Index: /trunk/src/VBox/VMM/VMMAll/PGMAllBth.h
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/PGMAllBth.h	(revision 27489)
+++ /trunk/src/VBox/VMM/VMMAll/PGMAllBth.h	(revision 27490)
@@ -1500,4 +1500,6 @@
                 &&  PGM_PAGE_GET_STATE(pPage) != PGM_PAGE_STATE_ALLOCATED)
             {
+                /* Still applies to shared pages. */
+                Assert(!PGM_PAGE_IS_ZERO(pPage));
                 PteDst.n.u1Write = 0;   /** @todo this isn't quite working yet. */
                 Log3(("SyncPageWorker: write-protecting %RGp pPage=%R[pgmpage]at iPTDst=%d\n", (RTGCPHYS)(PteSrc.u & X86_PTE_PAE_PG_MASK), pPage, iPTDst));
@@ -1833,4 +1835,6 @@
                         &&  PGM_PAGE_GET_STATE(pPage) != PGM_PAGE_STATE_ALLOCATED)
                     {
+                        /* Still applies to shared pages. */
+                        Assert(!PGM_PAGE_IS_ZERO(pPage));
                         PteDst.n.u1Write = 0;   /** @todo this isn't quite working yet... */
                         Log3(("SyncPage: write-protecting %RGp pPage=%R[pgmpage] at %RGv\n", GCPhys, pPage, GCPtrPage));
@@ -2394,7 +2398,13 @@
                                 }
                                 if (PGM_PAGE_GET_STATE(pPage) == PGM_PAGE_STATE_ALLOCATED)
+                                {
                                     PteDst.n.u1Write = 1;
+                                }
                                 else
+                                {
+                                    /* Still applies to shared pages. */
+                                    Assert(!PGM_PAGE_IS_ZERO(pPage));
                                     PteDst.n.u1Write = 0;
+                                }
                             }
                         }
@@ -2862,4 +2872,6 @@
                             &&  PGM_PAGE_GET_STATE(pPage) != PGM_PAGE_STATE_ALLOCATED)
                         {
+                            /* Still applies to shared pages. */
+                            Assert(!PGM_PAGE_IS_ZERO(pPage));
                             PteDst.n.u1Write = 0;   /** @todo this isn't quite working yet... */
                             Log3(("SyncPT: write-protecting %RGp pPage=%R[pgmpage] at %RGv\n", GCPhys, pPage, (RTGCPTR)(GCPtr | (iPTDst << SHW_PT_SHIFT))));