Index: /trunk/src/VBox/VMM/VMMAll/PGMAllBth.h
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/PGMAllBth.h	(revision 20125)
+++ /trunk/src/VBox/VMM/VMMAll/PGMAllBth.h	(revision 20126)
@@ -2585,4 +2585,13 @@
             GCPhys |= (iPDDst & 1) * (PAGE_SIZE / 2);
 # endif
+            rc = pgmPoolAlloc(pVM, GCPhys, BTH_PGMPOOLKIND_PT_FOR_PT, pShwPde->idx,      iPDDst, &pShwPage);
+        }
+        else
+        {
+            GCPhys = GST_GET_PDE_BIG_PG_GCPHYS(PdeSrc);
+# if PGM_SHW_TYPE == PGM_TYPE_PAE && PGM_GST_TYPE == PGM_TYPE_32BIT
+            /* Select the right PDE as we're emulating a 4MB page directory with two 2 MB shadow PDEs.*/
+            GCPhys |= GCPtrPage & (1 << X86_PD_PAE_SHIFT);
+# endif
             /* Modify the physical address to distinguish between different access types to prevent incorrect reuse of cached entries. */
             if (PdeSrc.n.u1Write)
@@ -2591,13 +2600,4 @@
                 GCPhys |= PGMPOOL_PHYS_ACCESS_USER;
 
-            rc = pgmPoolAlloc(pVM, GCPhys, BTH_PGMPOOLKIND_PT_FOR_PT, pShwPde->idx,      iPDDst, &pShwPage);
-        }
-        else
-        {
-            GCPhys = GST_GET_PDE_BIG_PG_GCPHYS(PdeSrc);
-# if PGM_SHW_TYPE == PGM_TYPE_PAE && PGM_GST_TYPE == PGM_TYPE_32BIT
-            /* Select the right PDE as we're emulating a 4MB page directory with two 2 MB shadow PDEs.*/
-            GCPhys |= GCPtrPage & (1 << X86_PD_PAE_SHIFT);
-# endif
             rc = pgmPoolAlloc(pVM, GCPhys, BTH_PGMPOOLKIND_PT_FOR_BIG, pShwPde->idx,      iPDDst, &pShwPage);
         }