Index: /trunk/src/VBox/VMM/VMMAll/PGMAllBth.h
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/PGMAllBth.h	(revision 27539)
+++ /trunk/src/VBox/VMM/VMMAll/PGMAllBth.h	(revision 27540)
@@ -807,4 +807,5 @@
                         Log(("PGM #PF: Make writable: %RGp %R[pgmpage] pvFault=%RGp uErr=%#x\n", GCPhys, pPage, pvFault, uErr));
                         Assert(!PGM_PAGE_IS_ZERO(pPage));
+                        AssertFatalMsg(!PGM_PAGE_IS_BALLOONED(pPage), ("Unexpected ballooned page at %RGp\n", GCPhys));
 
                         rc = pgmPhysPageMakeWritable(pVM, pPage, GCPhys);
@@ -1402,4 +1403,8 @@
         if (RT_SUCCESS(rc))
         {
+            /* Ignore ballooned pages. Don't return errors or use a fatal assert here as part of a shadow sync range might included ballooned pages. */
+            if (PGM_PAGE_IS_BALLOONED(pPage))
+                return;
+
 #ifndef VBOX_WITH_NEW_LAZY_PAGE_ALLOC
             /* Try to make the page writable if necessary. */
@@ -1411,5 +1416,5 @@
                          && PGM_PAGE_GET_STATE(pPage) != PGM_PAGE_STATE_WRITE_MONITORED
 # endif
-                         && PGM_PAGE_GET_TYPE(pPage)  == PGMPAGETYPE_RAM)
+                        )
                      )
                )
@@ -1795,4 +1800,6 @@
                 if (RT_SUCCESS(rc))
                 {
+                    AssertFatalMsg(!PGM_PAGE_IS_BALLOONED(pPage), ("Unexpected ballooned page at %RGp\n", GCPhys));
+
 # ifndef VBOX_WITH_NEW_LAZY_PAGE_ALLOC
                     /* Try to make the page writable if necessary. */
@@ -1804,5 +1811,5 @@
                                  && PGM_PAGE_GET_STATE(pPage) != PGM_PAGE_STATE_WRITE_MONITORED
 #  endif
-                                 && PGM_PAGE_GET_TYPE(pPage)  == PGMPAGETYPE_RAM)
+                                 )
                              )
                        )
@@ -1826,6 +1833,8 @@
                             PteDst.u = 0;
                     }
+
                     const unsigned iPTDst = (GCPtrPage >> SHW_PT_SHIFT) & SHW_PT_MASK;
-                    if (PteDst.n.u1Present && !pPTDst->a[iPTDst].n.u1Present)
+                    if (    PteDst.n.u1Present 
+                        &&  !pPTDst->a[iPTDst].n.u1Present)
                         PGM_BTH_NAME(SyncPageWorkerTrackAddref)(pVCpu, pShwPage, PGM_PAGE_GET_TRACKING(pPage), pPage, iPTDst);
 
@@ -2833,5 +2842,5 @@
                                      && PGM_PAGE_GET_STATE(pPage) != PGM_PAGE_STATE_WRITE_MONITORED
 #  endif
-                                     && PGM_PAGE_GET_TYPE(pPage)  == PGMPAGETYPE_RAM)
+                                     && !PGM_PAGE_IS_BALLOONED(pPage))
                                  )
                            )
@@ -2853,4 +2862,10 @@
                             else
                                 PteDst.u = 0;
+                        }
+                        else
+                        if (PGM_PAGE_IS_BALLOONED(pPage))
+                        {
+                            /* Skip ballooned pages. */
+                            PteDst.u = 0;
                         }
 # ifndef IN_RING0
Index: /trunk/src/VBox/VMM/VMMAll/PGMAllPhys.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/PGMAllPhys.cpp	(revision 27539)
+++ /trunk/src/VBox/VMM/VMMAll/PGMAllPhys.cpp	(revision 27540)
@@ -673,4 +673,8 @@
         case PGM_PAGE_STATE_SHARED:
             return pgmPhysAllocPage(pVM, pPage, GCPhys);
+
+        /* Not allowed to write to ballooned pages. */
+        case PGM_PAGE_STATE_BALLOONED:
+            return VERR_PGM_PHYS_PAGE_BALLOONED;
     }
 }
@@ -1009,5 +1013,6 @@
     PPGMPAGE pPage = &pRam->aPages[off >> PAGE_SHIFT];
     PPGMPAGEMAPTLBE pTlbe = &pPGM->CTXSUFF(PhysTlb).aEntries[PGM_PAGEMAPTLB_IDX(GCPhys)];
-    if (!PGM_PAGE_IS_ZERO(pPage))
+    if (    !PGM_PAGE_IS_ZERO(pPage)
+        &&  !PGM_PAGE_IS_BALLOONED(pPage))
     {
         void *pv;
@@ -1058,5 +1063,6 @@
      */
     PPGMPAGEMAPTLBE pTlbe = &pPGM->CTXSUFF(PhysTlb).aEntries[PGM_PAGEMAPTLB_IDX(GCPhys)];
-    if (!PGM_PAGE_IS_ZERO(pPage))
+    if (    !PGM_PAGE_IS_ZERO(pPage)
+        &&  !PGM_PAGE_IS_BALLOONED(pPage))
     {
         void *pv;
Index: /trunk/src/VBox/VMM/VMMAll/PGMAllPool.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/PGMAllPool.cpp	(revision 27539)
+++ /trunk/src/VBox/VMM/VMMAll/PGMAllPool.cpp	(revision 27540)
@@ -3381,5 +3381,6 @@
          * will be needed for this problem of course, but it will have to wait...
          */
-        if (PGM_PAGE_IS_ZERO(pPhysPage))
+        if (    PGM_PAGE_IS_ZERO(pPhysPage)
+            ||  PGM_PAGE_IS_BALLOONED(pPhysPage))
             rc = VINF_PGM_GCPHYS_ALIASED;
         else