Index: /trunk/src/VBox/VMM/VMMR3/PGM.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR3/PGM.cpp	(revision 41392)
+++ /trunk/src/VBox/VMM/VMMR3/PGM.cpp	(revision 41393)
@@ -1251,4 +1251,5 @@
 
         pPGM->fA20Enabled      = true;
+        pPGM->GCPhysA20Mask    = ~(RTGCPHYS)(!pPGM->fA20Enabled << 20);
     }
 
Index: /trunk/src/VBox/VMM/VMMR3/PGMPhys.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR3/PGMPhys.cpp	(revision 41392)
+++ /trunk/src/VBox/VMM/VMMR3/PGMPhys.cpp	(revision 41393)
@@ -3391,4 +3391,5 @@
     Log5(("pgmR3PhysRomWriteHandler: %d %c %#08RGp %#04zx\n", pRomPage->enmProt, enmAccessType == PGMACCESSTYPE_READ ? 'R' : 'W', GCPhys, cbBuf));
     NOREF(pvPhys);
+RTLogPrintf("pgmPhysRomWriteHandler: enmAccessType=%d GCPhys=%RGp\n", (uint32_t)enmAccessType, GCPhys);
 
     if (enmAccessType == PGMACCESSTYPE_READ)
Index: /trunk/src/VBox/VMM/VMMR3/PGMSavedState.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR3/PGMSavedState.cpp	(revision 41392)
+++ /trunk/src/VBox/VMM/VMMR3/PGMSavedState.cpp	(revision 41393)
@@ -3017,4 +3017,10 @@
 
     /*
+     * Fix the A20 mask.
+     */
+    for (VMCPUID i = 0; i < pVM->cCpus; i++)
+        pVM->aCpus[i].pgm.s.GCPhysA20Mask = ~(RTGCPHYS)(!pVM->aCpus[i].pgm.s.fA20Enabled << 20);
+
+    /*
      * The guest mappings - skipped now, see re-fixation in the caller.
      */