDMCritSectLeave(&pVGAState->lock);
+            LogRel(("Pending command count has reached its threshold.. completing them all.."));
+            RTMemFree(pPend);
         }
         else
@@ -862,7 +880,5 @@
     }
     else
-    {
         LogRel(("Pending command count has reached its threshold, completing them all.."));
-    }
 
     vbvaVHWACommandCompleteAllPending(pVGAState, rc);
@@ -973,18 +989,26 @@
 static bool vbvaVHWACheckPendingCommands(PVGASTATE pVGAState)
 {
-    if (!pVGAState->pendingVhwaCommands.cPending)
+    if (!ASMAtomicUoReadU32(&pVGAState->pendingVhwaCommands.cPending))
         return true;
 
     VBOX_VHWA_PENDINGCMD *pIter, *pNext;
+
+    PDMCritSectEnter(&pVGAState->lock, VERR_SEM_BUSY);
+
     RTListForEachSafe(&pVGAState->pendingVhwaCommands.PendingList, pIter, pNext, VBOX_VHWA_PENDINGCMD, Node)
     {
         if (!vbvaVHWACommandSubmit(pVGAState, pIter->pCommand, true))
+        {
+            PDMCritSectLeave(&pVGAState->lock);
             return false; /* the command should be pended still */
+        }
 
         /* the command is submitted/processed, remove from the pend list */
         RTListNodeRemove(&pIter->Node);
-        --pVGAState->pendingVhwaCommands.cPending;
+        ASMAtomicDecU32(&pVGAState->pendingVhwaCommands.cPending);
         RTMemFree(pIter);
     }
+
+    PDMCritSectLeave(&pVGAState->lock);
 
     return true;
@@ -1045,4 +1069,5 @@
     pVGAState->pendingVhwaCommands.cPending = 0;
     RTListInit(&pVGAState->pendingVhwaCommands.PendingList);
+
     VBOXVHWACMD *pCmd = vbvaVHWAHHCommandCreate(pVGAState, VBOXVHWACMD_TYPE_HH_CONSTRUCT, 0, sizeof(VBOXVHWACMD_HH_CONSTRUCT));
     Assert(pCmd);
@@ -1098,5 +1123,5 @@
 int vbvaVHWAReset (PVGASTATE pVGAState)
 {
-    vbvaVHWACommandCClearAllPending(pVGAState);
+    vbvaVHWACommandClearAllPending(pVGAState);
 
     /* ensure we have all pending cmds processed and h->g cmds disabled */
