Index: trunk/src/VBox/Runtime/r0drv/nt/initterm-r0drv-nt.cpp
===================================================================
--- trunk/src/VBox/Runtime/r0drv/nt/initterm-r0drv-nt.cpp	(revision 70150)
+++ trunk/src/VBox/Runtime/r0drv/nt/initterm-r0drv-nt.cpp	(revision 70151)
@@ -117,4 +117,9 @@
 uint32_t                                g_uRtNtBuildNo;
 
+/** Pointer to the MmHighestUserAddress kernel variable - can be NULL. */
+uintptr_t const                        *g_puRtMmHighestUserAddress;
+/** Pointer to the MmSystemRangeStart kernel variable - can be NULL. */
+uintptr_t const                        *g_puRtMmSystemRangeStart;
+
 
 /**
@@ -288,4 +293,7 @@
     g_pfnrtHalRequestIpiW7Plus = (PFNHALREQUESTIPI_W7PLUS)RTR0DbgKrnlInfoGetSymbol(hKrnlInfo, NULL, "HalRequestIpi");
     g_pfnrtHalRequestIpiPreW7 = (PFNHALREQUESTIPI_PRE_W7)g_pfnrtHalRequestIpiW7Plus;
+
+    g_puRtMmHighestUserAddress = (uintptr_t const *)RTR0DbgKrnlInfoGetSymbol(hKrnlInfo, NULL, "MmHighestUserAddress");
+    g_puRtMmSystemRangeStart   = (uintptr_t const *)RTR0DbgKrnlInfoGetSymbol(hKrnlInfo, NULL, "MmSystemRangeStart");
 
     RTR0DbgKrnlInfoRelease(hKrnlInfo);
Index: trunk/src/VBox/Runtime/r0drv/nt/internal-r0drv-nt.h
===================================================================
--- trunk/src/VBox/Runtime/r0drv/nt/internal-r0drv-nt.h	(revision 70150)
+++ trunk/src/VBox/Runtime/r0drv/nt/internal-r0drv-nt.h	(revision 70151)
@@ -101,4 +101,7 @@
 extern uint32_t                                g_uRtNtBuildNo;
 
+extern uintptr_t const                        *g_puRtMmHighestUserAddress;
+extern uintptr_t const                        *g_puRtMmSystemRangeStart;
+
 
 int __stdcall rtMpPokeCpuUsingDpc(RTCPUID idCpu);
Index: trunk/src/VBox/Runtime/r0drv/nt/memuserkernel-r0drv-nt.cpp
===================================================================
--- trunk/src/VBox/Runtime/r0drv/nt/memuserkernel-r0drv-nt.cpp	(revision 70150)
+++ trunk/src/VBox/Runtime/r0drv/nt/memuserkernel-r0drv-nt.cpp	(revision 70151)
@@ -34,4 +34,6 @@
 #include <iprt/err.h>
 
+#include "internal-r0drv-nt.h"
+
 
 RTR0DECL(int) RTR0MemUserCopyFrom(void *pvDst, RTR3PTR R3PtrSrc, size_t cb)
@@ -68,9 +70,9 @@
 {
 #ifdef IPRT_TARGET_NT4
-    /* Play safe+wrong... it used to be a constant, but in w2k+ is a variable. */
-    return R3Ptr < _2G;
+    uintptr_t const uLast = g_puRtMmHighestUserAddress ? *g_puRtMmHighestUserAddress : ~(uintptr_t)0 / 2;
 #else
-    return R3Ptr <= (uintptr_t)MM_HIGHEST_USER_ADDRESS;
+    uintptr_t const uLast = (uintptr_t)MM_HIGHEST_USER_ADDRESS;
 #endif
+    return R3Ptr <= uLast;
 }
 
@@ -79,9 +81,9 @@
 {
 #ifdef IPRT_TARGET_NT4
-    /* Play safe+wrong... it used to be a constant, but in w2k+ is a variable. */
-    return (uintptr_t)pv >= _2G;
+    uintptr_t const uFirst = g_puRtMmSystemRangeStart ? *g_puRtMmSystemRangeStart : ~(uintptr_t)0 / 2 + 1;
 #else
-    return (uintptr_t)pv >= (uintptr_t)MM_SYSTEM_RANGE_START;
+    uintptr_t const uFirst = (uintptr_t)MM_SYSTEM_RANGE_START;
 #endif
+    return (uintptr_t)pv >= uFirst;
 }
 
Index: trunk/src/VBox/Runtime/r0drv/nt/mp-r0drv-nt.cpp
===================================================================
--- trunk/src/VBox/Runtime/r0drv/nt/mp-r0drv-nt.cpp	(revision 70150)
+++ trunk/src/VBox/Runtime/r0drv/nt/mp-r0drv-nt.cpp	(revision 70151)
@@ -594,5 +594,4 @@
 
     g_pfnrtMpPokeCpuWorker = rtMpPokeCpuUsingDpc;
-#ifndef IPRT_TARGET_NT4
     if (   g_pfnrtHalRequestIpiW7Plus
         && g_pfnrtKeInitializeAffinityEx
@@ -611,5 +610,4 @@
         DbgPrint("IPRT: RTMpPoke => rtMpPokeCpuUsingDpc\n");
     /* else: Windows XP should send always send an IPI -> VERIFY */
-#endif
 
     return VINF_SUCCESS;
@@ -1362,16 +1360,10 @@
                              RT_NT_CPUID enmCpuid, RTCPUID idCpu, RTCPUID idCpu2, uint32_t *pcHits)
 {
-#ifdef IPRT_TARGET_NT4
-    RT_NOREF(pfnWorker, pvUser1, pvUser2, enmCpuid, idCpu, idCpu2, pcHits);
-    /* g_pfnrtNt* are not present on NT anyway. */
-    return VERR_NOT_SUPPORTED;
-
-#else  /* !IPRT_TARGET_NT4 */
-# if 0
+#if 0
     /* KeFlushQueuedDpcs must be run at IRQL PASSIVE_LEVEL according to MSDN, but the
      * driver verifier doesn't complain...
      */
     AssertMsg(KeGetCurrentIrql() == PASSIVE_LEVEL, ("%d != %d (PASSIVE_LEVEL)\n", KeGetCurrentIrql(), PASSIVE_LEVEL));
-# endif
+#endif
     /* KeFlushQueuedDpcs is not present in Windows 2000; import it dynamically so we can just fail this call. */
     if (!g_pfnrtNtKeFlushQueuedDpcs)
@@ -1512,5 +1504,6 @@
      *        executed. Seen pArgs being freed while some CPU was using it before
      *        cRefs was added. */
-    g_pfnrtNtKeFlushQueuedDpcs();
+    if (g_pfnrtNtKeFlushQueuedDpcs)
+        g_pfnrtNtKeFlushQueuedDpcs();
 
     if (pcHits)
@@ -1524,5 +1517,4 @@
 
     return VINF_SUCCESS;
-#endif /* !IPRT_TARGET_NT4 */
 }
 
@@ -1764,10 +1756,8 @@
         if (rcNt == STATUS_TIMEOUT)
         {
-#ifndef IPRT_TARGET_NT4
             if (   !pArgs->fExecuting
                 && (   g_pfnrtMpPokeCpuWorker == rtMpPokeCpuUsingHalReqestIpiW7Plus
                     || g_pfnrtMpPokeCpuWorker == rtMpPokeCpuUsingHalReqestIpiPreW7))
                 RTMpPokeCpu(idCpu);
-#endif
 
             Timeout.QuadPart = -1280000; /* 128ms */
@@ -1823,5 +1813,4 @@
 }
 
-#ifndef IPRT_TARGET_NT4
 
 /** Callback used by rtMpPokeCpuUsingBroadcastIpi. */
@@ -1881,6 +1870,4 @@
     return VINF_SUCCESS;
 }
-
-#endif /* !IPRT_TARGET_NT4 */
 
 
@@ -1910,6 +1897,5 @@
 
     /* Raise the IRQL to DISPATCH_LEVEL so we can't be rescheduled to another cpu.
-     * KeInsertQueueDpc must also be executed at IRQL >= DISPATCH_LEVEL.
-     */
+       KeInsertQueueDpc must also be executed at IRQL >= DISPATCH_LEVEL. */
     KIRQL oldIrql;
     KeRaiseIrql(DISPATCH_LEVEL, &oldIrql);
@@ -1919,10 +1905,9 @@
 
     /* Assuming here that high importance DPCs will be delivered immediately; or at least an IPI will be sent immediately.
-     * @note: not true on at least Vista & Windows 7
-     */
-    BOOLEAN bRet = KeInsertQueueDpc(&s_aPokeDpcs[idCpu], 0, 0);
+       Note! Not true on at least Vista & Windows 7 */
+    BOOLEAN fRet = KeInsertQueueDpc(&s_aPokeDpcs[idCpu], 0, 0);
 
     KeLowerIrql(oldIrql);
-    return (bRet == TRUE) ? VINF_SUCCESS : VERR_ACCESS_DENIED /* already queued */;
+    return fRet == TRUE ? VINF_SUCCESS : VERR_ACCESS_DENIED /* already queued */;
 }
 
