Index: /trunk/src/VBox/VMM/VMMAll/PGMAllPool.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/PGMAllPool.cpp	(revision 17230)
+++ /trunk/src/VBox/VMM/VMMAll/PGMAllPool.cpp	(revision 17231)
@@ -4118,4 +4118,6 @@
 static void pgmPoolFlushAllInt(PPGMPOOL pPool)
 {
+    PVM pVM = pPool->CTX_SUFF(pVM);
+
     STAM_PROFILE_START(&pPool->StatFlushAllInt, a);
     LogFlow(("pgmPoolFlushAllInt:\n"));
@@ -4130,4 +4132,10 @@
     }
 
+#ifdef VBOX_WITH_PGMPOOL_PAGING_ONLY
+    /* Unmap the old CR3 value before flushing everything. */
+    int rc = PGM_BTH_PFN(UnmapCR3, pVM)(pVM);
+    AssertRC(rc);
+#endif
+
     /*
      * Nuke the free list and reinsert all pages into it.
@@ -4138,5 +4146,5 @@
 
 #ifdef IN_RING3
-        Assert(pPage->Core.Key == MMPage2Phys(pPool->pVMR3, pPage->pvPageR3));
+        Assert(pPage->Core.Key == MMPage2Phys(pVM, pPage->pvPageR3));
 #endif
 #ifdef PGMPOOL_WITH_MONITORING
@@ -4193,5 +4201,5 @@
      * Clear all the GCPhys links and rebuild the phys ext free list.
      */
-    for (PPGMRAMRANGE pRam = pPool->CTX_SUFF(pVM)->pgm.s.CTX_SUFF(pRamRanges);
+    for (PPGMRAMRANGE pRam = pVM->pgm.s.CTX_SUFF(pRamRanges);
          pRam;
          pRam = pRam->CTX_SUFF(pNext))
@@ -4251,5 +4259,4 @@
         if (pPage->fMonitored)
         {
-            PVM pVM = pPool->CTX_SUFF(pVM);
             int rc = PGMHandlerPhysicalChangeCallbacks(pVM, pPage->GCPhys & ~(RTGCPHYS)(PAGE_SIZE - 1),
                                                        pPool->pfnAccessHandlerR3, MMHyperCCToR3(pVM, pPage),
@@ -4275,5 +4282,5 @@
      * Finally, assert the FF.
      */
-    VM_FF_SET(pPool->CTX_SUFF(pVM), VM_FF_PGM_SYNC_CR3);
+    VM_FF_SET(pVM, VM_FF_PGM_SYNC_CR3);
 
     STAM_PROFILE_STOP(&pPool->StatFlushAllInt, a);