Index: /trunk/src/VBox/VMM/PGM.cpp
===================================================================
--- /trunk/src/VBox/VMM/PGM.cpp	(revision 12404)
+++ /trunk/src/VBox/VMM/PGM.cpp	(revision 12405)
@@ -3180,4 +3180,6 @@
 
     }
+    else
+        LogFlow(("PGMR3ChangeMode: Shadow mode remains: %s\n",  PGMGetModeName(pVM->pgm.s.enmShadowMode)));
 
     /* guest */
@@ -3237,4 +3239,15 @@
             return rc;
         }
+    }
+
+    /* We must flush the PGM pool cache if the guest mode changes; we don't always
+     * switch shadow paging mode (e.g. protected->32-bit) and shouldn't reuse
+     * the shadow page tables.
+     */
+    if (   pVM->pgm.s.CTXSUFF(pPool)
+        && pVM->pgm.s.enmGuestMode != enmGuestMode)
+    {
+        Log(("PGMR3ChangeMode: changing guest paging mode -> flush pgm pool cache!\n"));
+        pgmPoolFlushAll(pVM);
     }