Index: /trunk/src/VBox/VMM/VMMAll/PGMAllPool.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/PGMAllPool.cpp	(revision 20139)
+++ /trunk/src/VBox/VMM/VMMAll/PGMAllPool.cpp	(revision 20140)
@@ -2685,4 +2685,5 @@
 int pgmPoolTrackFlushGCPhys(PVM pVM, PPGMPAGE pPhysPage, bool *pfFlushTLBs)
 {
+    PVMCPU pVCpu = VMMGetCpu(pVM);
     pgmLock(pVM);
     int rc = VINF_SUCCESS;
@@ -2704,5 +2705,4 @@
             /* Start a subset here because pgmPoolTrackFlushGCPhysPTsSlow and
                pgmPoolTrackFlushGCPhysPTs will/may kill the pool otherwise. */
-            PVMCPU pVCpu = VMMGetCpu(pVM);
             uint32_t iPrevSubset = PGMDynMapPushAutoSubset(pVCpu);
 # endif
@@ -2732,5 +2732,4 @@
 # ifdef VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0
         /* Start a subset here because pgmPoolTrackFlushGCPhysPTsSlow kill the pool otherwise. */
-        PVMCPU pVCpu = VMMGetCpu(pVM);
         uint32_t iPrevSubset = PGMDynMapPushAutoSubset(pVCpu);
 # endif
@@ -2751,9 +2750,5 @@
     {
         pVM->pgm.s.fGlobalSyncFlags |= PGM_GLOBAL_SYNC_CLEAR_PGM_POOL;
-        for (unsigned i=0;i<pVM->cCPUs;i++)
-        {
-            PVMCPU pVCpu = &pVM->aCpus[i];
-            VMCPU_FF_SET(pVCpu, VMCPU_FF_PGM_SYNC_CR3);
-        }
+        VMCPU_FF_SET(pVCpu, VMCPU_FF_PGM_SYNC_CR3);
         rc = VINF_PGM_SYNC_CR3;
     }