Index: /trunk/src/VBox/VMM/PGMPhys.cpp
===================================================================
--- /trunk/src/VBox/VMM/PGMPhys.cpp	(revision 30821)
+++ /trunk/src/VBox/VMM/PGMPhys.cpp	(revision 30822)
@@ -3281,5 +3281,5 @@
              * Check that it's not in any of the TLBs.
              */
-            PVM pVM = (PVM)pvUser;
+            PVM pVM = (PGMR3PHYSCHUNKUNMAPCB()pvUser)->pVM;
             for (unsigned i = 0; i < RT_ELEMENTS(pVM->pgm.s.ChunkR3Map.Tlb.aEntries); i++)
                 if (pVM->pgm.s.ChunkR3Map.Tlb.aEntries[i].pChunk == pChunk)
@@ -3334,6 +3334,10 @@
     Args.pVM = pVM;
     Args.pChunk = NULL;
-    if (RTAvllU32DoWithAll(&pVM->pgm.s.ChunkR3Map.pAgeTree, true /*fFromLeft*/, pgmR3PhysChunkUnmapCandidateCallback, pVM))
-        return Args.pChunk->Core.Key;
+    if (RTAvllU32DoWithAll(&pVM->pgm.s.ChunkR3Map.pAgeTree, true /*fFromLeft*/, pgmR3PhysChunkUnmapCandidateCallback, &Args))
+    {
+        Assert(Args.pChunk);
+        if (Args.pChunk)
+            return Args.pChunk->Core.Key;
+    }
     return INT32_MAX;
 }