Index: /trunk/src/VBox/VMM/VMMAll/PGMAllBth.h
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/PGMAllBth.h	(revision 20127)
+++ /trunk/src/VBox/VMM/VMMAll/PGMAllBth.h	(revision 20128)
@@ -2604,4 +2604,7 @@
 
             rc = pgmPoolAlloc(pVM, GCPhys, BTH_PGMPOOLKIND_PT_FOR_BIG, pShwPde->idx,      iPDDst, &pShwPage);
+
+            /* Strip the flags again in case we have to construct it. */
+            GCPhys &= ~(PGMPOOL_PHYS_ACCESS_RW|PGMPOOL_PHYS_ACCESS_USER);
         }
         if (rc == VINF_SUCCESS)