Index: trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPCr.cpp
===================================================================
--- trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPCr.cpp	(revision 71517)
+++ trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPCr.cpp	(revision 71590)
@@ -15,4 +15,5 @@
  * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
  */
+
 #ifdef VBOX_WITH_CROGL
 
@@ -37,41 +38,40 @@
 }
 
-static void* vboxMpCrShgsmiBufferAlloc(PVBOXMP_DEVEXT pDevExt, HGSMISIZE cbData)
+static void RT_UNTRUSTED_VOLATILE_HOST *vboxMpCrShgsmiBufferAlloc(PVBOXMP_DEVEXT pDevExt, HGSMISIZE cbData)
 {
     return VBoxSHGSMIHeapBufferAlloc(&VBoxCommonFromDeviceExt(pDevExt)->guestCtx.heapCtx, cbData);
 }
 
-static VBOXVIDEOOFFSET vboxMpCrShgsmiBufferOffset(PVBOXMP_DEVEXT pDevExt, void *pvBuffer)
-{
-    return (VBOXVIDEOOFFSET)HGSMIPointerToOffset(&VBoxCommonFromDeviceExt(pDevExt)->guestCtx.heapCtx.Heap.area,
-                                                 (const HGSMIBUFFERHEADER *)pvBuffer);
-}
-
-static void* vboxMpCrShgsmiBufferFromOffset(PVBOXMP_DEVEXT pDevExt, VBOXVIDEOOFFSET offBuffer)
+static VBOXVIDEOOFFSET vboxMpCrShgsmiBufferOffset(PVBOXMP_DEVEXT pDevExt, void RT_UNTRUSTED_VOLATILE_HOST *pvBuffer)
+{
+    return (VBOXVIDEOOFFSET)HGSMIPointerToOffset(&VBoxCommonFromDeviceExt(pDevExt)->guestCtx.heapCtx.Heap.area, pvBuffer);
+}
+
+static void RT_UNTRUSTED_VOLATILE_HOST *vboxMpCrShgsmiBufferFromOffset(PVBOXMP_DEVEXT pDevExt, VBOXVIDEOOFFSET offBuffer)
 {
     return HGSMIOffsetToPointer(&VBoxCommonFromDeviceExt(pDevExt)->guestCtx.heapCtx.Heap.area, (HGSMIOFFSET)offBuffer);
 }
 
-static void vboxMpCrShgsmiBufferFree(PVBOXMP_DEVEXT pDevExt, void *pvBuffer)
+static void vboxMpCrShgsmiBufferFree(PVBOXMP_DEVEXT pDevExt, void RT_UNTRUSTED_VOLATILE_HOST *pvBuffer)
 {
     VBoxSHGSMIHeapBufferFree(&VBoxCommonFromDeviceExt(pDevExt)->guestCtx.heapCtx, pvBuffer);
 }
 
-static VBOXVIDEOOFFSET vboxMpCrShgsmiTransportBufOffset(PVBOXMP_CRSHGSMITRANSPORT pCon, void* pvBuffer)
+static VBOXVIDEOOFFSET vboxMpCrShgsmiTransportBufOffset(PVBOXMP_CRSHGSMITRANSPORT pCon, void RT_UNTRUSTED_VOLATILE_HOST *pvBuffer)
 {
     return vboxMpCrShgsmiBufferOffset(pCon->pDevExt, pvBuffer);
 }
 
-static void* vboxMpCrShgsmiTransportBufFromOffset(PVBOXMP_CRSHGSMITRANSPORT pCon, VBOXVIDEOOFFSET offBuffer)
+static void RT_UNTRUSTED_VOLATILE_HOST *vboxMpCrShgsmiTransportBufFromOffset(PVBOXMP_CRSHGSMITRANSPORT pCon, VBOXVIDEOOFFSET offBuffer)
 {
     return vboxMpCrShgsmiBufferFromOffset(pCon->pDevExt, offBuffer);
 }
 
-void* VBoxMpCrShgsmiTransportBufAlloc(PVBOXMP_CRSHGSMITRANSPORT pCon, uint32_t cbBuffer)
+void RT_UNTRUSTED_VOLATILE_HOST *VBoxMpCrShgsmiTransportBufAlloc(PVBOXMP_CRSHGSMITRANSPORT pCon, uint32_t cbBuffer)
 {
     return vboxMpCrShgsmiBufferAlloc(pCon->pDevExt, cbBuffer);
 }
 
-void VBoxMpCrShgsmiTransportBufFree(PVBOXMP_CRSHGSMITRANSPORT pCon, void* pvBuffer)
+void VBoxMpCrShgsmiTransportBufFree(PVBOXMP_CRSHGSMITRANSPORT pCon, void RT_UNTRUSTED_VOLATILE_HOST *pvBuffer)
 {
     vboxMpCrShgsmiBufferFree(pCon->pDevExt, pvBuffer);
@@ -297,5 +297,6 @@
 
 typedef DECLCALLBACK(void) FNVBOXMP_CRSHGSMITRANSPORT_SENDREADASYNC_COMPLETION(PVBOXMP_CRSHGSMITRANSPORT pCon, int rc,
-                                                                               void *pvRx, uint32_t cbRx, void *pvCtx);
+                                                                               void RT_UNTRUSTED_VOLATILE_HOST *pvRx,
+                                                                               uint32_t cbRx, void *pvCtx);
 typedef FNVBOXMP_CRSHGSMITRANSPORT_SENDREADASYNC_COMPLETION *PFNVBOXMP_CRSHGSMITRANSPORT_SENDREADASYNC_COMPLETION;
 
@@ -321,5 +322,5 @@
     VBOXVDMACMD_CHROMIUM_BUFFER *pRxBuf = &pBody->aBuffers[1];
     PVBOXMP_CRSHGSMICON_BUFDR pWbDr = (PVBOXMP_CRSHGSMICON_BUFDR)pRxBuf->u64GuestData;
-    void *pvRx = NULL;
+    void RT_UNTRUSTED_VOLATILE_HOST *pvRx = NULL;
     uint32_t cbRx = 0;
 
@@ -418,6 +419,8 @@
 } VBOXMP_CRHGSMICON_WRR_COMPLETION_CTX, *PVBOXMP_CRHGSMICON_WRR_COMPLETION_CTX;
 
+/** @callback_method_impl{FNVBOXMP_CRSHGSMITRANSPORT_SENDREADASYNC_COMPLETION} */
 static DECLCALLBACK(void) vboxMpCrShgsmiTransportSendWriteReadReadRepostCompletion(PVBOXMP_CRSHGSMITRANSPORT pCon, int rc,
-                                                                                   void *pvRx, uint32_t cbRx, void *pvCtx)
+                                                                                   void RT_UNTRUSTED_VOLATILE_HOST *pvRx,
+                                                                                   uint32_t cbRx, void *pvCtx)
 {
     PVBOXMP_CRHGSMICON_WRR_COMPLETION_CTX pData = (PVBOXMP_CRHGSMICON_WRR_COMPLETION_CTX)pvCtx;
@@ -448,5 +451,5 @@
     PVBOXMP_CRSHGSMICON_BUFDR pWbDr = (PVBOXMP_CRSHGSMICON_BUFDR)pRxBuf->u64GuestData;
     PFNVBOXMP_CRSHGSMITRANSPORT_SENDWRITEREADASYNC_COMPLETION pfnCompletion = (PFNVBOXMP_CRSHGSMITRANSPORT_SENDWRITEREADASYNC_COMPLETION)pBufCmd->u64GuestData;
-    void *pvRx = NULL;
+    void RT_UNTRUSTED_VOLATILE_HOST *pvRx = NULL;
     uint32_t cbRx = 0;
 
@@ -552,5 +555,7 @@
 }
 
-static DECLCALLBACK(VOID) vboxMpCrShgsmiTransportVbvaSendWriteAsyncCompletion(PVBOXSHGSMI pHeap, void *pvCmd, void *pvContext)
+/** @callback_method_impl{FNVBOXSHGSMICMDCOMPLETION}   */
+static DECLCALLBACK(VOID)
+vboxMpCrShgsmiTransportVbvaSendWriteAsyncCompletion(PVBOXSHGSMI pHeap, void RT_UNTRUSTED_VOLATILE_HOST *pvCmd, void *pvContext)
 {
     RT_NOREF(pHeap);
@@ -559,5 +564,5 @@
 
     PVBOXMP_CRSHGSMITRANSPORT pCon = (PVBOXMP_CRSHGSMITRANSPORT)pvContext;
-    VBOXCMDVBVA_CRCMD_CMD *pCmd;
+    VBOXCMDVBVA_CRCMD_CMD RT_UNTRUSTED_VOLATILE_HOST *pCmd = NULL;
     int rc = VBoxCmdVbvaConCmdCompletionData(pvCmd, &pCmd);
     const UINT cBuffers = 2;
@@ -581,5 +586,5 @@
     const uint32_t cbCmd = VBOXMP_CRSHGSMICON_DR_SIZE(cBuffers, sizeof (VBOXMP_CRHGSMICMD_WRITEREAD), cbContextData);
     PVBOXMP_DEVEXT pDevExt = pCon->pDevExt;
-    PVBOXVDMACBUF_DR pDr = vboxVdmaCBufDrCreate(&pDevExt->u.primary.Vdma, cbCmd);
+    VBOXVDMACBUF_DR RT_UNTRUSTED_VOLATILE_HOST *pDr = vboxVdmaCBufDrCreate(&pDevExt->u.primary.Vdma, cbCmd);
     if (!pDr)
     {
@@ -686,5 +691,5 @@
     const uint32_t cBuffers = 2;
     const uint32_t cbCmd = VBOXMP_CRSHGSMICON_DR_SIZE(cBuffers, sizeof (VBOXMP_CRHGSMICMD_WRITE), cbContextData);
-    PVBOXVDMACBUF_DR pDr = vboxVdmaCBufDrCreate(&pDevExt->u.primary.Vdma, cbCmd);
+    VBOXVDMACBUF_DR RT_UNTRUSTED_VOLATILE_HOST *pDr = vboxVdmaCBufDrCreate(&pDevExt->u.primary.Vdma, cbCmd);
     if (!pDr)
     {
@@ -1103,32 +1108,32 @@
 }
 
-int VBoxMpCrCmdRxReadbackHandler(CRMessageReadback *pRx, uint32_t cbRx)
-{
-    if (cbRx < sizeof (*pRx))
+int VBoxMpCrCmdRxReadbackHandler(CRMessageReadback RT_UNTRUSTED_VOLATILE_HOST *pRx, uint32_t cbRx)
+{
+    if (cbRx < sizeof(*pRx))
     {
         WARN(("invalid rx size %d", cbRx));
         return VERR_INVALID_PARAMETER;
     }
-    void* pvData = VBoxMpCrCmdRxReadbackData(pRx);
+    void    *pvSrc  = VBoxMpCrCmdRxReadbackData(pRx);
     uint32_t cbData = VBoxMpCrCmdRxReadbackDataSize(pRx, cbRx);
-    void *pvDataPtr = *((void**)&pRx->readback_ptr);
-    memcpy(pvDataPtr, pvData, cbData);
+    void    *pvDst  = *((void**)&pRx->readback_ptr);
+    memcpy(pvDst, pvSrc, cbData);
     return VINF_SUCCESS;
 }
 
-int VBoxMpCrCmdRxHandler(CRMessageHeader *pRx, uint32_t cbRx)
-{
-    if (cbRx < sizeof (*pRx))
+int VBoxMpCrCmdRxHandler(CRMessageHeader RT_UNTRUSTED_VOLATILE_HOST *pRx, uint32_t cbRx)
+{
+    if (cbRx < sizeof(*pRx))
     {
         WARN(("invalid rx size %d", cbRx));
         return VERR_INVALID_PARAMETER;
     }
-    CRMessageHeader *pHdr = (CRMessageHeader*)pRx;
-    switch (pHdr->type)
+    CRMessageType enmType = pRx->type;
+    switch (enmType)
     {
         case CR_MESSAGE_READBACK:
-            return VBoxMpCrCmdRxReadbackHandler((CRMessageReadback*)pRx, cbRx);
+            return VBoxMpCrCmdRxReadbackHandler((CRMessageReadback RT_UNTRUSTED_VOLATILE_HOST *)pRx, cbRx);
         default:
-            WARN(("unsupported rx message type: %d", pHdr->type));
+            WARN(("unsupported rx message type: %d", enmType));
             return VERR_INVALID_PARAMETER;
     }
Index: trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPCr.h
===================================================================
--- trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPCr.h	(revision 71517)
+++ trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPCr.h	(revision 71590)
@@ -45,5 +45,5 @@
 {
     uint32_t cbBuf;
-    void *pvBuf;
+    void RT_UNTRUSTED_VOLATILE_HOST *pvBuf;
 } VBOXMP_CRSHGSMICON_BUFDR, *PVBOXMP_CRSHGSMICON_BUFDR;
 
@@ -62,5 +62,7 @@
  * the callee must NOT free it or use outside of the callback context.
  * */
-typedef DECLCALLBACK(void) FNVBOXMP_CRSHGSMITRANSPORT_SENDWRITEREADASYNC_COMPLETION(PVBOXMP_CRSHGSMITRANSPORT pCon, int rc, void *pvRx, uint32_t cbRx, void *pvCtx);
+typedef DECLCALLBACK(void) FNVBOXMP_CRSHGSMITRANSPORT_SENDWRITEREADASYNC_COMPLETION(PVBOXMP_CRSHGSMITRANSPORT pCon, int rc,
+                                                                                    void RT_UNTRUSTED_VOLATILE_HOST *pvRx,
+                                                                                    uint32_t cbRx, void *pvCtx);
 typedef FNVBOXMP_CRSHGSMITRANSPORT_SENDWRITEREADASYNC_COMPLETION *PFNVBOXMP_CRSHGSMITRANSPORT_SENDWRITEREADASYNC_COMPLETION;
 
@@ -79,6 +81,6 @@
 void VBoxMpCrShgsmiTransportCmdTermWriteAsync(PVBOXMP_CRSHGSMITRANSPORT pCon, void *pvContext);
 
-void* VBoxMpCrShgsmiTransportBufAlloc(PVBOXMP_CRSHGSMITRANSPORT pCon, uint32_t cbBuffer);
-void VBoxMpCrShgsmiTransportBufFree(PVBOXMP_CRSHGSMITRANSPORT pCon, void* pvBuffer);
+void RT_UNTRUSTED_VOLATILE_HOST *VBoxMpCrShgsmiTransportBufAlloc(PVBOXMP_CRSHGSMITRANSPORT pCon, uint32_t cbBuffer);
+void VBoxMpCrShgsmiTransportBufFree(PVBOXMP_CRSHGSMITRANSPORT pCon, void RT_UNTRUSTED_VOLATILE_HOST *pvBuffer);
 
 typedef struct VBOXMP_CRPACKER
@@ -98,7 +100,8 @@
 }
 
-DECLINLINE(void) VBoxMpCrPackerTxBufferInit(PVBOXMP_CRPACKER pPacker, void *pvBuffer, uint32_t cbBuffer, uint32_t cCommands)
-{
-    crPackInitBuffer(&pPacker->CrBuffer, pvBuffer, cbBuffer, cbBuffer, cCommands);
+DECLINLINE(void) VBoxMpCrPackerTxBufferInit(PVBOXMP_CRPACKER pPacker, void RT_UNTRUSTED_VOLATILE_HOST *pvBuffer,
+                                            uint32_t cbBuffer, uint32_t cCommands)
+{
+    crPackInitBuffer(&pPacker->CrBuffer, (void *)pvBuffer, cbBuffer, cbBuffer, cCommands);
     crPackSetBuffer(&pPacker->CrPacker, &pPacker->CrBuffer);
 }
@@ -190,16 +193,16 @@
 }
 
-DECLINLINE(void*) VBoxMpCrCmdRxReadbackData(CRMessageReadback *pRx)
-{
-    return pRx + 1;
-}
-
-DECLINLINE(uint32_t) VBoxMpCrCmdRxReadbackDataSize(CRMessageReadback *pRx, uint32_t cbRx)
+DECLINLINE(void *) VBoxMpCrCmdRxReadbackData(CRMessageReadback RT_UNTRUSTED_VOLATILE_HOST *pRx)
+{
+    return (void *)(pRx + 1);
+}
+
+DECLINLINE(uint32_t) VBoxMpCrCmdRxReadbackDataSize(CRMessageReadback RT_UNTRUSTED_VOLATILE_HOST *pRx, uint32_t cbRx)
 {
     RT_NOREF(pRx);
     return cbRx - sizeof(*pRx);
 }
-int VBoxMpCrCmdRxReadbackHandler(CRMessageReadback *pRx, uint32_t cbRx);
-int VBoxMpCrCmdRxHandler(CRMessageHeader *pRx, uint32_t cbRx);
+int VBoxMpCrCmdRxReadbackHandler(CRMessageReadback RT_UNTRUSTED_VOLATILE_HOST *pRx, uint32_t cbRx);
+int VBoxMpCrCmdRxHandler(CRMessageHeader RT_UNTRUSTED_VOLATILE_HOST *pRx, uint32_t cbRx);
 
 /* must be called after calling VBoxMpCrCtlConIs3DSupported only */
Index: trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPMisc.cpp
===================================================================
--- trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPMisc.cpp	(revision 71517)
+++ trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPMisc.cpp	(revision 71590)
@@ -1392,5 +1392,5 @@
     UINT cbCmd = VBOXVDMACMD_SIZE_FROMBODYSIZE(RT_OFFSETOF(VBOXVDMACMD_CHROMIUM_CMD, aBuffers[cBuffers]));
 
-    PVBOXVDMACBUF_DR pDr = vboxVdmaCBufDrCreate(&pDevExt->u.primary.Vdma, cbCmd);
+    VBOXVDMACBUF_DR RT_UNTRUSTED_VOLATILE_HOST *pDr = vboxVdmaCBufDrCreate(&pDevExt->u.primary.Vdma, cbCmd);
     if (pDr)
     {
@@ -1438,5 +1438,5 @@
         {
             PVBOXVDMADDI_CMD pDdiCmd = VBOXVDMADDI_CMD_FROM_BUF_DR(pDr);
-            vboxVdmaDdiCmdInit(pDdiCmd, 0, 0, vboxVideoAMgrAllocSubmitCompletion, pDr);
+            vboxVdmaDdiCmdInit(pDdiCmd, 0, 0, vboxVideoAMgrAllocSubmitCompletion, (void *)pDr);
             /* mark command as submitted & invisible for the dx runtime since dx did not originate it */
             vboxVdmaDdiCmdSubmittedNotDx(pDdiCmd);
@@ -1808,6 +1808,7 @@
 {
     int rc = VINF_SUCCESS;
-    PVBOXVDMA_CTL pCmd = (PVBOXVDMA_CTL)VBoxSHGSMICommandAlloc(&VBoxCommonFromDeviceExt(pDevExt)->guestCtx.heapCtx,
-                                                               sizeof(VBOXVDMA_CTL), HGSMI_CH_VBVA, VBVA_VDMA_CTL);
+    VBOXVDMA_CTL RT_UNTRUSTED_VOLATILE_GUEST *pCmd
+        = (VBOXVDMA_CTL RT_UNTRUSTED_VOLATILE_GUEST *)VBoxSHGSMICommandAlloc(&VBoxCommonFromDeviceExt(pDevExt)->guestCtx.heapCtx,
+                                                                             sizeof(VBOXVDMA_CTL), HGSMI_CH_VBVA, VBVA_VDMA_CTL);
     if (pCmd)
     {
@@ -1845,5 +1846,5 @@
         }
 
-        VBoxSHGSMICommandFree (&VBoxCommonFromDeviceExt(pDevExt)->guestCtx.heapCtx, pCmd);
+        VBoxSHGSMICommandFree(&VBoxCommonFromDeviceExt(pDevExt)->guestCtx.heapCtx, pCmd);
     }
     else
Index: trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPShgsmi.cpp
===================================================================
--- trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPShgsmi.cpp	(revision 71517)
+++ trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPShgsmi.cpp	(revision 71590)
@@ -20,23 +20,23 @@
 
 /* SHGSMI */
-DECLINLINE(void) vboxSHGSMICommandRetain(PVBOXSHGSMIHEADER pCmd)
+DECLINLINE(void) vboxSHGSMICommandRetain(VBOXSHGSMIHEADER RT_UNTRUSTED_VOLATILE_HOST *pCmd)
 {
     ASMAtomicIncU32(&pCmd->cRefs);
 }
 
-void vboxSHGSMICommandFree(PVBOXSHGSMI pHeap, PVBOXSHGSMIHEADER pCmd)
+void vboxSHGSMICommandFree(PVBOXSHGSMI pHeap, VBOXSHGSMIHEADER RT_UNTRUSTED_VOLATILE_HOST *pCmd)
 {
     VBoxSHGSMIHeapFree(pHeap, pCmd);
 }
 
-DECLINLINE(void) vboxSHGSMICommandRelease(PVBOXSHGSMI pHeap, PVBOXSHGSMIHEADER pCmd)
+DECLINLINE(void) vboxSHGSMICommandRelease(PVBOXSHGSMI pHeap, VBOXSHGSMIHEADER RT_UNTRUSTED_VOLATILE_HOST *pCmd)
 {
     uint32_t cRefs = ASMAtomicDecU32(&pCmd->cRefs);
     Assert(cRefs < UINT32_MAX / 2);
     if(!cRefs)
-        vboxSHGSMICommandFree (pHeap, pCmd);
-}
-
-static DECLCALLBACK(void) vboxSHGSMICompletionSetEvent(PVBOXSHGSMI pHeap, void *pvCmd, void *pvContext)
+        vboxSHGSMICommandFree(pHeap, pCmd);
+}
+
+static DECLCALLBACK(void) vboxSHGSMICompletionSetEvent(PVBOXSHGSMI pHeap, void RT_UNTRUSTED_VOLATILE_HOST *pvCmd, void *pvContext)
 {
     RT_NOREF(pHeap, pvCmd);
@@ -44,5 +44,5 @@
 }
 
-DECLCALLBACK(void) vboxSHGSMICompletionCommandRelease(PVBOXSHGSMI pHeap, void *pvCmd, void *pvContext)
+DECLCALLBACK(void) vboxSHGSMICompletionCommandRelease(PVBOXSHGSMI pHeap, void RT_UNTRUSTED_VOLATILE_HOST *pvCmd, void *pvContext)
 {
     RT_NOREF(pvContext);
@@ -51,5 +51,6 @@
 
 /* do not wait for completion */
-DECLINLINE(const VBOXSHGSMIHEADER *) vboxSHGSMICommandPrepAsynch(PVBOXSHGSMI pHeap, PVBOXSHGSMIHEADER pHeader)
+DECLINLINE(const VBOXSHGSMIHEADER RT_UNTRUSTED_VOLATILE_HOST *)
+vboxSHGSMICommandPrepAsynch(PVBOXSHGSMI pHeap, VBOXSHGSMIHEADER RT_UNTRUSTED_VOLATILE_HOST *pHeader)
 {
     RT_NOREF(pHeap);
@@ -59,5 +60,5 @@
 }
 
-DECLINLINE(void) vboxSHGSMICommandDoneAsynch(PVBOXSHGSMI pHeap, const VBOXSHGSMIHEADER* pHeader)
+DECLINLINE(void) vboxSHGSMICommandDoneAsynch(PVBOXSHGSMI pHeap, const VBOXSHGSMIHEADER RT_UNTRUSTED_VOLATILE_HOST *pHeader)
 {
     if(!(ASMAtomicReadU32((volatile uint32_t *)&pHeader->fFlags) & VBOXSHGSMI_FLAG_HG_ASYNCH))
@@ -71,7 +72,8 @@
 }
 
-const VBOXSHGSMIHEADER* VBoxSHGSMICommandPrepAsynchEvent(PVBOXSHGSMI pHeap, PVOID pvBuff, RTSEMEVENT hEventSem)
-{
-    PVBOXSHGSMIHEADER pHeader = VBoxSHGSMIBufferHeader(pvBuff);
+const VBOXSHGSMIHEADER RT_UNTRUSTED_VOLATILE_HOST *
+VBoxSHGSMICommandPrepAsynchEvent(PVBOXSHGSMI pHeap, void RT_UNTRUSTED_VOLATILE_HOST *pvBuff, RTSEMEVENT hEventSem)
+{
+    VBOXSHGSMIHEADER RT_UNTRUSTED_VOLATILE_HOST *pHeader = VBoxSHGSMIBufferHeader(pvBuff);
     pHeader->u64Info1 = (uint64_t)vboxSHGSMICompletionSetEvent;
     pHeader->u64Info2 = (uintptr_t)hEventSem;
@@ -81,5 +83,6 @@
 }
 
-const VBOXSHGSMIHEADER* VBoxSHGSMICommandPrepSynch(PVBOXSHGSMI pHeap, PVOID pCmd)
+const VBOXSHGSMIHEADER RT_UNTRUSTED_VOLATILE_HOST *VBoxSHGSMICommandPrepSynch(PVBOXSHGSMI pHeap,
+                                                                              void  RT_UNTRUSTED_VOLATILE_HOST *pCmd)
 {
     RTSEMEVENT hEventSem;
@@ -93,10 +96,10 @@
 }
 
-void VBoxSHGSMICommandDoneAsynch(PVBOXSHGSMI pHeap, const VBOXSHGSMIHEADER * pHeader)
+void VBoxSHGSMICommandDoneAsynch(PVBOXSHGSMI pHeap, const VBOXSHGSMIHEADER RT_UNTRUSTED_VOLATILE_HOST *pHeader)
 {
     vboxSHGSMICommandDoneAsynch(pHeap, pHeader);
 }
 
-int VBoxSHGSMICommandDoneSynch(PVBOXSHGSMI pHeap, const VBOXSHGSMIHEADER* pHeader)
+int VBoxSHGSMICommandDoneSynch(PVBOXSHGSMI pHeap, const VBOXSHGSMIHEADER RT_UNTRUSTED_VOLATILE_HOST *pHeader)
 {
     VBoxSHGSMICommandDoneAsynch(pHeap, pHeader);
@@ -109,34 +112,35 @@
 }
 
-void VBoxSHGSMICommandCancelAsynch(PVBOXSHGSMI pHeap, const VBOXSHGSMIHEADER* pHeader)
+void VBoxSHGSMICommandCancelAsynch(PVBOXSHGSMI pHeap, const VBOXSHGSMIHEADER RT_UNTRUSTED_VOLATILE_HOST *pHeader)
 {
     vboxSHGSMICommandRelease(pHeap, (PVBOXSHGSMIHEADER)pHeader);
 }
 
-void VBoxSHGSMICommandCancelSynch (PVBOXSHGSMI pHeap, const VBOXSHGSMIHEADER* pHeader)
-{
-    VBoxSHGSMICommandCancelAsynch (pHeap, pHeader);
+void VBoxSHGSMICommandCancelSynch(PVBOXSHGSMI pHeap, const VBOXSHGSMIHEADER RT_UNTRUSTED_VOLATILE_HOST *pHeader)
+{
+    VBoxSHGSMICommandCancelAsynch(pHeap, pHeader);
     RTSEMEVENT hEventSem = (RTSEMEVENT)pHeader->u64Info2;
     RTSemEventDestroy(hEventSem);
 }
 
-const VBOXSHGSMIHEADER* VBoxSHGSMICommandPrepAsynch(PVBOXSHGSMI pHeap, PVOID pvBuff, PFNVBOXSHGSMICMDCOMPLETION pfnCompletion,
-                                                    PVOID pvCompletion, uint32_t fFlags)
+const VBOXSHGSMIHEADER RT_UNTRUSTED_VOLATILE_HOST *
+VBoxSHGSMICommandPrepAsynch(PVBOXSHGSMI pHeap, void RT_UNTRUSTED_VOLATILE_HOST *pvBuff,
+                            PFNVBOXSHGSMICMDCOMPLETION pfnCompletion, PVOID pvCompletion, uint32_t fFlags)
 {
     fFlags &= ~VBOXSHGSMI_FLAG_GH_ASYNCH_CALLBACK_IRQ;
-    PVBOXSHGSMIHEADER pHeader = VBoxSHGSMIBufferHeader (pvBuff);
+    VBOXSHGSMIHEADER RT_UNTRUSTED_VOLATILE_HOST *pHeader = VBoxSHGSMIBufferHeader(pvBuff);
     pHeader->u64Info1 = (uintptr_t)pfnCompletion;
     pHeader->u64Info2 = (uintptr_t)pvCompletion;
     pHeader->fFlags = fFlags;
 
-    return vboxSHGSMICommandPrepAsynch (pHeap, pHeader);
-}
-
-const VBOXSHGSMIHEADER* VBoxSHGSMICommandPrepAsynchIrq(PVBOXSHGSMI pHeap, PVOID pvBuff,
-                                                       PFNVBOXSHGSMICMDCOMPLETION_IRQ pfnCompletion, PVOID pvCompletion,
-                                                       uint32_t fFlags)
+    return vboxSHGSMICommandPrepAsynch(pHeap, pHeader);
+}
+
+const VBOXSHGSMIHEADER  RT_UNTRUSTED_VOLATILE_HOST *
+VBoxSHGSMICommandPrepAsynchIrq(PVBOXSHGSMI pHeap, void RT_UNTRUSTED_VOLATILE_HOST *pvBuff,
+                               PFNVBOXSHGSMICMDCOMPLETION_IRQ pfnCompletion, PVOID pvCompletion, uint32_t fFlags)
 {
     fFlags |= VBOXSHGSMI_FLAG_GH_ASYNCH_CALLBACK_IRQ | VBOXSHGSMI_FLAG_GH_ASYNCH_IRQ;
-    PVBOXSHGSMIHEADER pHeader = VBoxSHGSMIBufferHeader (pvBuff);
+    VBOXSHGSMIHEADER  RT_UNTRUSTED_VOLATILE_HOST *pHeader = VBoxSHGSMIBufferHeader(pvBuff);
     pHeader->u64Info1 = (uintptr_t)pfnCompletion;
     pHeader->u64Info2 = (uintptr_t)pvCompletion;
@@ -144,11 +148,11 @@
     pHeader->fFlags = fFlags;
 
-    return vboxSHGSMICommandPrepAsynch (pHeap, pHeader);
-}
-
-void* VBoxSHGSMIHeapAlloc(PVBOXSHGSMI pHeap, HGSMISIZE cbData, uint8_t u8Channel, uint16_t u16ChannelInfo)
-{
-    KIRQL OldIrql;
-    void* pvData;
+    return vboxSHGSMICommandPrepAsynch(pHeap, pHeader);
+}
+
+void RT_UNTRUSTED_VOLATILE_HOST *VBoxSHGSMIHeapAlloc(PVBOXSHGSMI pHeap, HGSMISIZE cbData, uint8_t u8Channel, uint16_t u16ChannelInfo)
+{
+    KIRQL OldIrql;
+    void RT_UNTRUSTED_VOLATILE_HOST *pvData;
     Assert(KeGetCurrentIrql() <= DISPATCH_LEVEL);
     KeAcquireSpinLock(&pHeap->HeapLock, &OldIrql);
@@ -160,5 +164,5 @@
 }
 
-void VBoxSHGSMIHeapFree(PVBOXSHGSMI pHeap, void *pvBuffer)
+void VBoxSHGSMIHeapFree(PVBOXSHGSMI pHeap, void RT_UNTRUSTED_VOLATILE_HOST *pvBuffer)
 {
     KIRQL OldIrql;
@@ -169,8 +173,8 @@
 }
 
-void* VBoxSHGSMIHeapBufferAlloc(PVBOXSHGSMI pHeap, HGSMISIZE cbData)
-{
-    KIRQL OldIrql;
-    void* pvData;
+void RT_UNTRUSTED_VOLATILE_HOST *VBoxSHGSMIHeapBufferAlloc(PVBOXSHGSMI pHeap, HGSMISIZE cbData)
+{
+    KIRQL OldIrql;
+    void RT_UNTRUSTED_VOLATILE_HOST * pvData;
     Assert(KeGetCurrentIrql() <= DISPATCH_LEVEL);
     KeAcquireSpinLock(&pHeap->HeapLock, &OldIrql);
@@ -182,5 +186,5 @@
 }
 
-void VBoxSHGSMIHeapBufferFree(PVBOXSHGSMI pHeap, void *pvBuffer)
+void VBoxSHGSMIHeapBufferFree(PVBOXSHGSMI pHeap, void RT_UNTRUSTED_VOLATILE_HOST *pvBuffer)
 {
     KIRQL OldIrql;
@@ -203,9 +207,11 @@
 }
 
-void* VBoxSHGSMICommandAlloc(PVBOXSHGSMI pHeap, HGSMISIZE cbData, uint8_t u8Channel, uint16_t u16ChannelInfo)
+void RT_UNTRUSTED_VOLATILE_HOST *VBoxSHGSMICommandAlloc(PVBOXSHGSMI pHeap, HGSMISIZE cbData, uint8_t u8Channel,
+                                                        uint16_t u16ChannelInfo)
 {
     /* Issue the flush command. */
-    PVBOXSHGSMIHEADER pHeader = (PVBOXSHGSMIHEADER)VBoxSHGSMIHeapAlloc(pHeap, cbData + sizeof (VBOXSHGSMIHEADER), u8Channel,
-                                                                       u16ChannelInfo);
+    VBOXSHGSMIHEADER RT_UNTRUSTED_VOLATILE_HOST *pHeader =
+        (VBOXSHGSMIHEADER RT_UNTRUSTED_VOLATILE_HOST *)VBoxSHGSMIHeapAlloc(pHeap, cbData + sizeof(VBOXSHGSMIHEADER),
+                                                                           u8Channel, u16ChannelInfo);
     Assert(pHeader);
     if (pHeader)
@@ -217,8 +223,8 @@
 }
 
-void VBoxSHGSMICommandFree(PVBOXSHGSMI pHeap, void *pvBuffer)
-{
-    PVBOXSHGSMIHEADER pHeader = VBoxSHGSMIBufferHeader(pvBuffer);
-    vboxSHGSMICommandRelease (pHeap, pHeader);
+void VBoxSHGSMICommandFree(PVBOXSHGSMI pHeap, void RT_UNTRUSTED_VOLATILE_HOST *pvBuffer)
+{
+    VBOXSHGSMIHEADER RT_UNTRUSTED_VOLATILE_HOST *pHeader = VBoxSHGSMIBufferHeader(pvBuffer);
+    vboxSHGSMICommandRelease(pHeap, pHeader);
 }
 
@@ -226,5 +232,5 @@
 #define VBOXSHGSMI_LISTENTRY2CMD(_pEntry) ( (PVBOXSHGSMIHEADER)((uint8_t *)(_pEntry) - RT_OFFSETOF(VBOXSHGSMIHEADER, pvNext)) )
 
-int VBoxSHGSMICommandProcessCompletion (PVBOXSHGSMI pHeap, VBOXSHGSMIHEADER* pCur, bool bIrq, PVBOXVTLIST pPostProcessList)
+int VBoxSHGSMICommandProcessCompletion(PVBOXSHGSMI pHeap, VBOXSHGSMIHEADER *pCur, bool bIrq, PVBOXVTLIST pPostProcessList)
 {
     int rc = VINF_SUCCESS;
Index: trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPShgsmi.h
===================================================================
--- trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPShgsmi.h	(revision 71517)
+++ trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPShgsmi.h	(revision 71590)
@@ -30,22 +30,30 @@
 } VBOXSHGSMI, *PVBOXSHGSMI;
 
-typedef DECLCALLBACK(void) FNVBOXSHGSMICMDCOMPLETION(PVBOXSHGSMI pHeap, void *pvCmd, void *pvContext);
+typedef DECLCALLBACK(void) FNVBOXSHGSMICMDCOMPLETION(PVBOXSHGSMI pHeap, void RT_UNTRUSTED_VOLATILE_HOST *pvCmd, void *pvContext);
 typedef FNVBOXSHGSMICMDCOMPLETION *PFNVBOXSHGSMICMDCOMPLETION;
 
-typedef DECLCALLBACK(PFNVBOXSHGSMICMDCOMPLETION) FNVBOXSHGSMICMDCOMPLETION_IRQ(PVBOXSHGSMI pHeap, void *pvCmd, void *pvContext, void **ppvCompletion);
+typedef DECLCALLBACK(PFNVBOXSHGSMICMDCOMPLETION) FNVBOXSHGSMICMDCOMPLETION_IRQ(PVBOXSHGSMI pHeap,
+                                                                               void RT_UNTRUSTED_VOLATILE_HOST *pvCmd,
+                                                                               void *pvContext, void **ppvCompletion);
 typedef FNVBOXSHGSMICMDCOMPLETION_IRQ *PFNVBOXSHGSMICMDCOMPLETION_IRQ;
 
 
-const VBOXSHGSMIHEADER* VBoxSHGSMICommandPrepAsynchEvent(PVBOXSHGSMI pHeap, PVOID pvBuff, RTSEMEVENT hEventSem);
-const VBOXSHGSMIHEADER* VBoxSHGSMICommandPrepSynch(PVBOXSHGSMI pHeap, PVOID pCmd);
-const VBOXSHGSMIHEADER* VBoxSHGSMICommandPrepAsynch(PVBOXSHGSMI pHeap, PVOID pvBuff, PFNVBOXSHGSMICMDCOMPLETION pfnCompletion, PVOID pvCompletion, uint32_t fFlags);
-const VBOXSHGSMIHEADER* VBoxSHGSMICommandPrepAsynchIrq(PVBOXSHGSMI pHeap, PVOID pvBuff, PFNVBOXSHGSMICMDCOMPLETION_IRQ pfnCompletion, PVOID pvCompletion, uint32_t fFlags);
+const VBOXSHGSMIHEADER RT_UNTRUSTED_VOLATILE_HOST *
+    VBoxSHGSMICommandPrepAsynchEvent(PVBOXSHGSMI pHeap, PVOID pvBuff, RTSEMEVENT hEventSem);
+const VBOXSHGSMIHEADER RT_UNTRUSTED_VOLATILE_HOST *
+    VBoxSHGSMICommandPrepSynch(PVBOXSHGSMI pHeap, void RT_UNTRUSTED_VOLATILE_HOST *pvCmd);
+const VBOXSHGSMIHEADER RT_UNTRUSTED_VOLATILE_HOST *
+    VBoxSHGSMICommandPrepAsynch(PVBOXSHGSMI pHeap, void RT_UNTRUSTED_VOLATILE_HOST *pvBuff,
+                                PFNVBOXSHGSMICMDCOMPLETION pfnCompletion,  PVOID pvCompletion, uint32_t fFlags);
+const VBOXSHGSMIHEADER RT_UNTRUSTED_VOLATILE_HOST *
+    VBoxSHGSMICommandPrepAsynchIrq(PVBOXSHGSMI pHeap, void RT_UNTRUSTED_VOLATILE_HOST *pvBuff,
+                                   PFNVBOXSHGSMICMDCOMPLETION_IRQ pfnCompletion, PVOID pvCompletion, uint32_t fFlags);
 
-void VBoxSHGSMICommandDoneAsynch(PVBOXSHGSMI pHeap, const VBOXSHGSMIHEADER* pHeader);
-int VBoxSHGSMICommandDoneSynch(PVBOXSHGSMI pHeap, const VBOXSHGSMIHEADER* pHeader);
-void VBoxSHGSMICommandCancelAsynch(PVBOXSHGSMI pHeap, const VBOXSHGSMIHEADER* pHeader);
-void VBoxSHGSMICommandCancelSynch(PVBOXSHGSMI pHeap, const VBOXSHGSMIHEADER* pHeader);
+void VBoxSHGSMICommandDoneAsynch(PVBOXSHGSMI pHeap, const VBOXSHGSMIHEADER RT_UNTRUSTED_VOLATILE_HOST *pHeader);
+int  VBoxSHGSMICommandDoneSynch(PVBOXSHGSMI pHeap, const VBOXSHGSMIHEADER RT_UNTRUSTED_VOLATILE_HOST *pHeader);
+void VBoxSHGSMICommandCancelAsynch(PVBOXSHGSMI pHeap, const VBOXSHGSMIHEADER RT_UNTRUSTED_VOLATILE_HOST *pHeader);
+void VBoxSHGSMICommandCancelSynch(PVBOXSHGSMI pHeap, const VBOXSHGSMIHEADER RT_UNTRUSTED_VOLATILE_HOST *pHeader);
 
-DECLINLINE(HGSMIOFFSET) VBoxSHGSMICommandOffset(const PVBOXSHGSMI pHeap, const VBOXSHGSMIHEADER* pHeader)
+DECLINLINE(HGSMIOFFSET) VBoxSHGSMICommandOffset(const PVBOXSHGSMI pHeap, const VBOXSHGSMIHEADER RT_UNTRUSTED_VOLATILE_HOST *pHeader)
 {
     return HGSMIHeapBufferOffset(&pHeap->Heap, (void*)pHeader);
@@ -61,10 +69,10 @@
 int VBoxSHGSMIInit(PVBOXSHGSMI pHeap, void *pvBase, HGSMISIZE cbArea, HGSMIOFFSET offBase, const HGSMIENV *pEnv);
 void VBoxSHGSMITerm(PVBOXSHGSMI pHeap);
-void* VBoxSHGSMIHeapAlloc(PVBOXSHGSMI pHeap, HGSMISIZE cbData, uint8_t u8Channel, uint16_t u16ChannelInfo);
-void VBoxSHGSMIHeapFree(PVBOXSHGSMI pHeap, void *pvBuffer);
-void* VBoxSHGSMIHeapBufferAlloc(PVBOXSHGSMI pHeap, HGSMISIZE cbData);
-void VBoxSHGSMIHeapBufferFree(PVBOXSHGSMI pHeap, void *pvBuffer);
-void* VBoxSHGSMICommandAlloc(PVBOXSHGSMI pHeap, HGSMISIZE cbData, uint8_t u8Channel, uint16_t u16ChannelInfo);
-void VBoxSHGSMICommandFree(PVBOXSHGSMI pHeap, void *pvBuffer);
+void RT_UNTRUSTED_VOLATILE_HOST *VBoxSHGSMIHeapAlloc(PVBOXSHGSMI pHeap, HGSMISIZE cbData, uint8_t u8Channel, uint16_t u16ChannelInfo);
+void VBoxSHGSMIHeapFree(PVBOXSHGSMI pHeap, void RT_UNTRUSTED_VOLATILE_HOST *pvBuffer);
+void RT_UNTRUSTED_VOLATILE_HOST *VBoxSHGSMIHeapBufferAlloc(PVBOXSHGSMI pHeap, HGSMISIZE cbData);
+void VBoxSHGSMIHeapBufferFree(PVBOXSHGSMI pHeap, void RT_UNTRUSTED_VOLATILE_HOST *pvBuffer);
+void RT_UNTRUSTED_VOLATILE_HOST *VBoxSHGSMICommandAlloc(PVBOXSHGSMI pHeap, HGSMISIZE cbData, uint8_t u8Channel, uint16_t u16ChannelInfo);
+void VBoxSHGSMICommandFree(PVBOXSHGSMI pHeap, void RT_UNTRUSTED_VOLATILE_HOST *pvBuffer);
 int VBoxSHGSMICommandProcessCompletion(PVBOXSHGSMI pHeap, VBOXSHGSMIHEADER* pCmd, bool bIrq, struct VBOXVTLIST * pPostProcessList);
 int VBoxSHGSMICommandPostprocessCompletion(PVBOXSHGSMI pHeap, struct VBOXVTLIST * pPostProcessList);
Index: trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPVbva.cpp
===================================================================
--- trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPVbva.cpp	(revision 71517)
+++ trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPVbva.cpp	(revision 71590)
@@ -123,18 +123,19 @@
 #define vboxCmdVbvaSubmit vboxCmdVbvaSubmitHgsmi
 
-static VBOXCMDVBVA_CTL * vboxCmdVbvaCtlCreate(PHGSMIGUESTCOMMANDCONTEXT pHGSMICtx, uint32_t cbCtl)
+static VBOXCMDVBVA_CTL RT_UNTRUSTED_VOLATILE_HOST *vboxCmdVbvaCtlCreate(PHGSMIGUESTCOMMANDCONTEXT pHGSMICtx, uint32_t cbCtl)
 {
     Assert(cbCtl >= sizeof (VBOXCMDVBVA_CTL));
-    return (VBOXCMDVBVA_CTL*)VBoxSHGSMICommandAlloc(&pHGSMICtx->heapCtx, cbCtl, HGSMI_CH_VBVA, VBVA_CMDVBVA_CTL);
-}
-
-static void vboxCmdVbvaCtlFree(PHGSMIGUESTCOMMANDCONTEXT pHGSMICtx, VBOXCMDVBVA_CTL * pCtl)
+    return (VBOXCMDVBVA_CTL RT_UNTRUSTED_VOLATILE_HOST *)VBoxSHGSMICommandAlloc(&pHGSMICtx->heapCtx, cbCtl,
+                                                                                HGSMI_CH_VBVA, VBVA_CMDVBVA_CTL);
+}
+
+static void vboxCmdVbvaCtlFree(PHGSMIGUESTCOMMANDCONTEXT pHGSMICtx, VBOXCMDVBVA_CTL RT_UNTRUSTED_VOLATILE_HOST *pCtl)
 {
     VBoxSHGSMICommandFree(&pHGSMICtx->heapCtx, pCtl);
 }
 
-static int vboxCmdVbvaCtlSubmitSync(PHGSMIGUESTCOMMANDCONTEXT pHGSMICtx, VBOXCMDVBVA_CTL * pCtl)
-{
-    const VBOXSHGSMIHEADER* pHdr = VBoxSHGSMICommandPrepSynch(&pHGSMICtx->heapCtx, pCtl);
+static int vboxCmdVbvaCtlSubmitSync(PHGSMIGUESTCOMMANDCONTEXT pHGSMICtx, VBOXCMDVBVA_CTL RT_UNTRUSTED_VOLATILE_HOST *pCtl)
+{
+    const VBOXSHGSMIHEADER RT_UNTRUSTED_VOLATILE_HOST *pHdr = VBoxSHGSMICommandPrepSynch(&pHGSMICtx->heapCtx, pCtl);
     if (!pHdr)
     {
@@ -176,5 +177,6 @@
 static int vboxCmdVbvaCtlSubmitAsync(PHGSMIGUESTCOMMANDCONTEXT pHGSMICtx, VBOXCMDVBVA_CTL * pCtl, FNVBOXSHGSMICMDCOMPLETION pfnCompletion, void *pvCompletion)
 {
-    const VBOXSHGSMIHEADER* pHdr = VBoxSHGSMICommandPrepAsynch(&pHGSMICtx->heapCtx, pCtl, pfnCompletion, pvCompletion, VBOXSHGSMI_FLAG_GH_ASYNCH_IRQ);
+    const VBOXSHGSMIHEADER RT_UNTRUSTED_VOLATILE_HOST *pHdr = VBoxSHGSMICommandPrepAsynch(&pHGSMICtx->heapCtx, pCtl, pfnCompletion,
+                                                                                          pvCompletion, VBOXSHGSMI_FLAG_GH_ASYNCH_IRQ);
     HGSMIOFFSET offCmd = VBoxSHGSMICommandOffset(&pHGSMICtx->heapCtx, pHdr);
     if (offCmd == HGSMIOFFSET_VOID)
@@ -191,9 +193,7 @@
         return rc;
     }
-    else
-        WARN(("vboxCmdVbvaSubmit returnd %d", rc));
-
+
+    WARN(("vboxCmdVbvaSubmit returnd %d", rc));
     VBoxSHGSMICommandCancelAsynch(&pHGSMICtx->heapCtx, pHdr);
-
     return rc;
 }
@@ -201,5 +201,6 @@
 static int vboxVBVAExCtlSubmitEnableDisable(PVBVAEXBUFFERCONTEXT pCtx, PHGSMIGUESTCOMMANDCONTEXT pHGSMICtx, bool fEnable)
 {
-    VBOXCMDVBVA_CTL_ENABLE *pCtl = (VBOXCMDVBVA_CTL_ENABLE*)vboxCmdVbvaCtlCreate(pHGSMICtx, sizeof (*pCtl));
+    VBOXCMDVBVA_CTL_ENABLE RT_UNTRUSTED_VOLATILE_HOST *pCtl =
+        (VBOXCMDVBVA_CTL_ENABLE RT_UNTRUSTED_VOLATILE_HOST *)vboxCmdVbvaCtlCreate(pHGSMICtx, sizeof (*pCtl));
     if (!pCtl)
     {
@@ -210,5 +211,5 @@
     pCtl->Hdr.u32Type = VBOXCMDVBVACTL_TYPE_ENABLE;
     pCtl->Hdr.i32Result = VERR_NOT_IMPLEMENTED;
-    memset(&pCtl->Enable, 0, sizeof (pCtl->Enable));
+    memset((void *)&pCtl->Enable, 0, sizeof(pCtl->Enable));
     pCtl->Enable.u32Flags  = fEnable? VBVA_F_ENABLE: VBVA_F_DISABLE;
     pCtl->Enable.u32Offset = pCtx->offVRAMBuffer;
@@ -1232,5 +1233,7 @@
         uint32_t *pu32ClientID)
 {
-    VBOXCMDVBVA_CTL_3DCTL_CONNECT *pConnect = (VBOXCMDVBVA_CTL_3DCTL_CONNECT*)vboxCmdVbvaCtlCreate(pHGSMICtx, sizeof (VBOXCMDVBVA_CTL_3DCTL_CONNECT));
+    VBOXCMDVBVA_CTL_3DCTL_CONNECT RT_UNTRUSTED_VOLATILE_HOST *pConnect =
+        (VBOXCMDVBVA_CTL_3DCTL_CONNECT RT_UNTRUSTED_VOLATILE_HOST *)vboxCmdVbvaCtlCreate(pHGSMICtx,
+                                                                                         sizeof(VBOXCMDVBVA_CTL_3DCTL_CONNECT));
     if (!pConnect)
     {
@@ -1268,5 +1271,6 @@
 int vboxCmdVbvaConDisconnect(PHGSMIGUESTCOMMANDCONTEXT pHGSMICtx, uint32_t u32ClientID)
 {
-    VBOXCMDVBVA_CTL_3DCTL *pDisconnect = (VBOXCMDVBVA_CTL_3DCTL*)vboxCmdVbvaCtlCreate(pHGSMICtx, sizeof (VBOXCMDVBVA_CTL_3DCTL));
+    VBOXCMDVBVA_CTL_3DCTL RT_UNTRUSTED_VOLATILE_HOST *pDisconnect =
+        (VBOXCMDVBVA_CTL_3DCTL RT_UNTRUSTED_VOLATILE_HOST*)vboxCmdVbvaCtlCreate(pHGSMICtx, sizeof(VBOXCMDVBVA_CTL_3DCTL));
     if (!pDisconnect)
     {
@@ -1331,5 +1335,5 @@
 void vboxCmdVbvaConCmdFree(PHGSMIGUESTCOMMANDCONTEXT pHGSMICtx, VBOXCMDVBVA_CRCMD_CMD *pCmd)
 {
-    VBOXCMDVBVA_CTL_3DCTL_CMD *pHdr = ((VBOXCMDVBVA_CTL_3DCTL_CMD*)pCmd)-1;
+    VBOXCMDVBVA_CTL_3DCTL_CMD RT_UNTRUSTED_VOLATILE_HOST *pHdr = ((VBOXCMDVBVA_CTL_3DCTL_CMD RT_UNTRUSTED_VOLATILE_HOST *)pCmd) - 1;
     vboxCmdVbvaCtlFree(pHGSMICtx, &pHdr->Hdr);
 }
@@ -1351,14 +1355,15 @@
 }
 
-int VBoxCmdVbvaConCmdSubmitAsync(PVBOXMP_DEVEXT pDevExt, VBOXCMDVBVA_CRCMD_CMD* pCmd, FNVBOXSHGSMICMDCOMPLETION pfnCompletion, void *pvCompletion)
+int VBoxCmdVbvaConCmdSubmitAsync(PVBOXMP_DEVEXT pDevExt, VBOXCMDVBVA_CRCMD_CMD* pCmd,
+                                 PFNVBOXSHGSMICMDCOMPLETION pfnCompletion, void *pvCompletion)
 {
     return vboxCmdVbvaConSubmitAsync(&VBoxCommonFromDeviceExt(pDevExt)->guestCtx, pCmd, pfnCompletion, pvCompletion);
 }
 
-int VBoxCmdVbvaConCmdCompletionData(void *pvCmd, VBOXCMDVBVA_CRCMD_CMD **ppCmd)
-{
-    VBOXCMDVBVA_CTL_3DCTL_CMD *pCmd = (VBOXCMDVBVA_CTL_3DCTL_CMD*)pvCmd;
+int VBoxCmdVbvaConCmdCompletionData(void RT_UNTRUSTED_VOLATILE_HOST *pvCmd, VBOXCMDVBVA_CRCMD_CMD RT_UNTRUSTED_VOLATILE_HOST **ppCmd)
+{
+    VBOXCMDVBVA_CTL_3DCTL_CMD RT_UNTRUSTED_VOLATILE_HOST *pCmd = (VBOXCMDVBVA_CTL_3DCTL_CMD RT_UNTRUSTED_VOLATILE_HOST *)pvCmd;
     if (ppCmd)
-        *ppCmd = (VBOXCMDVBVA_CRCMD_CMD*)(pCmd+1);
+        *ppCmd = (VBOXCMDVBVA_CRCMD_CMD RT_UNTRUSTED_VOLATILE_HOST *)(pCmd + 1);
     return pCmd->Hdr.i32Result;
 }
@@ -1368,5 +1373,7 @@
     Assert(KeGetCurrentIrql() < DISPATCH_LEVEL);
 
-    VBOXCMDVBVA_CTL_RESIZE *pResize = (VBOXCMDVBVA_CTL_RESIZE*)vboxCmdVbvaCtlCreate(&VBoxCommonFromDeviceExt(pDevExt)->guestCtx, sizeof (VBOXCMDVBVA_CTL_RESIZE));
+    VBOXCMDVBVA_CTL_RESIZE RT_UNTRUSTED_VOLATILE_HOST *pResize =
+        (VBOXCMDVBVA_CTL_RESIZE RT_UNTRUSTED_VOLATILE_HOST*)vboxCmdVbvaCtlCreate(&VBoxCommonFromDeviceExt(pDevExt)->guestCtx,
+                                                                                 sizeof(VBOXCMDVBVA_CTL_RESIZE));
     if (!pResize)
     {
@@ -1381,6 +1388,6 @@
     if (RT_SUCCESS(rc))
     {
-        VBOXCMDVBVA_RESIZE_ENTRY* pEntry = &pResize->Resize.aEntries[0];
-        memcpy(pEntry->aTargetMap, pTargetMap, sizeof (pEntry->aTargetMap));
+        VBOXCMDVBVA_RESIZE_ENTRY RT_UNTRUSTED_VOLATILE_HOST *pEntry = &pResize->Resize.aEntries[0];
+        memcpy((void *)&pEntry->aTargetMap[0], pTargetMap, sizeof(pEntry->aTargetMap));
         LOG(("[%d] %dx%d, TargetMap0 0x%x, flags 0x%x",
             pEntry->Screen.u32ViewIndex, pEntry->Screen.u32Width, pEntry->Screen.u32Height, pEntry->aTargetMap[0], pEntry->Screen.u16Flags));
Index: trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPVbva.h
===================================================================
--- trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPVbva.h	(revision 71517)
+++ trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPVbva.h	(revision 71590)
@@ -239,6 +239,7 @@
 VBOXCMDVBVA_CRCMD_CMD* VBoxCmdVbvaConCmdAlloc(PVBOXMP_DEVEXT pDevExt, uint32_t cbCmd);
 void VBoxCmdVbvaConCmdFree(PVBOXMP_DEVEXT pDevExt, VBOXCMDVBVA_CRCMD_CMD* pCmd);
-int VBoxCmdVbvaConCmdSubmitAsync(PVBOXMP_DEVEXT pDevExt, VBOXCMDVBVA_CRCMD_CMD* pCmd, FNVBOXSHGSMICMDCOMPLETION pfnCompletion, void *pvCompletion);
-int VBoxCmdVbvaConCmdCompletionData(void *pvCmd, VBOXCMDVBVA_CRCMD_CMD **ppCmd);
+int VBoxCmdVbvaConCmdSubmitAsync(PVBOXMP_DEVEXT pDevExt, VBOXCMDVBVA_CRCMD_CMD* pCmd,
+                                 PFNVBOXSHGSMICMDCOMPLETION pfnCompletion, void *pvCompletion);
+int VBoxCmdVbvaConCmdCompletionData(void RT_UNTRUSTED_VOLATILE_HOST *pvCmd, VBOXCMDVBVA_CRCMD_CMD RT_UNTRUSTED_VOLATILE_HOST **ppCmd);
 int VBoxCmdVbvaConCmdResize(PVBOXMP_DEVEXT pDevExt, const VBOXWDDM_ALLOC_DATA *pAllocData, const uint32_t *pTargetMap, const POINT * pVScreenPos, uint16_t fFlags);
 #endif /* #ifdef VBOX_WITH_CROGL */
Index: trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPVdma.cpp
===================================================================
--- trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPVdma.cpp	(revision 71517)
+++ trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPVdma.cpp	(revision 71590)
@@ -342,5 +342,6 @@
 }
 
-NTSTATUS vboxVdmaCrSubmitWriteReadAsync(PVBOXMP_DEVEXT pDevExt, VBOXMP_CRPACKER *pCrPacker, uint32_t u32CrConClientID, PFNVBOXMP_CRSHGSMITRANSPORT_SENDWRITEREADASYNC_COMPLETION pfnCompletion, void *pvCompletion)
+NTSTATUS vboxVdmaCrSubmitWriteReadAsync(PVBOXMP_DEVEXT pDevExt, VBOXMP_CRPACKER *pCrPacker, uint32_t u32CrConClientID,
+                                        PFNVBOXMP_CRSHGSMITRANSPORT_SENDWRITEREADASYNC_COMPLETION pfnCompletion, void *pvCompletion)
 {
     Assert(u32CrConClientID);
@@ -547,9 +548,9 @@
             }
 
-            void *pvCommandBuffer = NULL;
-            uint32_t cbCommandBuffer = VBOXMP_CRCMD_HEADER_SIZE;
-            cbCommandBuffer += VBOXMP_CRCMD_SIZE_WINDOWVISIBLEREGIONS(cVRects);
-
-            pvCommandBuffer = VBoxMpCrShgsmiTransportBufAlloc(&pDevExt->CrHgsmiTransport, cbCommandBuffer);
+            ;
+            uint32_t cbCommandBuffer = VBOXMP_CRCMD_HEADER_SIZE
+                                     + VBOXMP_CRCMD_SIZE_WINDOWVISIBLEREGIONS(cVRects);
+            void RT_UNTRUSTED_VOLATILE_HOST *pvCommandBuffer = VBoxMpCrShgsmiTransportBufAlloc(&pDevExt->CrHgsmiTransport,
+                                                                                               cbCommandBuffer);
             if (!pvCommandBuffer)
             {
@@ -603,5 +604,5 @@
     }
 
-    void *pvCommandBuffer = VBoxMpCrShgsmiTransportBufAlloc(&pDevExt->CrHgsmiTransport, cbCommandBuffer);
+    void RT_UNTRUSTED_VOLATILE_HOST *pvCommandBuffer = VBoxMpCrShgsmiTransportBufAlloc(&pDevExt->CrHgsmiTransport, cbCommandBuffer);
     if (!pvCommandBuffer)
     {
@@ -878,5 +879,7 @@
 } VBOXVDMA_CRRXGENERICSYNC, *PVBOXVDMA_CRRXGENERICSYNC;
 
-static DECLCALLBACK(void) vboxVdmaCrRxGenericSyncCompletion(PVBOXMP_CRSHGSMITRANSPORT pCon, int rc, void *pvRx, uint32_t cbRx, void *pvCtx)
+/** @callback_method_impl{PFNVBOXMP_CRSHGSMITRANSPORT_SENDWRITEREADASYNC_COMPLETION}   */
+static DECLCALLBACK(void) vboxVdmaCrRxGenericSyncCompletion(PVBOXMP_CRSHGSMITRANSPORT pCon, int rc,
+                                                            void RT_UNTRUSTED_VOLATILE_HOST *pvRx, uint32_t cbRx, void *pvCtx)
 {
     PVBOXMP_VDMACR_WRITEREADCOMPLETION pvCompletionData = (PVBOXMP_VDMACR_WRITEREADCOMPLETION)pvCtx;
@@ -884,5 +887,5 @@
     if (RT_SUCCESS(rc))
     {
-        rc = VBoxMpCrCmdRxHandler((CRMessageHeader*)pvRx, cbRx);
+        rc = VBoxMpCrCmdRxHandler((CRMessageHeader *)pvRx, cbRx);
         if (!RT_SUCCESS(rc))
         {
@@ -927,5 +930,5 @@
 {
     VBOXMP_CRPACKER CrPacker;
-    void *pvCommandBuffer;
+    void RT_UNTRUSTED_VOLATILE_HOST *pvCommandBuffer;
 } VBOXMP_CRHGSMIMGR;
 
@@ -1095,5 +1098,5 @@
     uint32_t cbCommandBuffer = VBOXMP_CRCMD_HEADER_SIZE + VBOXMP_CRCMD_SIZE_VBOXTEXPRESENT(cRects);
     uint32_t cCommands = 1;
-    void *pvCommandBuffer = VBoxMpCrShgsmiTransportBufAlloc(&pDevExt->CrHgsmiTransport, cbCommandBuffer);
+    void RT_UNTRUSTED_VOLATILE_HOST *pvCommandBuffer = VBoxMpCrShgsmiTransportBufAlloc(&pDevExt->CrHgsmiTransport, cbCommandBuffer);
     if (!pvCommandBuffer)
     {
@@ -1125,5 +1128,5 @@
     uint32_t cbCommandBuffer = VBOXMP_CRCMD_HEADER_SIZE + VBOXMP_CRCMD_SIZE_CHROMIUMPARAMETERICR;
     uint32_t cCommands = 1;
-    void *pvCommandBuffer = VBoxMpCrShgsmiTransportBufAlloc(&pDevExt->CrHgsmiTransport, cbCommandBuffer);
+    void RT_UNTRUSTED_VOLATILE_HOST *pvCommandBuffer = VBoxMpCrShgsmiTransportBufAlloc(&pDevExt->CrHgsmiTransport, cbCommandBuffer);
     if (!pvCommandBuffer)
     {
@@ -1528,5 +1531,7 @@
     int rc = VINF_SUCCESS;
 
-    PVBOXVDMA_CTL pCmd = (PVBOXVDMA_CTL)VBoxSHGSMICommandAlloc(&VBoxCommonFromDeviceExt(pDevExt)->guestCtx.heapCtx, sizeof (VBOXVDMA_CTL), HGSMI_CH_VBVA, VBVA_VDMA_CTL);
+    VBOXVDMA_CTL RT_UNTRUSTED_VOLATILE_HOST *pCmd =
+        (VBOXVDMA_CTL RT_UNTRUSTED_VOLATILE_HOST *)VBoxSHGSMICommandAlloc(&VBoxCommonFromDeviceExt(pDevExt)->guestCtx.heapCtx,
+                                                                           sizeof(VBOXVDMA_CTL), HGSMI_CH_VBVA, VBVA_VDMA_CTL);
     if (pCmd)
     {
@@ -1535,5 +1540,6 @@
         pCmd->i32Result = VERR_NOT_SUPPORTED;
 
-        const VBOXSHGSMIHEADER* pHdr = VBoxSHGSMICommandPrepSynch(&VBoxCommonFromDeviceExt(pDevExt)->guestCtx.heapCtx, pCmd);
+        const VBOXSHGSMIHEADER RT_UNTRUSTED_VOLATILE_HOST *pHdr = VBoxSHGSMICommandPrepSynch(&VBoxCommonFromDeviceExt(pDevExt)->guestCtx.heapCtx,
+                                                                                             pCmd);
         Assert(pHdr);
         if (pHdr)
@@ -1566,5 +1572,5 @@
         }
 
-        VBoxSHGSMICommandFree (&VBoxCommonFromDeviceExt(pDevExt)->guestCtx.heapCtx, pCmd);
+        VBoxSHGSMICommandFree(&VBoxCommonFromDeviceExt(pDevExt)->guestCtx.heapCtx, pCmd);
     }
     else
@@ -1714,16 +1720,17 @@
 
 #ifdef VBOX_WITH_VDMA
-void vboxVdmaCBufDrFree (PVBOXVDMAINFO pInfo, PVBOXVDMACBUF_DR pDr)
-{
-    VBoxSHGSMICommandFree (&pInfo->CmdHeap, pDr);
-}
-
-PVBOXVDMACBUF_DR vboxVdmaCBufDrCreate (PVBOXVDMAINFO pInfo, uint32_t cbTrailingData)
+void vboxVdmaCBufDrFree(PVBOXVDMAINFO pInfo, VBOXVDMACBUF_DR RT_UNTRUSTED_VOLATILE_HOST *pDr)
+{
+    VBoxSHGSMICommandFree(&pInfo->CmdHeap, pDr);
+}
+
+VBOXVDMACBUF_DR RT_UNTRUSTED_VOLATILE_HOST *vboxVdmaCBufDrCreate(PVBOXVDMAINFO pInfo, uint32_t cbTrailingData)
 {
     uint32_t cbDr = VBOXVDMACBUF_DR_SIZE(cbTrailingData);
-    PVBOXVDMACBUF_DR pDr = (PVBOXVDMACBUF_DR)VBoxSHGSMICommandAlloc (&pInfo->CmdHeap, cbDr, HGSMI_CH_VBVA, VBVA_VDMA_CMD);
+    VBOXVDMACBUF_DR RT_UNTRUSTED_VOLATILE_HOST *pDr =
+        (VBOXVDMACBUF_DR RT_UNTRUSTED_VOLATILE_HOST *)VBoxSHGSMICommandAlloc(&pInfo->CmdHeap, cbDr, HGSMI_CH_VBVA, VBVA_VDMA_CMD);
     Assert(pDr);
     if (pDr)
-        memset (pDr, 0, cbDr);
+        memset((void *)pDr, 0, cbDr);
     else
         LOGREL(("VBoxSHGSMICommandAlloc returned NULL"));
@@ -1741,10 +1748,11 @@
 }
 
-static DECLCALLBACK(PFNVBOXSHGSMICMDCOMPLETION) vboxVdmaCBufDrCompletionIrq(PVBOXSHGSMI pHeap, void *pvCmd,
-                                                                            void *pvContext, void **ppvCompletion)
+/** @callback_method_impl{FNVBOXSHGSMICMDCOMPLETION_IRQ} */
+static DECLCALLBACK(PFNVBOXSHGSMICMDCOMPLETION)
+vboxVdmaCBufDrCompletionIrq(PVBOXSHGSMI pHeap, void RT_UNTRUSTED_VOLATILE_HOST *pvCmd, void *pvContext, void **ppvCompletion)
 {
     RT_NOREF(pHeap, ppvCompletion);
     PVBOXMP_DEVEXT pDevExt = (PVBOXMP_DEVEXT)pvContext;
-    PVBOXVDMACBUF_DR pDr = (PVBOXVDMACBUF_DR)pvCmd;
+    VBOXVDMACBUF_DR RT_UNTRUSTED_VOLATILE_HOST *pDr = (VBOXVDMACBUF_DR RT_UNTRUSTED_VOLATILE_HOST *)pvCmd;
 
     DXGK_INTERRUPT_TYPE enmComplType;
@@ -1756,10 +1764,10 @@
     else if (pDr->rc == VERR_INTERRUPTED)
     {
-        Assert(0);
+        AssertFailed();
         enmComplType = DXGK_INTERRUPT_DMA_PREEMPTED;
     }
     else
     {
-        Assert(0);
+        AssertFailed();
         enmComplType = DXGK_INTERRUPT_DMA_FAULTED;
     }
@@ -1775,7 +1783,8 @@
 }
 
-int vboxVdmaCBufDrSubmit(PVBOXMP_DEVEXT pDevExt, PVBOXVDMAINFO pInfo, PVBOXVDMACBUF_DR pDr)
-{
-    const VBOXSHGSMIHEADER* pHdr = VBoxSHGSMICommandPrepAsynchIrq (&pInfo->CmdHeap, pDr, vboxVdmaCBufDrCompletionIrq, pDevExt, VBOXSHGSMI_FLAG_GH_ASYNCH_FORCE);
+int vboxVdmaCBufDrSubmit(PVBOXMP_DEVEXT pDevExt, PVBOXVDMAINFO pInfo, VBOXVDMACBUF_DR RT_UNTRUSTED_VOLATILE_HOST *pDr)
+{
+    const VBOXSHGSMIHEADER RT_UNTRUSTED_VOLATILE_HOST *pHdr =
+        VBoxSHGSMICommandPrepAsynchIrq(&pInfo->CmdHeap, pDr, vboxVdmaCBufDrCompletionIrq, pDevExt, VBOXSHGSMI_FLAG_GH_ASYNCH_FORCE);
     Assert(pHdr);
     int rc = VERR_GENERAL_FAILURE;
@@ -1808,7 +1817,8 @@
 }
 
-int vboxVdmaCBufDrSubmitSynch(PVBOXMP_DEVEXT pDevExt, PVBOXVDMAINFO pInfo, PVBOXVDMACBUF_DR pDr)
-{
-    const VBOXSHGSMIHEADER* pHdr = VBoxSHGSMICommandPrepAsynch (&pInfo->CmdHeap, pDr, NULL, NULL, VBOXSHGSMI_FLAG_GH_SYNCH);
+int vboxVdmaCBufDrSubmitSynch(PVBOXMP_DEVEXT pDevExt, PVBOXVDMAINFO pInfo, VBOXVDMACBUF_DR RT_UNTRUSTED_VOLATILE_HOST *pDr)
+{
+    const VBOXSHGSMIHEADER RT_UNTRUSTED_VOLATILE_HOST *pHdr = VBoxSHGSMICommandPrepAsynch(&pInfo->CmdHeap, pDr, NULL,
+                                                                                          NULL, VBOXSHGSMI_FLAG_GH_SYNCH);
     Assert(pHdr);
     int rc = VERR_GENERAL_FAILURE;
Index: trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPVdma.h
===================================================================
--- trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPVdma.h	(revision 71517)
+++ trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPVdma.h	(revision 71590)
@@ -71,7 +71,6 @@
 NTSTATUS vboxVdmaDdiCmdSubmitted(PVBOXMP_DEVEXT pDevExt, PVBOXVDMADDI_CMD pCmd);
 
-DECLINLINE(VOID) vboxVdmaDdiCmdInit(PVBOXVDMADDI_CMD pCmd,
-        uint32_t u32NodeOrdinal, uint32_t u32FenceId,
-        PFNVBOXVDMADDICMDCOMPLETE_DPC pfnComplete, PVOID pvComplete)
+DECLINLINE(VOID) vboxVdmaDdiCmdInit(PVBOXVDMADDI_CMD pCmd, uint32_t u32NodeOrdinal, uint32_t u32FenceId,
+                                    PFNVBOXVDMADDICMDCOMPLETE_DPC pfnComplete, PVOID pvComplete)
 {
     pCmd->QueueEntry.Blink = NULL;
@@ -283,8 +282,8 @@
     return VBoxSHGSMICommandPtrOffset(&pInfo->CmdHeap, pvPtr);
 }
-int vboxVdmaCBufDrSubmit(PVBOXMP_DEVEXT pDevExt, PVBOXVDMAINFO pInfo, PVBOXVDMACBUF_DR pDr);
-int vboxVdmaCBufDrSubmitSynch(PVBOXMP_DEVEXT pDevExt, PVBOXVDMAINFO pInfo, PVBOXVDMACBUF_DR pDr);
-struct VBOXVDMACBUF_DR* vboxVdmaCBufDrCreate(PVBOXVDMAINFO pInfo, uint32_t cbTrailingData);
-void vboxVdmaCBufDrFree(PVBOXVDMAINFO pInfo, struct VBOXVDMACBUF_DR* pDr);
+int vboxVdmaCBufDrSubmit(PVBOXMP_DEVEXT pDevExt, PVBOXVDMAINFO pInfo, VBOXVDMACBUF_DR RT_UNTRUSTED_VOLATILE_HOST *pDr);
+int vboxVdmaCBufDrSubmitSynch(PVBOXMP_DEVEXT pDevExt, PVBOXVDMAINFO pInfo, VBOXVDMACBUF_DR RT_UNTRUSTED_VOLATILE_HOST *pDr);
+struct VBOXVDMACBUF_DR RT_UNTRUSTED_VOLATILE_HOST *vboxVdmaCBufDrCreate(PVBOXVDMAINFO pInfo, uint32_t cbTrailingData);
+void vboxVdmaCBufDrFree(PVBOXVDMAINFO pInfo, struct VBOXVDMACBUF_DR RT_UNTRUSTED_VOLATILE_HOST *pDr);
 
 #define VBOXVDMACBUF_DR_DATA_OFFSET() (sizeof (VBOXVDMACBUF_DR))
Index: trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPVhwa.cpp
===================================================================
--- trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPVhwa.cpp	(revision 71517)
+++ trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPVhwa.cpp	(revision 71590)
@@ -27,7 +27,8 @@
 
 
-DECLINLINE(void) vboxVhwaHdrInit(VBOXVHWACMD* pHdr, D3DDDI_VIDEO_PRESENT_SOURCE_ID srcId, VBOXVHWACMD_TYPE enmCmd)
-{
-    memset(pHdr, 0, sizeof(VBOXVHWACMD));
+DECLINLINE(void) vboxVhwaHdrInit(VBOXVHWACMD RT_UNTRUSTED_VOLATILE_HOST *pHdr,
+                                 D3DDDI_VIDEO_PRESENT_SOURCE_ID srcId, VBOXVHWACMD_TYPE enmCmd)
+{
+    memset((void *)pHdr, 0, sizeof(VBOXVHWACMD));
     pHdr->iDisplay = srcId;
     pHdr->rc = VERR_GENERAL_FAILURE;
@@ -39,5 +40,5 @@
 
 #ifdef VBOXVHWA_WITH_SHGSMI
-static int vboxVhwaCommandSubmitHgsmi(struct _DEVICE_EXTENSION* pDevExt, HGSMIOFFSET offDr)
+static int vboxVhwaCommandSubmitHgsmi(struct _DEVICE_EXTENSION *pDevExt, HGSMIOFFSET offDr)
 {
     VBoxHGSMIGuestWrite(pDevExt, offDr);
@@ -45,5 +46,5 @@
 }
 #else
-DECLINLINE(void) vbvaVhwaCommandRelease(PVBOXMP_DEVEXT pDevExt, VBOXVHWACMD* pCmd)
+DECLINLINE(void) vbvaVhwaCommandRelease(PVBOXMP_DEVEXT pDevExt, VBOXVHWACMD RT_UNTRUSTED_VOLATILE_HOST *pCmd)
 {
     uint32_t cRefs = ASMAtomicDecU32(&pCmd->cRefs);
@@ -55,5 +56,5 @@
 }
 
-DECLINLINE(void) vbvaVhwaCommandRetain(VBOXVHWACMD *pCmd)
+DECLINLINE(void) vbvaVhwaCommandRetain(VBOXVHWACMD RT_UNTRUSTED_VOLATILE_HOST *pCmd)
 {
     ASMAtomicIncU32(&pCmd->cRefs);
@@ -61,5 +62,6 @@
 
 /* do not wait for completion */
-void vboxVhwaCommandSubmitAsynch(PVBOXMP_DEVEXT pDevExt, VBOXVHWACMD* pCmd, PFNVBOXVHWACMDCOMPLETION pfnCompletion, void *pContext)
+void vboxVhwaCommandSubmitAsynch(PVBOXMP_DEVEXT pDevExt, VBOXVHWACMD RT_UNTRUSTED_VOLATILE_HOST *pCmd,
+                                 PFNVBOXVHWACMDCOMPLETION pfnCompletion, void *pContext)
 {
     pCmd->GuestVBVAReserved1 = (uintptr_t)pfnCompletion;
@@ -69,7 +71,8 @@
     VBoxHGSMIBufferSubmit(&VBoxCommonFromDeviceExt(pDevExt)->guestCtx, pCmd);
 
-    if(   !(pCmd->Flags & VBOXVHWACMD_FLAG_HG_ASYNCH)
-       || (   (pCmd->Flags & VBOXVHWACMD_FLAG_GH_ASYNCH_NOCOMPLETION)
-           && (pCmd->Flags & VBOXVHWACMD_FLAG_HG_ASYNCH_RETURNED) ) )
+    uint32_t const fFlags = pCmd->Flags;
+    if(   !(fFlags & VBOXVHWACMD_FLAG_HG_ASYNCH)
+       || (   (fFlags & VBOXVHWACMD_FLAG_GH_ASYNCH_NOCOMPLETION)
+           && (fFlags & VBOXVHWACMD_FLAG_HG_ASYNCH_RETURNED) ) )
     {
         /* the command is completed */
@@ -80,11 +83,13 @@
 }
 
-static DECLCALLBACK(void) vboxVhwaCompletionSetEvent(PVBOXMP_DEVEXT pDevExt, VBOXVHWACMD * pCmd, void * pvContext)
-{
-    RT_NOREF(pDevExt,  pCmd);
+/** @callback_method_impl{FNVBOXVHWACMDCOMPLETION} */
+static DECLCALLBACK(void)
+vboxVhwaCompletionSetEvent(PVBOXMP_DEVEXT pDevExt, VBOXVHWACMD RT_UNTRUSTED_VOLATILE_HOST *pCmd, void *pvContext)
+{
+    RT_NOREF(pDevExt, pCmd);
     RTSemEventSignal((RTSEMEVENT)pvContext);
 }
 
-void vboxVhwaCommandSubmitAsynchByEvent(PVBOXMP_DEVEXT pDevExt, VBOXVHWACMD* pCmd, RTSEMEVENT hEvent)
+void vboxVhwaCommandSubmitAsynchByEvent(PVBOXMP_DEVEXT pDevExt, VBOXVHWACMD RT_UNTRUSTED_VOLATILE_HOST *pCmd, RTSEMEVENT hEvent)
 {
     vboxVhwaCommandSubmitAsynch(pDevExt, pCmd, vboxVhwaCompletionSetEvent, hEvent);
@@ -98,32 +103,30 @@
 }
 
-VBOXVHWACMD* vboxVhwaCommandCreate(PVBOXMP_DEVEXT pDevExt, D3DDDI_VIDEO_PRESENT_SOURCE_ID srcId, VBOXVHWACMD_TYPE enmCmd, VBOXVHWACMD_LENGTH cbCmd)
+VBOXVHWACMD RT_UNTRUSTED_VOLATILE_HOST *vboxVhwaCommandCreate(PVBOXMP_DEVEXT pDevExt, D3DDDI_VIDEO_PRESENT_SOURCE_ID srcId,
+                                                              VBOXVHWACMD_TYPE enmCmd, VBOXVHWACMD_LENGTH cbCmd)
 {
     vboxVhwaCommandCheckCompletion(pDevExt);
+    VBOXVHWACMD RT_UNTRUSTED_VOLATILE_HOST *pHdr;
 #ifdef VBOXVHWA_WITH_SHGSMI
-    VBOXVHWACMD* pHdr = (VBOXVHWACMD*)VBoxSHGSMICommandAlloc(&pDevExt->u.primary.hgsmiAdapterHeap,
-                              cbCmd + VBOXVHWACMD_HEADSIZE(),
-                              HGSMI_CH_VBVA,
-                              VBVA_VHWA_CMD);
+    pHdr = (VBOXVHWACMD RT_UNTRUSTED_VOLATILE_HOST *)VBoxSHGSMICommandAlloc(&pDevExt->u.primary.hgsmiAdapterHeap,
+                                                                            cbCmd + VBOXVHWACMD_HEADSIZE(),
+                                                                            HGSMI_CH_VBVA,
+                                                                            VBVA_VHWA_CMD);
 #else
-    VBOXVHWACMD* pHdr = (VBOXVHWACMD*)VBoxHGSMIBufferAlloc(&VBoxCommonFromDeviceExt(pDevExt)->guestCtx,
-                              cbCmd + VBOXVHWACMD_HEADSIZE(),
-                              HGSMI_CH_VBVA,
-                              VBVA_VHWA_CMD);
+    pHdr = (VBOXVHWACMD RT_UNTRUSTED_VOLATILE_HOST *)VBoxHGSMIBufferAlloc(&VBoxCommonFromDeviceExt(pDevExt)->guestCtx,
+                                                                          cbCmd + VBOXVHWACMD_HEADSIZE(),
+                                                                          HGSMI_CH_VBVA,
+                                                                          VBVA_VHWA_CMD);
 #endif
     Assert(pHdr);
     if (!pHdr)
-    {
         LOGREL(("VBoxHGSMIBufferAlloc failed"));
-    }
     else
-    {
         vboxVhwaHdrInit(pHdr, srcId, enmCmd);
-    }
 
     return pHdr;
 }
 
-void vboxVhwaCommandFree(PVBOXMP_DEVEXT pDevExt, VBOXVHWACMD* pCmd)
+void vboxVhwaCommandFree(PVBOXMP_DEVEXT pDevExt, VBOXVHWACMD RT_UNTRUSTED_VOLATILE_HOST *pCmd)
 {
 #ifdef VBOXVHWA_WITH_SHGSMI
@@ -134,5 +137,5 @@
 }
 
-int vboxVhwaCommandSubmit(PVBOXMP_DEVEXT pDevExt, VBOXVHWACMD* pCmd)
+int vboxVhwaCommandSubmit(PVBOXMP_DEVEXT pDevExt, VBOXVHWACMD RT_UNTRUSTED_VOLATILE_HOST *pCmd)
 {
 #ifdef VBOXVHWA_WITH_SHGSMI
@@ -184,5 +187,7 @@
 
 #ifndef VBOXVHWA_WITH_SHGSMI
-static DECLCALLBACK(void) vboxVhwaCompletionFreeCmd(PVBOXMP_DEVEXT pDevExt, VBOXVHWACMD *pCmd, void *pvContext)
+/** @callback_method_impl{FNVBOXVHWACMDCOMPLETION} */
+static DECLCALLBACK(void)
+vboxVhwaCompletionFreeCmd(PVBOXMP_DEVEXT pDevExt, VBOXVHWACMD RT_UNTRUSTED_VOLATILE_HOST *pCmd, void *pvContext)
 {
     RT_NOREF(pvContext);
@@ -197,5 +202,5 @@
         /* need to save next since the command may be released in a pfnCallback and thus its data might be invalid */
         pNext = pCur->pNext;
-        VBOXVHWACMD *pCmd = VBOXVHWA_LISTENTRY2CMD(pCur);
+        VBOXVHWACMD RT_UNTRUSTED_VOLATILE_HOST *pCmd = VBOXVHWA_LISTENTRY2CMD(pCur);
         PFNVBOXVHWACMDCOMPLETION pfnCallback = (PFNVBOXVHWACMDCOMPLETION)pCmd->GuestVBVAReserved1;
         void *pvCallback = (void*)pCmd->GuestVBVAReserved2;
@@ -206,5 +211,5 @@
 #endif
 
-void vboxVhwaCommandSubmitAsynchAndComplete(PVBOXMP_DEVEXT pDevExt, VBOXVHWACMD* pCmd)
+void vboxVhwaCommandSubmitAsynchAndComplete(PVBOXMP_DEVEXT pDevExt, VBOXVHWACMD RT_UNTRUSTED_VOLATILE_HOST *pCmd)
 {
 #ifdef VBOXVHWA_WITH_SHGSMI
@@ -231,15 +236,9 @@
 VBOXVHWACMD_QUERYINFO1* vboxVhwaQueryHostInfo1(PVBOXMP_DEVEXT pDevExt, D3DDDI_VIDEO_PRESENT_SOURCE_ID srcId)
 {
-    VBOXVHWACMD* pCmd = vboxVhwaCommandCreate(pDevExt, srcId, VBOXVHWACMD_TYPE_QUERY_INFO1, sizeof(VBOXVHWACMD_QUERYINFO1));
-    VBOXVHWACMD_QUERYINFO1 *pInfo1;
-
-    Assert(pCmd);
-    if (!pCmd)
-    {
-        LOGREL(("vboxVhwaCommandCreate failed"));
-        return NULL;
-    }
-
-    pInfo1 = VBOXVHWACMD_BODY(pCmd, VBOXVHWACMD_QUERYINFO1);
+    VBOXVHWACMD RT_UNTRUSTED_VOLATILE_HOST *pCmd = vboxVhwaCommandCreate(pDevExt, srcId, VBOXVHWACMD_TYPE_QUERY_INFO1,
+                                                                         sizeof(VBOXVHWACMD_QUERYINFO1));
+    AssertReturnStmt(pCmd, LOGREL(("vboxVhwaCommandCreate failed")), NULL);
+
+    VBOXVHWACMD_QUERYINFO1 *pInfo1 = VBOXVHWACMD_BODY(pCmd, VBOXVHWACMD_QUERYINFO1);
     pInfo1->u.in.guestVersion.maj = VBOXVHWA_VERSION_MAJ;
     pInfo1->u.in.guestVersion.min = VBOXVHWA_VERSION_MIN;
@@ -249,11 +248,7 @@
     int rc = vboxVhwaCommandSubmit(pDevExt, pCmd);
     AssertRC(rc);
-    if(RT_SUCCESS(rc))
-    {
-        if(RT_SUCCESS(pCmd->rc))
-        {
+    if (RT_SUCCESS(rc))
+        if (RT_SUCCESS(pCmd->rc))
             return VBOXVHWACMD_BODY(pCmd, VBOXVHWACMD_QUERYINFO1);
-        }
-    }
 
     vboxVhwaCommandFree(pDevExt, pCmd);
@@ -263,14 +258,9 @@
 VBOXVHWACMD_QUERYINFO2* vboxVhwaQueryHostInfo2(PVBOXMP_DEVEXT pDevExt, D3DDDI_VIDEO_PRESENT_SOURCE_ID srcId, uint32_t numFourCC)
 {
-    VBOXVHWACMD* pCmd = vboxVhwaCommandCreate(pDevExt, srcId, VBOXVHWACMD_TYPE_QUERY_INFO2, VBOXVHWAINFO2_SIZE(numFourCC));
-    VBOXVHWACMD_QUERYINFO2 *pInfo2;
-    Assert(pCmd);
-    if (!pCmd)
-    {
-        LOGREL(("vboxVhwaCommandCreate failed"));
-        return NULL;
-    }
-
-    pInfo2 = VBOXVHWACMD_BODY(pCmd, VBOXVHWACMD_QUERYINFO2);
+    VBOXVHWACMD RT_UNTRUSTED_VOLATILE_HOST *pCmd = vboxVhwaCommandCreate(pDevExt, srcId, VBOXVHWACMD_TYPE_QUERY_INFO2,
+                                                                         VBOXVHWAINFO2_SIZE(numFourCC));
+    AssertReturnStmt(pCmd, LOGREL(("vboxVhwaCommandCreate failed")), NULL);
+
+    VBOXVHWACMD_QUERYINFO2 *pInfo2 = VBOXVHWACMD_BODY(pCmd, VBOXVHWACMD_QUERYINFO2);
     pInfo2->numFourCC = numFourCC;
 
@@ -295,16 +285,8 @@
 int vboxVhwaEnable(PVBOXMP_DEVEXT pDevExt, D3DDDI_VIDEO_PRESENT_SOURCE_ID srcId)
 {
-    int rc = VERR_GENERAL_FAILURE;
-    VBOXVHWACMD* pCmd;
-
-    pCmd = vboxVhwaCommandCreate(pDevExt, srcId, VBOXVHWACMD_TYPE_ENABLE, 0);
-    Assert(pCmd);
-    if (!pCmd)
-    {
-        LOGREL(("vboxVhwaCommandCreate failed"));
-        return rc;
-    }
-
-    rc = vboxVhwaCommandSubmit(pDevExt, pCmd);
+    VBOXVHWACMD RT_UNTRUSTED_VOLATILE_HOST *pCmd = vboxVhwaCommandCreate(pDevExt, srcId, VBOXVHWACMD_TYPE_ENABLE, 0);
+    AssertReturnStmt(pCmd, LOGREL(("vboxVhwaCommandCreate failed")), VERR_GENERAL_FAILURE);
+
+    int rc = vboxVhwaCommandSubmit(pDevExt, pCmd);
     AssertRC(rc);
     if(RT_SUCCESS(rc))
@@ -325,18 +307,10 @@
     vboxVhwaCommandCheckCompletion(pDevExt);
 
-    int rc = VERR_GENERAL_FAILURE;
-    VBOXVHWACMD* pCmd;
-
-    pCmd = vboxVhwaCommandCreate(pDevExt, srcId, VBOXVHWACMD_TYPE_DISABLE, 0);
-    Assert(pCmd);
-    if (!pCmd)
-    {
-        LOGREL(("vboxVhwaCommandCreate failed"));
-        return rc;
-    }
-
-    rc = vboxVhwaCommandSubmit(pDevExt, pCmd);
+    VBOXVHWACMD RT_UNTRUSTED_VOLATILE_HOST *pCmd  = vboxVhwaCommandCreate(pDevExt, srcId, VBOXVHWACMD_TYPE_DISABLE, 0);
+    AssertReturnStmt(pCmd, LOGREL(("vboxVhwaCommandCreate failed")), VERR_GENERAL_FAILURE);
+
+    int rc = vboxVhwaCommandSubmit(pDevExt, pCmd);
     AssertRC(rc);
-    if(RT_SUCCESS(rc))
+    if (RT_SUCCESS(rc))
     {
         if(RT_SUCCESS(pCmd->rc))
@@ -511,8 +485,8 @@
         return VERR_INVALID_STATE;
 
-    VBOXVHWACMD* pCmd = vboxVhwaCommandCreate(pDevExt, VidPnSourceId,
-            VBOXVHWACMD_TYPE_SURF_DESTROY, sizeof(VBOXVHWACMD_SURF_DESTROY));
+    VBOXVHWACMD RT_UNTRUSTED_VOLATILE_HOST *pCmd = vboxVhwaCommandCreate(pDevExt, VidPnSourceId, VBOXVHWACMD_TYPE_SURF_DESTROY,
+                                                                         sizeof(VBOXVHWACMD_SURF_DESTROY));
     Assert(pCmd);
-    if(pCmd)
+    if (pCmd)
     {
         VBOXVHWACMD_SURF_DESTROY * pBody = VBOXVHWACMD_BODY(pCmd, VBOXVHWACMD_SURF_DESTROY);
@@ -636,6 +610,6 @@
 {
     /* the first thing we need is to post create primary */
-    VBOXVHWACMD* pCmd = vboxVhwaCommandCreate(pDevExt, VidPnSourceId,
-                VBOXVHWACMD_TYPE_SURF_CREATE, sizeof(VBOXVHWACMD_SURF_CREATE));
+    VBOXVHWACMD RT_UNTRUSTED_VOLATILE_HOST *pCmd = vboxVhwaCommandCreate(pDevExt, VidPnSourceId, VBOXVHWACMD_TYPE_SURF_CREATE,
+                                                                         sizeof(VBOXVHWACMD_SURF_CREATE));
     Assert(pCmd);
     if (pCmd)
@@ -671,6 +645,6 @@
 {
     /* the first thing we need is to post create primary */
-    VBOXVHWACMD* pCmd = vboxVhwaCommandCreate(pDevExt, VidPnSourceId,
-            VBOXVHWACMD_TYPE_SURF_GETINFO, sizeof(VBOXVHWACMD_SURF_GETINFO));
+    VBOXVHWACMD RT_UNTRUSTED_VOLATILE_HOST *pCmd = vboxVhwaCommandCreate(pDevExt, VidPnSourceId, VBOXVHWACMD_TYPE_SURF_GETINFO,
+                                                                         sizeof(VBOXVHWACMD_SURF_GETINFO));
     Assert(pCmd);
     if (pCmd)
@@ -844,8 +818,9 @@
         PVBOXWDDM_OVERLAYFLIP_INFO pOurInfo = (PVBOXWDDM_OVERLAYFLIP_INFO)pFlipInfo->pPrivateDriverData;
 
-        VBOXVHWACMD* pCmd = vboxVhwaCommandCreate(pOverlay->pDevExt, pOverlay->VidPnSourceId,
-                VBOXVHWACMD_TYPE_SURF_FLIP, sizeof(VBOXVHWACMD_SURF_FLIP));
+        VBOXVHWACMD RT_UNTRUSTED_VOLATILE_HOST *pCmd = vboxVhwaCommandCreate(pOverlay->pDevExt, pOverlay->VidPnSourceId,
+                                                                             VBOXVHWACMD_TYPE_SURF_FLIP,
+                                                                             sizeof(VBOXVHWACMD_SURF_FLIP));
         Assert(pCmd);
-        if(pCmd)
+        if (pCmd)
         {
             VBOXVHWACMD_SURF_FLIP * pBody = VBOXVHWACMD_BODY(pCmd, VBOXVHWACMD_SURF_FLIP);
@@ -915,6 +890,7 @@
 
     int rc;
-    VBOXVHWACMD* pCmd = vboxVhwaCommandCreate(pOverlay->pDevExt, pOverlay->VidPnSourceId,
-                VBOXVHWACMD_TYPE_SURF_FLIP, RT_OFFSETOF(VBOXVHWACMD_SURF_COLORFILL, u.in.aRects[pCF->ClrFill.Rects.cRects]));
+    VBOXVHWACMD RT_UNTRUSTED_VOLATILE_HOST *pCmd =
+        vboxVhwaCommandCreate(pOverlay->pDevExt, pOverlay->VidPnSourceId, VBOXVHWACMD_TYPE_SURF_FLIP,
+                              RT_OFFSETOF(VBOXVHWACMD_SURF_COLORFILL, u.in.aRects[pCF->ClrFill.Rects.cRects]));
     Assert(pCmd);
     if(pCmd)
@@ -1003,8 +979,9 @@
         PVBOXWDDM_OVERLAY_INFO pOurInfo = (PVBOXWDDM_OVERLAY_INFO)pOverlayInfo->pPrivateDriverData;
 
-        VBOXVHWACMD* pCmd = vboxVhwaCommandCreate(pOverlay->pDevExt, pOverlay->VidPnSourceId,
-                VBOXVHWACMD_TYPE_SURF_OVERLAY_UPDATE, sizeof(VBOXVHWACMD_SURF_OVERLAY_UPDATE));
+        VBOXVHWACMD RT_UNTRUSTED_VOLATILE_HOST * pCmd = vboxVhwaCommandCreate(pOverlay->pDevExt, pOverlay->VidPnSourceId,
+                                                                              VBOXVHWACMD_TYPE_SURF_OVERLAY_UPDATE,
+                                                                              sizeof(VBOXVHWACMD_SURF_OVERLAY_UPDATE));
         Assert(pCmd);
-        if(pCmd)
+        if (pCmd)
         {
             VBOXVHWACMD_SURF_OVERLAY_UPDATE * pBody = VBOXVHWACMD_BODY(pCmd, VBOXVHWACMD_SURF_OVERLAY_UPDATE);
Index: trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPVhwa.h
===================================================================
--- trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPVhwa.h	(revision 71517)
+++ trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPVhwa.h	(revision 71590)
@@ -23,25 +23,26 @@
 #include "VBoxMPShgsmi.h"
 
-VBOXVHWACMD* vboxVhwaCommandCreate(PVBOXMP_DEVEXT pDevExt,
-        D3DDDI_VIDEO_PRESENT_SOURCE_ID srcId,
-        VBOXVHWACMD_TYPE enmCmd,
-        VBOXVHWACMD_LENGTH cbCmd);
+VBOXVHWACMD RT_UNTRUSTED_VOLATILE_HOST * vboxVhwaCommandCreate(PVBOXMP_DEVEXT pDevExt,
+                                                               D3DDDI_VIDEO_PRESENT_SOURCE_ID srcId,
+                                                               VBOXVHWACMD_TYPE enmCmd,
+                                                               VBOXVHWACMD_LENGTH cbCmd);
 
-void vboxVhwaCommandFree(PVBOXMP_DEVEXT pDevExt, VBOXVHWACMD* pCmd);
-int vboxVhwaCommandSubmit(PVBOXMP_DEVEXT pDevExt, VBOXVHWACMD* pCmd);
-int vboxVhwaCommandSubmit(PVBOXMP_DEVEXT pDevExt, VBOXVHWACMD* pCmd);
-void vboxVhwaCommandSubmitAsynchAndComplete(PVBOXMP_DEVEXT pDevExt, VBOXVHWACMD* pCmd);
+void vboxVhwaCommandFree(PVBOXMP_DEVEXT pDevExt, VBOXVHWACMD RT_UNTRUSTED_VOLATILE_HOST *pCmd);
+int  vboxVhwaCommandSubmit(PVBOXMP_DEVEXT pDevExt, VBOXVHWACMD RT_UNTRUSTED_VOLATILE_HOST * pCmd);
+void vboxVhwaCommandSubmitAsynchAndComplete(PVBOXMP_DEVEXT pDevExt, VBOXVHWACMD RT_UNTRUSTED_VOLATILE_HOST *pCmd);
 
 #ifndef VBOXVHWA_WITH_SHGSMI
-typedef DECLCALLBACK(void) FNVBOXVHWACMDCOMPLETION(PVBOXMP_DEVEXT pDevExt, VBOXVHWACMD * pCmd, void * pContext);
+typedef DECLCALLBACK(void) FNVBOXVHWACMDCOMPLETION(PVBOXMP_DEVEXT pDevExt, VBOXVHWACMD RT_UNTRUSTED_VOLATILE_HOST * pCmd,
+                                                   void *pvContext);
 typedef FNVBOXVHWACMDCOMPLETION *PFNVBOXVHWACMDCOMPLETION;
 
-void vboxVhwaCommandSubmitAsynch(PVBOXMP_DEVEXT pDevExt, VBOXVHWACMD* pCmd, PFNVBOXVHWACMDCOMPLETION pfnCompletion, void * pContext);
-void vboxVhwaCommandSubmitAsynchByEvent(PVBOXMP_DEVEXT pDevExt, VBOXVHWACMD* pCmd, RTSEMEVENT hEvent);
+void vboxVhwaCommandSubmitAsynch(PVBOXMP_DEVEXT pDevExt, VBOXVHWACMD RT_UNTRUSTED_VOLATILE_HOST *pCmd,
+                                 PFNVBOXVHWACMDCOMPLETION pfnCompletion, void * pContext);
+void vboxVhwaCommandSubmitAsynchByEvent(PVBOXMP_DEVEXT pDevExt, VBOXVHWACMD RT_UNTRUSTED_VOLATILE_HOST *pCmd, RTSEMEVENT hEvent);
 
-#define VBOXVHWA_CMD2LISTENTRY(_pCmd) ((PVBOXVTLIST_ENTRY)&(_pCmd)->u.pNext)
-#define VBOXVHWA_LISTENTRY2CMD(_pEntry) ( (VBOXVHWACMD*)((uint8_t *)(_pEntry) - RT_OFFSETOF(VBOXVHWACMD, u.pNext)) )
+#define VBOXVHWA_CMD2LISTENTRY(_pCmd)   ((PVBOXVTLIST_ENTRY)&(_pCmd)->u.pNext)
+#define VBOXVHWA_LISTENTRY2CMD(_pEntry) ( (VBOXVHWACMD RT_UNTRUSTED_VOLATILE_HOST *)((uint8_t *)(_pEntry) - RT_OFFSETOF(VBOXVHWACMD, u.pNext)) )
 
-DECLINLINE(void) vboxVhwaPutList(VBOXVTLIST *pList, VBOXVHWACMD* pCmd)
+DECLINLINE(void) vboxVhwaPutList(VBOXVTLIST *pList, VBOXVHWACMD RT_UNTRUSTED_VOLATILE_HOST *pCmd)
 {
     vboxVtListPut(pList, VBOXVHWA_CMD2LISTENTRY(pCmd), VBOXVHWA_CMD2LISTENTRY(pCmd));
Index: trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPWddm.cpp
===================================================================
--- trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPWddm.cpp	(revision 71517)
+++ trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPWddm.cpp	(revision 71590)
@@ -211,23 +211,21 @@
 int vboxWddmGhDisplayPostInfoScreen(PVBOXMP_DEVEXT pDevExt, const VBOXWDDM_ALLOC_DATA *pAllocData, const POINT * pVScreenPos, uint16_t fFlags)
 {
-    void *p = VBoxHGSMIBufferAlloc (&VBoxCommonFromDeviceExt(pDevExt)->guestCtx,
-                                      sizeof (VBVAINFOSCREEN),
-                                      HGSMI_CH_VBVA,
-                                      VBVA_INFO_SCREEN);
-    if (!p)
+    VBVAINFOSCREEN RT_UNTRUSTED_VOLATILE_HOST *pScreen =
+        (VBVAINFOSCREEN RT_UNTRUSTED_VOLATILE_HOST *)VBoxHGSMIBufferAlloc(&VBoxCommonFromDeviceExt(pDevExt)->guestCtx,
+                                                                          sizeof(VBVAINFOSCREEN),
+                                                                          HGSMI_CH_VBVA,
+                                                                          VBVA_INFO_SCREEN);
+    if (!pScreen != NULL)
     {
         WARN(("VBoxHGSMIBufferAlloc failed"));
-
         return VERR_OUT_OF_RESOURCES;
     }
-
-    VBVAINFOSCREEN *pScreen = (VBVAINFOSCREEN *)p;
 
     int rc = vboxWddmScreenInfoInit(pScreen, pAllocData, pVScreenPos, fFlags);
     if (RT_SUCCESS(rc))
     {
-        pScreen->u32StartOffset  = 0; //(uint32_t)offVram; /* we pretend the view is located at the start of each framebuffer */
-
-        rc = VBoxHGSMIBufferSubmit (&VBoxCommonFromDeviceExt(pDevExt)->guestCtx, p);
+        pScreen->u32StartOffset = 0; //(uint32_t)offVram; /* we pretend the view is located at the start of each framebuffer */
+
+        rc = VBoxHGSMIBufferSubmit(&VBoxCommonFromDeviceExt(pDevExt)->guestCtx, pScreen);
         if (RT_FAILURE(rc))
             WARN(("VBoxHGSMIBufferSubmit failed %d", rc));
@@ -236,5 +234,5 @@
         WARN(("VBoxHGSMIBufferSubmit failed %d", rc));
 
-    VBoxHGSMIBufferFree (&VBoxCommonFromDeviceExt(pDevExt)->guestCtx, p);
+    VBoxHGSMIBufferFree(&VBoxCommonFromDeviceExt(pDevExt)->guestCtx, pScreen);
 
     return rc;
@@ -251,28 +249,22 @@
 
     /* Issue the screen info command. */
-    void *p = VBoxHGSMIBufferAlloc (&VBoxCommonFromDeviceExt(pDevExt)->guestCtx,
-                                      sizeof (VBVAINFOVIEW),
-                                      HGSMI_CH_VBVA,
-                                      VBVA_INFO_VIEW);
-    if (!p)
+    VBVAINFOVIEW RT_UNTRUSTED_VOLATILE_HOST *pView =
+        (VBVAINFOVIEW RT_UNTRUSTED_VOLATILE_HOST *)VBoxHGSMIBufferAlloc(&VBoxCommonFromDeviceExt(pDevExt)->guestCtx,
+                                                                        sizeof(VBVAINFOVIEW), HGSMI_CH_VBVA, VBVA_INFO_VIEW);
+    if (!pView)
     {
         WARN(("VBoxHGSMIBufferAlloc failed"));
         return VERR_OUT_OF_RESOURCES;
     }
-
-    VBVAINFOVIEW *pView = (VBVAINFOVIEW *)p;
-
     pView->u32ViewIndex     = pAllocData->SurfDesc.VidPnSourceId;
     pView->u32ViewOffset    = (uint32_t)offVram; /* we pretend the view is located at the start of each framebuffer */
     pView->u32ViewSize      = vboxWddmVramCpuVisibleSegmentSize(pDevExt)/VBoxCommonFromDeviceExt(pDevExt)->cDisplays;
-
     pView->u32MaxScreenSize = pView->u32ViewSize;
 
-    int rc = VBoxHGSMIBufferSubmit (&VBoxCommonFromDeviceExt(pDevExt)->guestCtx, p);
+    int rc = VBoxHGSMIBufferSubmit (&VBoxCommonFromDeviceExt(pDevExt)->guestCtx, pView);
     if (RT_FAILURE(rc))
         WARN(("VBoxHGSMIBufferSubmit failed %d", rc));
 
-    VBoxHGSMIBufferFree (&VBoxCommonFromDeviceExt(pDevExt)->guestCtx, p);
-
+    VBoxHGSMIBufferFree(&VBoxCommonFromDeviceExt(pDevExt)->guestCtx, pView);
     return rc;
 }
@@ -1561,5 +1553,6 @@
 
             uint16_t chInfo;
-            uint8_t *pvCmd = HGSMIBufferDataAndChInfoFromOffset (&VBoxCommonFromDeviceExt(pDevExt)->guestCtx.heapCtx.Heap.area, offCmd, &chInfo);
+            uint8_t RT_UNTRUSTED_VOLATILE_HOST *pvCmd =
+                HGSMIBufferDataAndChInfoFromOffset(&VBoxCommonFromDeviceExt(pDevExt)->guestCtx.heapCtx.Heap.area, offCmd, &chInfo);
             if (!pvCmd)
             {
@@ -1572,5 +1565,6 @@
                 case VBVA_CMDVBVA_CTL:
                 {
-                    int rc = VBoxSHGSMICommandProcessCompletion (&VBoxCommonFromDeviceExt(pDevExt)->guestCtx.heapCtx, (VBOXSHGSMIHEADER*)pvCmd, TRUE /*bool bIrq*/ , &CtlList);
+                    int rc = VBoxSHGSMICommandProcessCompletion(&VBoxCommonFromDeviceExt(pDevExt)->guestCtx.heapCtx,
+                                                                (VBOXSHGSMIHEADER *)pvCmd, TRUE /*bool bIrq*/ , &CtlList);
                     AssertRC(rc);
                     break;
@@ -1718,5 +1712,6 @@
                     {
                         uint16_t chInfo;
-                        uint8_t *pvCmd = HGSMIBufferDataAndChInfoFromOffset(&pHeap->Heap.area, offCmd, &chInfo);
+                        uint8_t RT_UNTRUSTED_VOLATILE_GUEST *pvCmd =
+                            HGSMIBufferDataAndChInfoFromOffset(&pHeap->Heap.area, offCmd, &chInfo);
                         Assert(pvCmd);
                         if (pvCmd)
@@ -3962,5 +3957,5 @@
             }
             UINT cbCmd = VBOXVDMACMD_SIZE(VBOXVDMACMD_DMA_BPB_TRANSFER);
-            PVBOXVDMACBUF_DR pDr = vboxVdmaCBufDrCreate (&pDevExt->u.primary.Vdma, cbCmd);
+            VBOXVDMACBUF_DR RT_UNTRUSTED_VOLATILE_HOST *pDr = vboxVdmaCBufDrCreate(&pDevExt->u.primary.Vdma, cbCmd);
             Assert(pDr);
             if (pDr)
Index: trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPWddm.h
===================================================================
--- trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPWddm.h	(revision 71517)
+++ trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPWddm.h	(revision 71590)
@@ -164,5 +164,6 @@
 }
 
-DECLINLINE(int) vboxWddmScreenInfoInit(VBVAINFOSCREEN *pScreen, const VBOXWDDM_ALLOC_DATA *pAllocData, const POINT * pVScreenPos, uint16_t fFlags)
+DECLINLINE(int) vboxWddmScreenInfoInit(VBVAINFOSCREEN RT_UNTRUSTED_VOLATILE_HOST *pScreen,
+                                       const VBOXWDDM_ALLOC_DATA *pAllocData, const POINT * pVScreenPos, uint16_t fFlags)
 {
     VBOXVIDEOOFFSET offVram = vboxWddmAddrFramOffset(&pAllocData->Addr);
Index: trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/xpdm/VBoxMPInternal.cpp
===================================================================
--- trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/xpdm/VBoxMPInternal.cpp	(revision 71517)
+++ trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/xpdm/VBoxMPInternal.cpp	(revision 71590)
@@ -452,5 +452,6 @@
 
 static DECLCALLBACK(int)
-VBoxVbvaChannelGenericHandlerCB(void *pvHandler, uint16_t u16ChannelInfo, void *pvBuffer, HGSMISIZE cbBuffer)
+VBoxVbvaChannelGenericHandlerCB(void *pvHandler, uint16_t u16ChannelInfo,
+                                void RT_UNTRUSTED_VOLATILE_HOST *pvBuffer, HGSMISIZE cbBuffer)
 {
     VBVA_CHANNELCONTEXTS *pCallbacks = (VBVA_CHANNELCONTEXTS*)pvHandler;
Index: trunk/src/VBox/Additions/common/VBoxVideo/HGSMIBase.cpp
===================================================================
--- trunk/src/VBox/Additions/common/VBoxVideo/HGSMIBase.cpp	(revision 71517)
+++ trunk/src/VBox/Additions/common/VBoxVideo/HGSMIBase.cpp	(revision 71590)
@@ -60,9 +60,9 @@
 DECLHIDDEN(int) VBoxHGSMIReportFlagsLocation(PHGSMIGUESTCOMMANDCONTEXT pCtx, HGSMIOFFSET offLocation)
 {
-    HGSMIBUFFERLOCATION *p;
-
-    /* Allocate the IO buffer. */
-    p = (HGSMIBUFFERLOCATION *)VBoxHGSMIBufferAlloc(pCtx, sizeof(*p), HGSMI_CH_HGSMI,
-                                                    HGSMI_CC_HOST_FLAGS_LOCATION);
+
+    /* Allocate the IO buffer. */
+    HGSMIBUFFERLOCATION RT_UNTRUSTED_VOLATILE_HOST *p =
+        (HGSMIBUFFERLOCATION RT_UNTRUSTED_VOLATILE_HOST *)VBoxHGSMIBufferAlloc(pCtx, sizeof(*p), HGSMI_CH_HGSMI,
+                                                                               HGSMI_CC_HOST_FLAGS_LOCATION);
     if (!p)
         return VERR_NO_MEMORY;
@@ -90,8 +90,8 @@
 DECLHIDDEN(int) VBoxHGSMISendCapsInfo(PHGSMIGUESTCOMMANDCONTEXT pCtx, uint32_t fCaps)
 {
-    VBVACAPS *p;
-
-    /* Allocate the IO buffer. */
-    p = (VBVACAPS *)VBoxHGSMIBufferAlloc(pCtx, sizeof(*p), HGSMI_CH_VBVA, VBVA_INFO_CAPS);
+
+    /* Allocate the IO buffer. */
+    VBVACAPS RT_UNTRUSTED_VOLATILE_HOST *p =
+        (VBVACAPS RT_UNTRUSTED_VOLATILE_HOST *)VBoxHGSMIBufferAlloc(pCtx, sizeof(*p), HGSMI_CH_VBVA, VBVA_INFO_CAPS);
 
     if (!p)
Index: trunk/src/VBox/Additions/common/VBoxVideo/HGSMIBuffers.cpp
===================================================================
--- trunk/src/VBox/Additions/common/VBoxVideo/HGSMIBuffers.cpp	(revision 71517)
+++ trunk/src/VBox/Additions/common/VBoxVideo/HGSMIBuffers.cpp	(revision 71590)
@@ -72,13 +72,13 @@
  * @param  u16Op    the HGSMI command to be sent, set to the descriptor
  */
-DECLHIDDEN(void *) VBoxHGSMIBufferAlloc(PHGSMIGUESTCOMMANDCONTEXT pCtx,
-                                        HGSMISIZE cbData,
-                                        uint8_t u8Ch,
-                                        uint16_t u16Op)
+DECLHIDDEN(void RT_UNTRUSTED_VOLATILE_HOST *) VBoxHGSMIBufferAlloc(PHGSMIGUESTCOMMANDCONTEXT pCtx,
+                                                                   HGSMISIZE cbData,
+                                                                   uint8_t u8Ch,
+                                                                   uint16_t u16Op)
 {
 #ifdef VBOX_WDDM_MINIPORT
-    return VBoxSHGSMIHeapAlloc (&pCtx->heapCtx, cbData, u8Ch, u16Op);
+    return VBoxSHGSMIHeapAlloc(&pCtx->heapCtx, cbData, u8Ch, u16Op);
 #else
-    return HGSMIHeapAlloc (&pCtx->heapCtx, cbData, u8Ch, u16Op);
+    return HGSMIHeapAlloc(&pCtx->heapCtx, cbData, u8Ch, u16Op);
 #endif
 }
@@ -91,11 +91,10 @@
  * @param  pvBuffer  the pointer returned by @a VBoxHGSMIBufferAlloc
  */
-DECLHIDDEN(void) VBoxHGSMIBufferFree(PHGSMIGUESTCOMMANDCONTEXT pCtx,
-                                     void *pvBuffer)
+DECLHIDDEN(void) VBoxHGSMIBufferFree(PHGSMIGUESTCOMMANDCONTEXT pCtx, void  RT_UNTRUSTED_VOLATILE_HOST *pvBuffer)
 {
 #ifdef VBOX_WDDM_MINIPORT
-    VBoxSHGSMIHeapFree (&pCtx->heapCtx, pvBuffer);
+    VBoxSHGSMIHeapFree(&pCtx->heapCtx, pvBuffer);
 #else
-    HGSMIHeapFree (&pCtx->heapCtx, pvBuffer);
+    HGSMIHeapFree(&pCtx->heapCtx, pvBuffer);
 #endif
 }
@@ -107,9 +106,8 @@
  * @param  pvBuffer  the pointer returned by @a VBoxHGSMIBufferAlloc
  */
-DECLHIDDEN(int) VBoxHGSMIBufferSubmit(PHGSMIGUESTCOMMANDCONTEXT pCtx,
-                                      void *pvBuffer)
+DECLHIDDEN(int) VBoxHGSMIBufferSubmit(PHGSMIGUESTCOMMANDCONTEXT pCtx, void RT_UNTRUSTED_VOLATILE_HOST *pvBuffer)
 {
     /* Initialize the buffer and get the offset for port IO. */
-    HGSMIOFFSET offBuffer = HGSMIHeapBufferOffset (HGSMIGUESTCMDHEAP_GET(&pCtx->heapCtx), pvBuffer);
+    HGSMIOFFSET offBuffer = HGSMIHeapBufferOffset(HGSMIGUESTCMDHEAP_GET(&pCtx->heapCtx), pvBuffer);
 
     Assert(offBuffer != HGSMIOFFSET_VOID);
Index: trunk/src/VBox/Additions/common/VBoxVideo/HGSMIHostCmd.cpp
===================================================================
--- trunk/src/VBox/Additions/common/VBoxVideo/HGSMIHostCmd.cpp	(revision 71517)
+++ trunk/src/VBox/Additions/common/VBoxVideo/HGSMIHostCmd.cpp	(revision 71590)
@@ -76,14 +76,11 @@
  *                be completed
  */
-DECLHIDDEN(void) VBoxHGSMIHostCmdComplete(PHGSMIHOSTCOMMANDCONTEXT pCtx,
-                                          void *pvMem)
-{
-    HGSMIBUFFERHEADER *pHdr = HGSMIBufferHeaderFromData(pvMem);
+DECLHIDDEN(void) VBoxHGSMIHostCmdComplete(PHGSMIHOSTCOMMANDCONTEXT pCtx, void RT_UNTRUSTED_VOLATILE_HOST *pvMem)
+{
+    HGSMIBUFFERHEADER RT_UNTRUSTED_VOLATILE_GUEST *pHdr = HGSMIBufferHeaderFromData(pvMem);
     HGSMIOFFSET offMem = HGSMIPointerToOffset(&pCtx->areaCtx, pHdr);
     Assert(offMem != HGSMIOFFSET_VOID);
-    if(offMem != HGSMIOFFSET_VOID)
-    {
+    if (offMem != HGSMIOFFSET_VOID)
         HGSMINotifyHostCmdComplete(pCtx, offMem);
-    }
 }
 
Index: trunk/src/VBox/Additions/common/VBoxVideo/Modesetting.cpp
===================================================================
--- trunk/src/VBox/Additions/common/VBoxVideo/Modesetting.cpp	(revision 71517)
+++ trunk/src/VBox/Additions/common/VBoxVideo/Modesetting.cpp	(revision 71590)
@@ -152,13 +152,13 @@
     int rc;
     /* Issue the screen info command. */
-    void *p = VBoxHGSMIBufferAlloc(pCtx, sizeof(VBVAINFOVIEW) * u32Count,
-                                   HGSMI_CH_VBVA, VBVA_INFO_VIEW);
-    if (p)
-    {
-        VBVAINFOVIEW *pInfo = (VBVAINFOVIEW *)p;
-        rc = pfnFill(pvData, pInfo, u32Count);
+    VBVAINFOVIEW RT_UNTRUSTED_VOLATILE_HOST *pInfo =
+        (VBVAINFOVIEW RT_UNTRUSTED_VOLATILE_HOST *)VBoxHGSMIBufferAlloc(pCtx, sizeof(VBVAINFOVIEW) * u32Count,
+                                                                        HGSMI_CH_VBVA, VBVA_INFO_VIEW);
+    if (pInfo)
+    {
+        rc = pfnFill(pvData, (VBVAINFOVIEW *)pInfo /* lazy bird */, u32Count);
         if (RT_SUCCESS(rc))
-            VBoxHGSMIBufferSubmit (pCtx, p);
-        VBoxHGSMIBufferFree(pCtx, p);
+            VBoxHGSMIBufferSubmit(pCtx, pInfo);
+        VBoxHGSMIBufferFree(pCtx, pInfo);
     }
     else
@@ -294,16 +294,9 @@
 {
     /* Issue the screen info command. */
-    void *p = VBoxHGSMIBufferAlloc(pCtx,
-                                   sizeof (VBVAINFOSCREEN),
-                                   HGSMI_CH_VBVA,
-                                   VBVA_INFO_SCREEN);
-    if (!p)
-    {
-        // LogFunc(("HGSMIHeapAlloc failed\n"));
-    }
-    else
-    {
-        VBVAINFOSCREEN *pScreen = (VBVAINFOSCREEN *)p;
-
+    VBVAINFOSCREEN RT_UNTRUSTED_VOLATILE_HOST *pScreen =
+        (VBVAINFOSCREEN RT_UNTRUSTED_VOLATILE_HOST *)VBoxHGSMIBufferAlloc(pCtx, sizeof(VBVAINFOSCREEN),
+                                                                          HGSMI_CH_VBVA, VBVA_INFO_SCREEN);
+    if (pScreen != NULL)
+    {
         pScreen->u32ViewIndex    = cDisplay;
         pScreen->i32OriginX      = cOriginX;
@@ -316,7 +309,11 @@
         pScreen->u16Flags        = fFlags;
 
-        VBoxHGSMIBufferSubmit(pCtx, p);
-
-        VBoxHGSMIBufferFree(pCtx, p);
+        VBoxHGSMIBufferSubmit(pCtx, pScreen);
+
+        VBoxHGSMIBufferFree(pCtx, pScreen);
+    }
+    else
+    {
+        // LogFunc(("HGSMIHeapAlloc failed\n"));
     }
 }
@@ -338,5 +335,5 @@
                                                  uint32_t cWidth, uint32_t cHeight)
 {
-    int rc = VINF_SUCCESS;
+    int rc;
     VBVAREPORTINPUTMAPPING *p;
     // Log(("%s: cOriginX=%d, cOriginY=%d, cWidth=%u, cHeight=%u\n", __PRETTY_FUNCTION__, (int)cOriginX, (int)cOriginX,
@@ -377,33 +374,28 @@
 {
     int rc;
-    void *p;
-
-    AssertPtr(paHints);
-    if (!VALID_PTR(paHints))
-        return VERR_INVALID_POINTER;
-
-    p = VBoxHGSMIBufferAlloc(pCtx, sizeof(VBVAQUERYMODEHINTS)
-                                       + cScreens * sizeof(VBVAMODEHINT),
-                             HGSMI_CH_VBVA, VBVA_QUERY_MODE_HINTS);
-    if (!p)
-    {
-        // LogFunc(("HGSMIHeapAlloc failed\n"));
-        return VERR_NO_MEMORY;
-    }
-    else
-    {
-        VBVAQUERYMODEHINTS *pQuery   = (VBVAQUERYMODEHINTS *)p;
-
+    VBVAQUERYMODEHINTS RT_UNTRUSTED_VOLATILE_HOST *pQuery;
+
+    AssertPtrReturn(paHints, VERR_INVALID_POINTER);
+    pQuery = (VBVAQUERYMODEHINTS RT_UNTRUSTED_VOLATILE_HOST *)VBoxHGSMIBufferAlloc(pCtx,
+                                                                                      sizeof(VBVAQUERYMODEHINTS)
+                                                                                   +  cScreens * sizeof(VBVAMODEHINT),
+                                                                                   HGSMI_CH_VBVA, VBVA_QUERY_MODE_HINTS);
+    if (pQuery != NULL)
+    {
         pQuery->cHintsQueried        = cScreens;
         pQuery->cbHintStructureGuest = sizeof(VBVAMODEHINT);
         pQuery->rc                   = VERR_NOT_SUPPORTED;
 
-        VBoxHGSMIBufferSubmit(pCtx, p);
+        VBoxHGSMIBufferSubmit(pCtx, pQuery);
         rc = pQuery->rc;
         if (RT_SUCCESS(rc))
-            memcpy(paHints, ((uint8_t *)p) + sizeof(VBVAQUERYMODEHINTS),
-                   cScreens * sizeof(VBVAMODEHINT));
-
-        VBoxHGSMIBufferFree(pCtx, p);
+            memcpy(paHints, (void *)(pQuery + 1), cScreens * sizeof(VBVAMODEHINT));
+
+        VBoxHGSMIBufferFree(pCtx, pQuery);
+    }
+    else
+    {
+        // LogFunc(("HGSMIHeapAlloc failed\n"));
+        rc = VERR_NO_MEMORY;
     }
     return rc;
Index: trunk/src/VBox/Additions/common/VBoxVideo/VBVABase.cpp
===================================================================
--- trunk/src/VBox/Additions/common/VBoxVideo/VBVABase.cpp	(revision 71517)
+++ trunk/src/VBox/Additions/common/VBoxVideo/VBVABase.cpp	(revision 71590)
@@ -56,9 +56,7 @@
 
 
-static bool vboxVBVAInformHost(PVBVABUFFERCONTEXT pCtx,
-                               PHGSMIGUESTCOMMANDCONTEXT pHGSMICtx,
-                               int32_t cScreen, bool bEnable)
-{
-    bool bRc = false;
+static bool vboxVBVAInformHost(PVBVABUFFERCONTEXT pCtx, PHGSMIGUESTCOMMANDCONTEXT pHGSMICtx, int32_t cScreen, bool fEnable)
+{
+    bool fRc = false;
 
 #if 0  /* All callers check this */
@@ -66,17 +64,10 @@
 #endif
     {
-        void *p = VBoxHGSMIBufferAlloc(pHGSMICtx,
-                                       sizeof (VBVAENABLE_EX),
-                                       HGSMI_CH_VBVA,
-                                       VBVA_ENABLE);
-        if (!p)
-        {
-            // LogFunc(("HGSMIHeapAlloc failed\n"));
-        }
-        else
-        {
-            VBVAENABLE_EX *pEnable = (VBVAENABLE_EX *)p;
-
-            pEnable->Base.u32Flags  = bEnable? VBVA_F_ENABLE: VBVA_F_DISABLE;
+        VBVAENABLE_EX RT_UNTRUSTED_VOLATILE_HOST *pEnable =
+            (VBVAENABLE_EX RT_UNTRUSTED_VOLATILE_HOST *)VBoxHGSMIBufferAlloc(pHGSMICtx, sizeof(VBVAENABLE_EX),
+                                                                             HGSMI_CH_VBVA, VBVA_ENABLE);
+        if (pEnable != NULL)
+        {
+            pEnable->Base.u32Flags  = fEnable ? VBVA_F_ENABLE : VBVA_F_DISABLE;
             pEnable->Base.u32Offset = pCtx->offVRAMBuffer;
             pEnable->Base.i32Result = VERR_NOT_SUPPORTED;
@@ -87,20 +78,20 @@
             }
 
-            VBoxHGSMIBufferSubmit(pHGSMICtx, p);
-
-            if (bEnable)
-            {
-                bRc = RT_SUCCESS(pEnable->Base.i32Result);
-            }
+            VBoxHGSMIBufferSubmit(pHGSMICtx, pEnable);
+
+            if (fEnable)
+                fRc = RT_SUCCESS(pEnable->Base.i32Result);
             else
-            {
-                bRc = true;
-            }
-
-            VBoxHGSMIBufferFree(pHGSMICtx, p);
-        }
-    }
-
-    return bRc;
+                fRc = true;
+
+            VBoxHGSMIBufferFree(pHGSMICtx, pEnable);
+        }
+        else
+        {
+            // LogFunc(("HGSMIHeapAlloc failed\n"));
+        }
+    }
+
+    return fRc;
 }
 
@@ -112,5 +103,5 @@
                                 VBVABUFFER *pVBVA, int32_t cScreen)
 {
-    bool bRc = false;
+    bool fRc = false;
 
     // LogFlowFunc(("pVBVA %p\n", pVBVA));
@@ -136,13 +127,13 @@
         pCtx->pVBVA      = pVBVA;
 
-        bRc = vboxVBVAInformHost(pCtx, pHGSMICtx, cScreen, true);
-    }
-
-    if (!bRc)
+        fRc = vboxVBVAInformHost(pCtx, pHGSMICtx, cScreen, true);
+    }
+
+    if (!fRc)
     {
         VBoxVBVADisable(pCtx, pHGSMICtx, cScreen);
     }
 
-    return bRc;
+    return fRc;
 }
 
@@ -158,6 +149,4 @@
 
     vboxVBVAInformHost(pCtx, pHGSMICtx, cScreen, false);
-
-    return;
 }
 
@@ -165,5 +154,5 @@
                                            PHGSMIGUESTCOMMANDCONTEXT pHGSMICtx)
 {
-    bool bRc = false;
+    bool fRc = false;
 
     // LogFunc(("flags = 0x%08X\n", pCtx->pVBVA? pCtx->pVBVA->u32HostEvents: -1));
@@ -205,9 +194,9 @@
             pCtx->pRecord = pRecord;
 
-            bRc = true;
-        }
-    }
-
-    return bRc;
+            fRc = true;
+        }
+    }
+
+    return fRc;
 }
 
@@ -228,6 +217,4 @@
     pCtx->fHwBufferOverflow = false;
     pCtx->pRecord = NULL;
-
-    return;
 }
 
@@ -245,24 +232,18 @@
 {
     /* Issue the flush command. */
-    void *p = VBoxHGSMIBufferAlloc(pCtx,
-                                   sizeof (VBVAFLUSH),
-                                   HGSMI_CH_VBVA,
-                                   VBVA_FLUSH);
-    if (!p)
+    VBVAFLUSH RT_UNTRUSTED_VOLATILE_HOST *pFlush =
+        (VBVAFLUSH RT_UNTRUSTED_VOLATILE_HOST * )VBoxHGSMIBufferAlloc(pCtx, sizeof(VBVAFLUSH), HGSMI_CH_VBVA, VBVA_FLUSH);
+    if (pFlush != NULL)
+    {
+        pFlush->u32Reserved = 0;
+
+        VBoxHGSMIBufferSubmit(pCtx, pFlush);
+
+        VBoxHGSMIBufferFree(pCtx, pFlush);
+    }
+    else
     {
         // LogFunc(("HGSMIHeapAlloc failed\n"));
     }
-    else
-    {
-        VBVAFLUSH *pFlush = (VBVAFLUSH *)p;
-
-        pFlush->u32Reserved = 0;
-
-        VBoxHGSMIBufferSubmit(pCtx, p);
-
-        VBoxHGSMIBufferFree(pCtx, p);
-    }
-
-    return;
 }
 
@@ -286,6 +267,4 @@
         memcpy (&pVBVA->au8Data[0], (uint8_t *)p + u32BytesTillBoundary, i32Diff);
     }
-
-    return;
 }
 
Index: trunk/src/VBox/Additions/x11/vboxvideo/HGSMIMemAlloc.h
===================================================================
--- trunk/src/VBox/Additions/x11/vboxvideo/HGSMIMemAlloc.h	(revision 71517)
+++ trunk/src/VBox/Additions/x11/vboxvideo/HGSMIMemAlloc.h	(revision 71590)
@@ -48,10 +48,10 @@
 
 int HGSMIMAInit(HGSMIMADATA *pMA, const HGSMIAREA *pArea,
-                HGSMIOFFSET *paDescriptors, uint32_t cDescriptors, HGSMISIZE cbMaxBlock,
-                const HGSMIENV *pEnv);
+                HGSMIOFFSET *paDescriptors, uint32_t cDescriptors,
+                HGSMISIZE cbMaxBlock, const HGSMIENV *pEnv);
 void HGSMIMAUninit(HGSMIMADATA *pMA);
 
-void *HGSMIMAAlloc(HGSMIMADATA *pMA, HGSMISIZE cb);
-void HGSMIMAFree(HGSMIMADATA *pMA, void *pv);
+void RT_UNTRUSTED_VOLATILE_GUEST *HGSMIMAAlloc(HGSMIMADATA *pMA, HGSMISIZE cb);
+void HGSMIMAFree(HGSMIMADATA *pMA, void RT_UNTRUSTED_VOLATILE_GUEST *pv);
 
 RT_C_DECLS_END
Index: trunk/src/VBox/Additions/x11/vboxvideo/VBoxVideoIPRT.h
===================================================================
--- trunk/src/VBox/Additions/x11/vboxvideo/VBoxVideoIPRT.h	(revision 71517)
+++ trunk/src/VBox/Additions/x11/vboxvideo/VBoxVideoIPRT.h	(revision 71590)
@@ -94,4 +94,5 @@
   } while (0)
 # define AssertPtr assert
+# define AssertPtrReturn(pv, rcRet) do { assert(pv); if (pv) {} else return(rcRet); } while(0)
 # define AssertRC(expr) assert (!expr)
 #else
@@ -99,5 +100,6 @@
 # define AssertFailed() do { } while(0)
 # define AssertMsg(expr, msg) do { } while(0)
-# define AssertPtr(expr) do { } while(0)
+# define AssertPtr(ptr) do { } while(0)
+# define AssertPtrReturn(pv, rcRet) do { if (pv) {} else return(rcRet); } while(0)
 # define AssertRC(expr) do { } while(0)
 #endif
@@ -136,4 +138,10 @@
 # define UINT32_C(Value) (Value ## U)
 #endif
+#define RT_UNTRUSTED_GUEST
+#define RT_UNTRUSTED_VOLATILE_GUEST  volatile
+#define RT_UNTRUSTED_HOST
+#define RT_UNTRUSTED_VOLATILE_HOST   volatile
+#define RT_UNTRUSTED_HSTGST
+#define RT_UNTRUSTED_VOLATILE_HSTGST volatile
 
 #define likely _X_LIKELY
Index: trunk/src/VBox/Additions/x11/vboxvideo/hgsmimemalloc.c
===================================================================
--- trunk/src/VBox/Additions/x11/vboxvideo/hgsmimemalloc.c	(revision 71517)
+++ trunk/src/VBox/Additions/x11/vboxvideo/hgsmimemalloc.c	(revision 71590)
@@ -35,4 +35,6 @@
  * submit and free pattern, we replace the generic allocator with a simple
  * Boolean.  Need more be said?
+ *
+ * bird> Yes, it's buggy. You never set fAllocated. See HGSMIMAAlloc().
  */
 
@@ -64,10 +66,8 @@
 }
 
-static HGSMIOFFSET HGSMIMAPointerToOffset(const HGSMIMADATA *pMA, const void *pv)
+static HGSMIOFFSET HGSMIMAPointerToOffset(const HGSMIMADATA *pMA, const void RT_UNTRUSTED_VOLATILE_GUEST *pv)
 {
     if (HGSMIAreaContainsPointer(&pMA->area, pv))
-    {
         return HGSMIPointerToOffset(&pMA->area, pv);
-    }
 
     AssertFailed();
@@ -75,10 +75,8 @@
 }
 
-static void *HGSMIMAOffsetToPointer(const HGSMIMADATA *pMA, HGSMIOFFSET off)
+static void RT_UNTRUSTED_VOLATILE_GUEST *HGSMIMAOffsetToPointer(const HGSMIMADATA *pMA, HGSMIOFFSET off)
 {
     if (HGSMIAreaContainsOffset(&pMA->area, off))
-    {
         return HGSMIOffsetToPointer(&pMA->area, off);
-    }
 
     AssertFailed();
@@ -86,5 +84,5 @@
 }
 
-void *HGSMIMAAlloc(HGSMIMADATA *pMA, HGSMISIZE cb)
+void RT_UNTRUSTED_VOLATILE_GUEST *HGSMIMAAlloc(HGSMIMADATA *pMA, HGSMISIZE cb)
 {
     (void)cb;
@@ -93,17 +91,14 @@
     HGSMIOFFSET off = pMA->area.offBase;
     return HGSMIMAOffsetToPointer(pMA, off);
-    pMA->fAllocated = true;
+    pMA->fAllocated = true; /** @todo r=bird: Errr. what's this doing *after* the return statement? */
 }
 
-void HGSMIMAFree(HGSMIMADATA *pMA, void *pv)
+void HGSMIMAFree(HGSMIMADATA *pMA, void RT_UNTRUSTED_VOLATILE_GUEST *pv)
 {
     HGSMIOFFSET off = HGSMIMAPointerToOffset(pMA, pv);
     if (off != HGSMIOFFSET_VOID)
-    {
         pMA->fAllocated = false;
-    }
     else
-    {
         AssertFailed();
-    }
 }
+
