Index: trunk/src/VBox/ValidationKit/bootsectors/bs3-cpu-instr-2-template.c
===================================================================
--- trunk/src/VBox/ValidationKit/bootsectors/bs3-cpu-instr-2-template.c	(revision 70666)
+++ trunk/src/VBox/ValidationKit/bootsectors/bs3-cpu-instr-2-template.c	(revision 70667)
@@ -97,24 +97,24 @@
 static BS3CI2FSGSBASE const s_aWrFsBaseWorkers[] =
 {
-    { "wrfsbase rbx", true,  BS3_CMN_NM(bs3CpuInstr2_wrfsbase_rbx_ud2), 5, BS3_CMN_NM(bs3CpuInstr2_wrfsbase_rbx_rdfsbase_rcx_ud2), 10 },
-    { "wrfsbase ebx", false, BS3_CMN_NM(bs3CpuInstr2_wrfsbase_ebx_ud2), 4, BS3_CMN_NM(bs3CpuInstr2_wrfsbase_ebx_rdfsbase_ecx_ud2),  8 },
+    { "wrfsbase rbx", true,  BS3_CMN_NM(bs3CpuInstr2_wrfsbase_rbx_ud2), 5, BS3_CMN_NM(bs3CpuInstr2_wrfsbase_rbx_rdfsbase_rcx_ud2), 13 },
+    { "wrfsbase ebx", false, BS3_CMN_NM(bs3CpuInstr2_wrfsbase_ebx_ud2), 4, BS3_CMN_NM(bs3CpuInstr2_wrfsbase_ebx_rdfsbase_ecx_ud2), 10 },
 };
 
 static BS3CI2FSGSBASE const s_aWrGsBaseWorkers[] =
 {
-    { "wrgsbase rbx", true,  BS3_CMN_NM(bs3CpuInstr2_wrgsbase_rbx_ud2), 5, BS3_CMN_NM(bs3CpuInstr2_wrgsbase_rbx_rdgsbase_rcx_ud2), 10 },
-    { "wrgsbase ebx", false, BS3_CMN_NM(bs3CpuInstr2_wrgsbase_ebx_ud2), 4, BS3_CMN_NM(bs3CpuInstr2_wrgsbase_ebx_rdgsbase_ecx_ud2),  8 },
+    { "wrgsbase rbx", true,  BS3_CMN_NM(bs3CpuInstr2_wrgsbase_rbx_ud2), 5, BS3_CMN_NM(bs3CpuInstr2_wrgsbase_rbx_rdgsbase_rcx_ud2), 13 },
+    { "wrgsbase ebx", false, BS3_CMN_NM(bs3CpuInstr2_wrgsbase_ebx_ud2), 4, BS3_CMN_NM(bs3CpuInstr2_wrgsbase_ebx_rdgsbase_ecx_ud2), 10 },
 };
 
 static BS3CI2FSGSBASE const s_aRdFsBaseWorkers[] =
 {
-    { "rdfsbase rbx", true,  BS3_CMN_NM(bs3CpuInstr2_rdfsbase_rbx_ud2), 5, BS3_CMN_NM(bs3CpuInstr2_wrfsbase_rbx_rdfsbase_rcx_ud2), 10 },
-    { "rdfsbase ebx", false, BS3_CMN_NM(bs3CpuInstr2_rdfsbase_ebx_ud2), 4, BS3_CMN_NM(bs3CpuInstr2_wrfsbase_ebx_rdfsbase_ecx_ud2),  8 },
+    { "rdfsbase rbx", true,  BS3_CMN_NM(bs3CpuInstr2_rdfsbase_rbx_ud2), 5, BS3_CMN_NM(bs3CpuInstr2_wrfsbase_rbx_rdfsbase_rcx_ud2), 13 },
+    { "rdfsbase ebx", false, BS3_CMN_NM(bs3CpuInstr2_rdfsbase_ebx_ud2), 4, BS3_CMN_NM(bs3CpuInstr2_wrfsbase_ebx_rdfsbase_ecx_ud2), 10 },
 };
 
 static BS3CI2FSGSBASE const s_aRdGsBaseWorkers[] =
 {
-    { "rdgsbase rbx", true,  BS3_CMN_NM(bs3CpuInstr2_rdgsbase_rbx_ud2), 5, BS3_CMN_NM(bs3CpuInstr2_wrgsbase_rbx_rdgsbase_rcx_ud2), 10 },
-    { "rdgsbase ebx", false, BS3_CMN_NM(bs3CpuInstr2_rdgsbase_ebx_ud2), 4, BS3_CMN_NM(bs3CpuInstr2_wrgsbase_ebx_rdgsbase_ecx_ud2),  8 },
+    { "rdgsbase rbx", true,  BS3_CMN_NM(bs3CpuInstr2_rdgsbase_rbx_ud2), 5, BS3_CMN_NM(bs3CpuInstr2_wrgsbase_rbx_rdgsbase_rcx_ud2), 13 },
+    { "rdgsbase ebx", false, BS3_CMN_NM(bs3CpuInstr2_rdgsbase_ebx_ud2), 4, BS3_CMN_NM(bs3CpuInstr2_wrgsbase_ebx_rdgsbase_ecx_ud2), 10 },
 };
 # endif
@@ -806,4 +806,5 @@
             Bs3TrapSetJmpAndRestore(pCtx, pTrapFrame);
             pExpectCtx->rip.u       = pCtx->rip.u + (!fGP ? pFsGsBaseWorker->offVerifyWorkerUd2 : 0);
+            pExpectCtx->rbx.u       = !fGP ? 0 : s_aValues64[iValue].u64Base;
             pExpectCtx->rcx.u       = !fGP ? s_aValues64[iValue].u64Base : 0;
             pExpectCtx->rflags.u32 |= X86_EFL_RF;
@@ -829,4 +830,5 @@
             Bs3TrapSetJmpAndRestore(pCtx, pTrapFrame);
             pExpectCtx->rip.u       = pCtx->rip.u + pFsGsBaseWorker->offVerifyWorkerUd2;
+            pExpectCtx->rbx.u       = 0;
             pExpectCtx->rcx.u       = s_aValues64[iValue].u64Base & UINT64_C(0x00000000ffffffff);
             pExpectCtx->rflags.u32 |= X86_EFL_RF;
@@ -879,5 +881,5 @@
             bs3CpuInstr2_fsgsbase_ExpectUD(bMode, &Ctx, &ExpectCtx, &TrapFrame);
 
-            /* Read existing base address. */
+            /* Read any existing base address. */
             Ctx.rbx.u  = 0xa0000;
             Ctx.cr4.u |= X86_CR4_FSGSBASE;
Index: trunk/src/VBox/ValidationKit/bootsectors/bs3-cpu-instr-2-template.mac
===================================================================
--- trunk/src/VBox/ValidationKit/bootsectors/bs3-cpu-instr-2-template.mac	(revision 70666)
+++ trunk/src/VBox/ValidationKit/bootsectors/bs3-cpu-instr-2-template.mac	(revision 70667)
@@ -197,9 +197,10 @@
 BS3_PROC_BEGIN_CMN bs3CpuInstr2_wrfsbase_rbx_rdfsbase_rcx_ud2, BS3_PBC_NEAR
         wrfsbase rbx
+        xor      rbx, rbx
         rdfsbase rcx
 .again:
         ud2
         jmp     .again
-AssertCompile(.again - BS3_LAST_LABEL == 10)
+AssertCompile(.again - BS3_LAST_LABEL == 13)
 BS3_PROC_END_CMN   bs3CpuInstr2_wrfsbase_rbx_rdfsbase_rcx_ud2
 
@@ -207,9 +208,10 @@
 BS3_PROC_BEGIN_CMN bs3CpuInstr2_wrfsbase_ebx_rdfsbase_ecx_ud2, BS3_PBC_NEAR
         wrfsbase ebx
+        xor      ebx, ebx
         rdfsbase ecx
 .again:
         ud2
         jmp     .again
-AssertCompile(.again - BS3_LAST_LABEL == 8)
+AssertCompile(.again - BS3_LAST_LABEL == 10)
 BS3_PROC_END_CMN   bs3CpuInstr2_wrfsbase_ebx_rdfsbase_ecx_ud2
 
@@ -217,9 +219,10 @@
 BS3_PROC_BEGIN_CMN bs3CpuInstr2_wrgsbase_rbx_rdgsbase_rcx_ud2, BS3_PBC_NEAR
         wrgsbase rbx
+        xor      rbx, rbx
         rdgsbase rcx
 .again:
         ud2
         jmp     .again
-AssertCompile(.again - BS3_LAST_LABEL == 10)
+AssertCompile(.again - BS3_LAST_LABEL == 13)
 BS3_PROC_END_CMN   bs3CpuInstr2_wrgsbase_rbx_rdgsbase_rcx_ud2
 
@@ -227,9 +230,10 @@
 BS3_PROC_BEGIN_CMN bs3CpuInstr2_wrgsbase_ebx_rdgsbase_ecx_ud2, BS3_PBC_NEAR
         wrgsbase ebx
+        xor      ebx, ebx
         rdgsbase ecx
 .again:
         ud2
         jmp     .again
-AssertCompile(.again - BS3_LAST_LABEL == 8)
+AssertCompile(.again - BS3_LAST_LABEL == 10)
 BS3_PROC_END_CMN   bs3CpuInstr2_wrfgbase_ebx_rdgsbase_ecx_ud2
 
