Index: /trunk/src/VBox/VMM/PGM.cpp
===================================================================
--- /trunk/src/VBox/VMM/PGM.cpp	(revision 31205)
+++ /trunk/src/VBox/VMM/PGM.cpp	(revision 31206)
@@ -2444,4 +2444,5 @@
     pgmLock(pVM);
     pgmR3PhysRamTerm(pVM);
+    pgmR3PhysRomTerm(pVM);
     pgmUnlock(pVM);
 
Index: /trunk/src/VBox/VMM/PGMInternal.h
===================================================================
--- /trunk/src/VBox/VMM/PGMInternal.h	(revision 31205)
+++ /trunk/src/VBox/VMM/PGMInternal.h	(revision 31206)
@@ -3583,4 +3583,5 @@
 int             pgmR3PhysChunkMap(PVM pVM, uint32_t idChunk, PPPGMCHUNKR3MAP ppChunk);
 int             pgmR3PhysRamTerm(PVM pVM);
+void            pgmR3PhysRomTerm(PVM pVM);
 
 int             pgmR3PoolInit(PVM pVM);
Index: /trunk/src/VBox/VMM/PGMPhys.cpp
===================================================================
--- /trunk/src/VBox/VMM/PGMPhys.cpp	(revision 31205)
+++ /trunk/src/VBox/VMM/PGMPhys.cpp	(revision 31206)
@@ -879,5 +879,5 @@
 
     /* Flush the recompiler's TLB as well. */
-    for (unsigned i = 0; i < pVM->cCpus; i++)
+    for (VMCPUID i = 0; i < pVM->cCpus; i++)
         CPUMSetChangedFlags(&pVM->aCpus[i], CPUM_CHANGED_GLOBAL_TLB_FLUSH);
 
@@ -2808,5 +2808,10 @@
                     pRomNew->fFlags = fFlags;
                     pRomNew->idSavedState = UINT8_MAX;
+#ifdef VBOX_STRICT
+                    pRomNew->pvOriginal = fFlags & PGMPHYS_ROM_FLAGS_PERMANENT_BINARY
+                                        ? pvBinary : RTMemDup(pvBinary, cPages * PAGE_SIZE);
+#else
                     pRomNew->pvOriginal = fFlags & PGMPHYS_ROM_FLAGS_PERMANENT_BINARY ? pvBinary : NULL;
+#endif
                     pRomNew->pszDesc = pszDesc;
 
@@ -2889,5 +2894,6 @@
  * @param   pvUser          User argument.
  */
-static DECLCALLBACK(int) pgmR3PhysRomWriteHandler(PVM pVM, RTGCPHYS GCPhys, void *pvPhys, void *pvBuf, size_t cbBuf, PGMACCESSTYPE enmAccessType, void *pvUser)
+static DECLCALLBACK(int) pgmR3PhysRomWriteHandler(PVM pVM, RTGCPHYS GCPhys, void *pvPhys, void *pvBuf, size_t cbBuf,
+                                                  PGMACCESSTYPE enmAccessType, void *pvUser)
 {
     PPGMROMRANGE    pRom     = (PPGMROMRANGE)pvUser;
@@ -2929,5 +2935,5 @@
 
             /*
-             * Write to the ram page.
+             * Write to the RAM page.
              */
             case PGMROMPROT_READ_ROM_WRITE_RAM:
@@ -3073,4 +3079,30 @@
 
 /**
+ * Called by PGMR3Term to free resources.
+ *
+ * ASSUMES that the caller owns the PGM lock.
+ *
+ * @param   pVM         The VM handle.
+ */
+void pgmR3PhysRomTerm(PVM pVM)
+{
+#ifdef RT_STRICT
+    /*
+     * Free the heap copy of the original bits.
+     */
+    for (PPGMROMRANGE pRom = pVM->pgm.s.pRomRangesR3; pRom; pRom = pRom->pNextR3)
+    {
+        if (   pRom->pvOriginal
+            && !(pRom->fFlags & PGMPHYS_ROM_FLAGS_PERMANENT_BINARY))
+        {
+            RTMemFree((void *)pRom->pvOriginal);
+            pRom->pvOriginal = NULL;
+        }
+    }
+#endif
+}
+
+
+/**
  * Change the shadowing of a range of ROM pages.
  *