Index: /trunk/src/VBox/VMM/VMMAll/PGMAllBth.h
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/PGMAllBth.h	(revision 19780)
+++ /trunk/src/VBox/VMM/VMMAll/PGMAllBth.h	(revision 19781)
@@ -3026,4 +3026,7 @@
     if (PdeSrc.n.u1Present && PdeSrc.n.u1Accessed)
     {
+        PVM pVM = pVCpu->CTX_SUFF(pVM);
+        pgmLock(pVM);
+
 # if PGM_SHW_TYPE == PGM_TYPE_32BIT
         const X86PDE    PdeDst = pgmShwGet32BitPDE(&pVCpu->pgm.s, GCPtrPage);
@@ -3041,4 +3044,5 @@
         if (rc != VINF_SUCCESS)
         {
+            pgmUnlock(pVM);
             AssertRC(rc);
             return rc;
@@ -3066,4 +3070,5 @@
         if (rc != VINF_SUCCESS)
         {
+            pgmUnlock(pVM);
             AssertRC(rc);
             return rc;
@@ -3076,9 +3081,6 @@
             if (!PdeDst.n.u1Present)
             {
-                PVM pVM = pVCpu->CTX_SUFF(pVM);
                 /** r=bird: This guy will set the A bit on the PDE, probably harmless. */
-                pgmLock(pVM);
                 rc = PGM_BTH_NAME(SyncPT)(pVCpu, iPDSrc, pPDSrc, GCPtrPage);
-                pgmUnlock(pVM);
             }
             else
@@ -3093,4 +3095,5 @@
             }
         }
+        pgmUnlock(pVM);
     }
     return rc;