Index: /trunk/include/VBox/dis.h
===================================================================
--- /trunk/include/VBox/dis.h	(revision 41790)
+++ /trunk/include/VBox/dis.h	(revision 41791)
@@ -632,10 +632,4 @@
     uint32_t        uPadding4;
 #endif
-    /** User data that can be set prior to calling the API.
-     * @deprecated Please don't use this any more. */
-    void           *pvUser2;
-#if ARCH_BITS == 32
-    uint32_t        uPadding5;
-#endif
 } DISSTATE;
 
Index: /trunk/src/VBox/Disassembler/DisasmCore.cpp
===================================================================
--- /trunk/src/VBox/Disassembler/DisasmCore.cpp	(revision 41790)
+++ /trunk/src/VBox/Disassembler/DisasmCore.cpp	(revision 41791)
@@ -48,6 +48,4 @@
 *******************************************************************************/
 static void     disasmModRMReg(PDISSTATE pDis, PCDISOPCODE pOp, unsigned idx, PDISOPPARAM pParam, int fRegAddr);
-static void     disasmModRMReg16(PDISSTATE pDis, PCDISOPCODE pOp, unsigned idx, PDISOPPARAM pParam);
-static void     disasmModRMSReg(PDISSTATE pDis, PCDISOPCODE pOp, unsigned idx, PDISOPPARAM pParam);
 
 
@@ -214,8 +212,11 @@
 
 
-//*****************************************************************************
-/* Read functions for getting the opcode bytes */
-//*****************************************************************************
-
+/********************************************************************************************************************************
+ *
+ *
+ * Read functions for getting the opcode bytes
+ *
+ *
+ ********************************************************************************************************************************/
 
 /**
@@ -593,17 +594,14 @@
 static size_t ParseEscFP(size_t offInstr, PCDISOPCODE pOp, PDISOPPARAM pParam, PDISSTATE pDis)
 {
-    int index;
+    size_t      size = 0;
     PCDISOPCODE fpop;
-    size_t size = 0;
-    unsigned ModRM;
     NOREF(pOp);
 
-    ModRM = disReadByte(pDis, offInstr);
-
-    index = pDis->bOpCode - 0xD8;
+    unsigned    ModRM = disReadByte(pDis, offInstr);
+    unsigned    index = pDis->bOpCode - 0xD8;
     if (ModRM <= 0xBF)
     {
         fpop            = &(g_apMapX86_FP_Low[index])[MODRM_REG(ModRM)];
-        pDis->pCurInstr = (PCDISOPCODE)fpop;
+        pDis->pCurInstr = fpop;
 
         // Should contain the parameter type on input
@@ -614,5 +612,5 @@
     {
         fpop            = &(g_apMapX86_FP_High[index])[ModRM - 0xC0];
-        pDis->pCurInstr = (PCDISOPCODE)fpop;
+        pDis->pCurInstr = fpop;
     }
 
@@ -644,16 +642,22 @@
 
     if (fpop->idxParse1 != IDX_ParseNop)
-        size += pDis->pfnDisasmFnTable[fpop->idxParse1](offInstr+size, (PCDISOPCODE)fpop, pParam, pDis);
+        size += pDis->pfnDisasmFnTable[fpop->idxParse1](offInstr+size, fpop, pParam, pDis);
 
     if (fpop->idxParse2 != IDX_ParseNop)
-        size += pDis->pfnDisasmFnTable[fpop->idxParse2](offInstr+size, (PCDISOPCODE)fpop, pParam, pDis);
+        size += pDis->pfnDisasmFnTable[fpop->idxParse2](offInstr+size, fpop, pParam, pDis);
 
     return size;
 }
-//*****************************************************************************
-// SIB byte: (not 16-bit mode)
-// 7 - 6  5 - 3  2-0
-// Scale  Index  Base
-//*****************************************************************************
+
+
+/********************************************************************************************************************************
+ *
+ *
+ * SIB byte: (not 16-bit mode)
+ * 7 - 6  5 - 3  2-0
+ * Scale  Index  Base
+ *
+ *
+ ********************************************************************************************************************************/
 static void UseSIB(size_t offInstr, PCDISOPCODE pOp, PDISOPPARAM pParam, PDISSTATE pDis)
 {
@@ -703,13 +707,12 @@
     return;   /* Already fetched everything in ParseSIB; no size returned */
 }
-//*****************************************************************************
-//*****************************************************************************
+
+
 static size_t ParseSIB(size_t offInstr, PCDISOPCODE pOp, PDISOPPARAM pParam, PDISSTATE pDis)
 {
     unsigned size = sizeof(uint8_t);
-    unsigned SIB;
     NOREF(pOp); NOREF(pParam);
 
-    SIB = disReadByte(pDis, offInstr);
+    unsigned SIB = disReadByte(pDis, offInstr);
     offInstr += size;
 
@@ -722,7 +725,7 @@
         /* REX.B extends the Base field if not scaled index + disp32 */
         if (!(pDis->SIB.Bits.Base == 5 && pDis->ModRM.Bits.Mod == 0))
-            pDis->SIB.Bits.Base  |= ((!!(pDis->fRexPrefix & DISPREFIX_REX_FLAGS_B)) << 3);
-
-        pDis->SIB.Bits.Index |= ((!!(pDis->fRexPrefix & DISPREFIX_REX_FLAGS_X)) << 3);
+            pDis->SIB.Bits.Base  |= (!!(pDis->fRexPrefix & DISPREFIX_REX_FLAGS_B)) << 3;
+
+        pDis->SIB.Bits.Index |= (!!(pDis->fRexPrefix & DISPREFIX_REX_FLAGS_X)) << 3;
     }
 
@@ -736,13 +739,12 @@
     return size;
 }
-//*****************************************************************************
-//*****************************************************************************
+
+
 static size_t ParseSIB_SizeOnly(size_t offInstr, PCDISOPCODE pOp, PDISOPPARAM pParam, PDISSTATE pDis)
 {
     unsigned size = sizeof(uint8_t);
-    unsigned SIB;
     NOREF(pOp); NOREF(pParam);
 
-    SIB = disReadByte(pDis, offInstr);
+    unsigned SIB = disReadByte(pDis, offInstr);
 
     pDis->SIB.Bits.Base  = SIB_BASE(SIB);
@@ -766,9 +768,122 @@
     return size;
 }
-//*****************************************************************************
-// ModR/M byte:
-// 7 - 6  5 - 3       2-0
-// Mod    Reg/Opcode  R/M
-//*****************************************************************************
+
+
+
+/********************************************************************************************************************************
+ *
+ *
+ * ModR/M byte:
+ * 7 - 6  5 - 3       2-0
+ * Mod    Reg/Opcode  R/M
+ *
+ *
+ ********************************************************************************************************************************/
+static void disasmModRMReg(PDISSTATE pDis, PCDISOPCODE pOp, unsigned idx, PDISOPPARAM pParam, int fRegAddr)
+{
+    NOREF(pOp); NOREF(pDis);
+
+    unsigned mod     = pDis->ModRM.Bits.Mod;
+
+    unsigned type    = OP_PARM_VTYPE(pParam->fParam);
+    unsigned subtype = OP_PARM_VSUBTYPE(pParam->fParam);
+    if (fRegAddr)
+        subtype = (pDis->uAddrMode == DISCPUMODE_64BIT) ? OP_PARM_q : OP_PARM_d;
+    else
+    if (subtype == OP_PARM_v || subtype == OP_PARM_NONE)
+    {
+        switch (pDis->uOpMode)
+        {
+        case DISCPUMODE_32BIT:
+            subtype = OP_PARM_d;
+            break;
+        case DISCPUMODE_64BIT:
+            subtype = OP_PARM_q;
+            break;
+        case DISCPUMODE_16BIT:
+            subtype = OP_PARM_w;
+            break;
+        default:
+            /* make gcc happy */
+            break;
+        }
+    }
+
+    switch (subtype)
+    {
+    case OP_PARM_b:
+        Assert(idx < (pDis->fPrefix & DISPREFIX_REX ? 16U : 8U));
+
+        /* AH, BH, CH & DH map to DIL, SIL, EBL & SPL when a rex prefix is present. */
+        /* Intel® 64 and IA-32 Architectures Software Developers Manual: 3.4.1.1 */
+        if (    (pDis->fPrefix & DISPREFIX_REX)
+            &&  idx >= DISGREG_AH
+            &&  idx <= DISGREG_BH)
+        {
+            idx += (DISGREG_SPL - DISGREG_AH);
+        }
+
+        pParam->fUse |= DISUSE_REG_GEN8;
+        pParam->Base.idxGenReg = idx;
+        break;
+
+    case OP_PARM_w:
+        Assert(idx < (pDis->fPrefix & DISPREFIX_REX ? 16U : 8U));
+
+        pParam->fUse |= DISUSE_REG_GEN16;
+        pParam->Base.idxGenReg = idx;
+        break;
+
+    case OP_PARM_d:
+        Assert(idx < (pDis->fPrefix & DISPREFIX_REX ? 16U : 8U));
+
+        pParam->fUse |= DISUSE_REG_GEN32;
+        pParam->Base.idxGenReg = idx;
+        break;
+
+    case OP_PARM_q:
+        pParam->fUse |= DISUSE_REG_GEN64;
+        pParam->Base.idxGenReg = idx;
+        break;
+
+    default:
+        Log(("disasmModRMReg %x:%x failed!!\n", type, subtype));
+        pDis->rc = VERR_DIS_INVALID_MODRM;
+        break;
+    }
+}
+
+static void disasmModRMReg16(PDISSTATE pDis, PCDISOPCODE pOp, unsigned idx, PDISOPPARAM pParam)
+{
+    static const uint8_t s_auBaseModRMReg16[8]  =
+    { DISGREG_BX, DISGREG_BX, DISGREG_BP, DISGREG_BP, DISGREG_SI, DISGREG_DI, DISGREG_BP, DISGREG_BX };
+
+    NOREF(pDis); NOREF(pOp);
+    pParam->fUse |= DISUSE_REG_GEN16;
+    pParam->Base.idxGenReg = s_auBaseModRMReg16[idx];
+    if (idx < 4)
+    {
+        static const uint8_t s_auIndexModRMReg16[4] = { DISGREG_SI, DISGREG_DI, DISGREG_SI, DISGREG_DI };
+        pParam->fUse |= DISUSE_INDEX;
+        pParam->Index.idxGenReg = s_auIndexModRMReg16[idx];
+    }
+}
+//*****************************************************************************
+//*****************************************************************************
+static void disasmModRMSReg(PDISSTATE pDis, PCDISOPCODE pOp, unsigned idx, PDISOPPARAM pParam)
+{
+    NOREF(pOp);
+    if (idx >= DISSELREG_END)
+    {
+        Log(("disasmModRMSReg %d failed!!\n", idx));
+        pDis->rc = VERR_DIS_INVALID_PARAMETER;
+        return;
+    }
+
+    pParam->fUse |= DISUSE_REG_SEG;
+    pParam->Base.idxSegReg = (DISSELREG)idx;
+}
+
+
 static size_t UseModRM(size_t offInstr, PCDISOPCODE pOp, PDISOPPARAM pParam, PDISSTATE pDis)
 {
@@ -1972,5 +2087,5 @@
     unsigned reg   = MODRM_REG(modrm);
 
-    pOp = (PCDISOPCODE)&g_aMapX86_Group1[idx+reg];
+    pOp = &g_aMapX86_Group1[idx+reg];
     //little hack to make sure the ModRM byte is included in the returned size
     if (pOp->idxParse1 != IDX_ParseModRM && pOp->idxParse2 != IDX_ParseModRM)
@@ -2032,5 +2147,5 @@
     unsigned reg   = MODRM_REG(modrm);
 
-    pOp = (PCDISOPCODE)&g_aMapX86_Group3[idx+reg];
+    pOp = &g_aMapX86_Group3[idx+reg];
 
     //little hack to make sure the ModRM byte is included in the returned size
@@ -2052,5 +2167,5 @@
     unsigned reg   = MODRM_REG(modrm);
 
-    pOp = (PCDISOPCODE)&g_aMapX86_Group4[reg];
+    pOp = &g_aMapX86_Group4[reg];
 
     //little hack to make sure the ModRM byte is included in the returned size
@@ -2072,5 +2187,5 @@
     unsigned reg   = MODRM_REG(modrm);
 
-    pOp = (PCDISOPCODE)&g_aMapX86_Group5[reg];
+    pOp = &g_aMapX86_Group5[reg];
 
     //little hack to make sure the ModRM byte is included in the returned size
@@ -2106,5 +2221,5 @@
     uint8_t opcode = disReadByte(pDis, offInstr+sizeof(uint8_t)+modrmsize);
 
-    pOp = (PCDISOPCODE)&g_aTwoByteMapX86_3DNow[opcode];
+    pOp = &g_aTwoByteMapX86_3DNow[opcode];
 
     //little hack to make sure the ModRM byte is included in the returned size
@@ -2132,5 +2247,5 @@
     unsigned reg   = MODRM_REG(modrm);
 
-    pOp = (PCDISOPCODE)&g_aMapX86_Group6[reg];
+    pOp = &g_aMapX86_Group6[reg];
 
     //little hack to make sure the ModRM byte is included in the returned size
@@ -2155,10 +2270,10 @@
 
     if (mod == 3 && rm == 0)
-        pOp = (PCDISOPCODE)&g_aMapX86_Group7_mod11_rm000[reg];
+        pOp = &g_aMapX86_Group7_mod11_rm000[reg];
     else
     if (mod == 3 && rm == 1)
-        pOp = (PCDISOPCODE)&g_aMapX86_Group7_mod11_rm001[reg];
-    else
-        pOp = (PCDISOPCODE)&g_aMapX86_Group7_mem[reg];
+        pOp = &g_aMapX86_Group7_mod11_rm001[reg];
+    else
+        pOp = &g_aMapX86_Group7_mem[reg];
 
     //little hack to make sure the ModRM byte is included in the returned size
@@ -2180,5 +2295,5 @@
     unsigned reg   = MODRM_REG(modrm);
 
-    pOp = (PCDISOPCODE)&g_aMapX86_Group8[reg];
+    pOp = &g_aMapX86_Group8[reg];
 
     //little hack to make sure the ModRM byte is included in the returned size
@@ -2200,5 +2315,5 @@
     unsigned reg   = MODRM_REG(modrm);
 
-    pOp = (PCDISOPCODE)&g_aMapX86_Group9[reg];
+    pOp = &g_aMapX86_Group9[reg];
 
     //little hack to make sure the ModRM byte is included in the returned size
@@ -2220,5 +2335,5 @@
     unsigned reg   = MODRM_REG(modrm);
 
-    pOp = (PCDISOPCODE)&g_aMapX86_Group10[reg];
+    pOp = &g_aMapX86_Group10[reg];
 
     //little hack to make sure the ModRM byte is included in the returned size
@@ -2243,5 +2358,5 @@
         reg += 8;   //2nd table
 
-    pOp = (PCDISOPCODE)&g_aMapX86_Group12[reg];
+    pOp = &g_aMapX86_Group12[reg];
 
     //little hack to make sure the ModRM byte is included in the returned size
@@ -2264,5 +2379,5 @@
         reg += 8;   //2nd table
 
-    pOp = (PCDISOPCODE)&g_aMapX86_Group13[reg];
+    pOp = &g_aMapX86_Group13[reg];
 
     //little hack to make sure the ModRM byte is included in the returned size
@@ -2286,5 +2401,5 @@
         reg += 8;   //2nd table
 
-    pOp = (PCDISOPCODE)&g_aMapX86_Group14[reg];
+    pOp = &g_aMapX86_Group14[reg];
 
     //little hack to make sure the ModRM byte is included in the returned size
@@ -2309,7 +2424,7 @@
 
     if (mod == 3 && rm == 0)
-        pOp = (PCDISOPCODE)&g_aMapX86_Group15_mod11_rm000[reg];
-    else
-        pOp = (PCDISOPCODE)&g_aMapX86_Group15_mem[reg];
+        pOp = &g_aMapX86_Group15_mod11_rm000[reg];
+    else
+        pOp = &g_aMapX86_Group15_mem[reg];
 
     //little hack to make sure the ModRM byte is included in the returned size
@@ -2330,5 +2445,5 @@
     unsigned reg   = MODRM_REG(modrm);
 
-    pOp = (PCDISOPCODE)&g_aMapX86_Group16[reg];
+    pOp = &g_aMapX86_Group16[reg];
 
     //little hack to make sure the ModRM byte is included in the returned size
@@ -2338,110 +2453,4 @@
     size += disParseInstruction(offInstr, pOp, pDis);
     return size;
-}
-//*****************************************************************************
-//*****************************************************************************
-static void disasmModRMReg(PDISSTATE pDis, PCDISOPCODE pOp, unsigned idx, PDISOPPARAM pParam, int fRegAddr)
-{
-    NOREF(pOp); NOREF(pDis);
-
-    unsigned mod     = pDis->ModRM.Bits.Mod;
-
-    unsigned type    = OP_PARM_VTYPE(pParam->fParam);
-    unsigned subtype = OP_PARM_VSUBTYPE(pParam->fParam);
-    if (fRegAddr)
-        subtype = (pDis->uAddrMode == DISCPUMODE_64BIT) ? OP_PARM_q : OP_PARM_d;
-    else
-    if (subtype == OP_PARM_v || subtype == OP_PARM_NONE)
-    {
-        switch (pDis->uOpMode)
-        {
-        case DISCPUMODE_32BIT:
-            subtype = OP_PARM_d;
-            break;
-        case DISCPUMODE_64BIT:
-            subtype = OP_PARM_q;
-            break;
-        case DISCPUMODE_16BIT:
-            subtype = OP_PARM_w;
-            break;
-        default:
-            /* make gcc happy */
-            break;
-        }
-    }
-
-    switch (subtype)
-    {
-    case OP_PARM_b:
-        Assert(idx < (pDis->fPrefix & DISPREFIX_REX ? 16U : 8U));
-
-        /* AH, BH, CH & DH map to DIL, SIL, EBL & SPL when a rex prefix is present. */
-        /* Intel® 64 and IA-32 Architectures Software Developers Manual: 3.4.1.1 */
-        if (    (pDis->fPrefix & DISPREFIX_REX)
-            &&  idx >= DISGREG_AH
-            &&  idx <= DISGREG_BH)
-        {
-            idx += (DISGREG_SPL - DISGREG_AH);
-        }
-
-        pParam->fUse |= DISUSE_REG_GEN8;
-        pParam->Base.idxGenReg = idx;
-        break;
-
-    case OP_PARM_w:
-        Assert(idx < (pDis->fPrefix & DISPREFIX_REX ? 16U : 8U));
-
-        pParam->fUse |= DISUSE_REG_GEN16;
-        pParam->Base.idxGenReg = idx;
-        break;
-
-    case OP_PARM_d:
-        Assert(idx < (pDis->fPrefix & DISPREFIX_REX ? 16U : 8U));
-
-        pParam->fUse |= DISUSE_REG_GEN32;
-        pParam->Base.idxGenReg = idx;
-        break;
-
-    case OP_PARM_q:
-        pParam->fUse |= DISUSE_REG_GEN64;
-        pParam->Base.idxGenReg = idx;
-        break;
-
-    default:
-        Log(("disasmModRMReg %x:%x failed!!\n", type, subtype));
-        pDis->rc = VERR_DIS_INVALID_MODRM;
-        break;
-    }
-}
-//*****************************************************************************
-static const uint8_t g_auBaseModRMReg16[8]  =
-{ DISGREG_BX, DISGREG_BX, DISGREG_BP, DISGREG_BP, DISGREG_SI, DISGREG_DI, DISGREG_BP, DISGREG_BX};
-static const uint8_t g_auIndexModRMReg16[4] = { DISGREG_SI, DISGREG_DI, DISGREG_SI, DISGREG_DI };
-//*****************************************************************************
-static void disasmModRMReg16(PDISSTATE pDis, PCDISOPCODE pOp, unsigned idx, PDISOPPARAM pParam)
-{
-    NOREF(pDis); NOREF(pOp);
-    pParam->fUse |= DISUSE_REG_GEN16;
-    pParam->Base.idxGenReg = g_auBaseModRMReg16[idx];
-    if (idx < 4)
-    {
-        pParam->fUse |= DISUSE_INDEX;
-        pParam->Index.idxGenReg = g_auIndexModRMReg16[idx];
-    }
-}
-//*****************************************************************************
-//*****************************************************************************
-static void disasmModRMSReg(PDISSTATE pDis, PCDISOPCODE pOp, unsigned idx, PDISOPPARAM pParam)
-{
-    NOREF(pOp);
-    if (idx >= DISSELREG_END)
-    {
-        Log(("disasmModRMSReg %d failed!!\n", idx));
-        pDis->rc = VERR_DIS_INVALID_PARAMETER;
-        return;
-    }
-
-    pParam->fUse |= DISUSE_REG_SEG;
-    pParam->Base.idxSegReg = (DISSELREG)idx;
 }
 
@@ -2657,8 +2666,5 @@
                    PFNDISREADBYTES pfnReadBytes, void *pvUser)
 {
-    /*
-     * Note! The RT_BZERO make ASSUMPTIONS about the placement of pvUser2.
-     */
-    RT_BZERO(pDis, RT_OFFSETOF(DISSTATE, pvUser2));
+    RT_ZERO(*pDis);
 
 #ifdef VBOX_STRICT /* poison */
@@ -2747,8 +2753,5 @@
  * @param   fFilter         Instruction type filter.
  * @param   pvUser          User argument for the instruction reader. (Ends up in pvUser.)
- * @param   pDis            Pointer to CPU structure. With the exception of
- *                          DISSTATE::pvUser2, the structure will be
- *                          completely initialized by this API, i.e. no input is
- *                          taken from it.
+ * @param   pDis            Pointer to disassembler state (output).
  * @param   pcbInstr        Where to store the size of the instruction.  (This
  *                          is also stored in PDISSTATE::cbInstr.)  Optional.
@@ -2779,8 +2782,5 @@
  * @param   fFilter         Instruction type filter.
  * @param   pvUser          User argument for the instruction reader. (Ends up in pvUser.)
- * @param   pDis            Pointer to CPU structure. With the exception of
- *                          DISSTATE::pvUser2, the structure will be
- *                          completely initialized by this API, i.e. no input is
- *                          taken from it.
+ * @param   pDis            Pointer to disassembler state (output).
  * @param   pcbInstr        Where to store the size of the instruction.  (This
  *                          is also stored in PDISSTATE::cbInstr.)  Optional.
Index: /trunk/src/VBox/VMM/VMMR3/CSAM.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR3/CSAM.cpp	(revision 41790)
+++ /trunk/src/VBox/VMM/VMMR3/CSAM.cpp	(revision 41791)
@@ -723,4 +723,13 @@
 }
 
+
+/** For csamR3ReadBytes. */
+typedef struct CSAMDISINFO
+{
+    PVM             pVM;
+    uint8_t const  *pbSrcInstr; /* aka pInstHC */
+} CSAMDISINFO, *PCSAMDISINFO;
+
+
 /**
  * @callback_method_impl{FNDISREADBYTES}
@@ -728,5 +737,5 @@
 static DECLCALLBACK(int) csamR3ReadBytes(PDISCPUSTATE pDis, uint8_t offInstr, uint8_t cbMinRead, uint8_t cbMaxRead)
 {
-    PVM pVM = (PVM)pDis->pvUser;
+    PCSAMDISINFO pDisInfo = (PCSAMDISINFO)pDis->pvUser;
 
     /*
@@ -741,5 +750,5 @@
     size_t      cbRead   = cbMaxRead;
     RTUINTPTR   uSrcAddr = pDis->uInstrAddr + offInstr;
-    int rc = PATMR3ReadOrgInstr(pVM, pDis->uInstrAddr + offInstr, &pDis->abInstr[offInstr], cbRead, &cbRead);
+    int rc = PATMR3ReadOrgInstr(pDisInfo->pVM, pDis->uInstrAddr + offInstr, &pDis->abInstr[offInstr], cbRead, &cbRead);
     if (RT_SUCCESS(rc))
     {
@@ -759,16 +768,16 @@
      * The current byte isn't a patch instruction byte.
      */
-    uint8_t const  *pbSrcInstr = (uint8_t const *)pDis->pvUser2; AssertPtr(pbSrcInstr);
+    AssertPtr(pDisInfo->pbSrcInstr);
     if ((pDis->uInstrAddr >> PAGE_SHIFT) == ((uSrcAddr + cbMaxRead - 1) >> PAGE_SHIFT))
     {
-        memcpy(&pDis->abInstr[offInstr], &pbSrcInstr[offInstr], cbMaxRead);
+        memcpy(&pDis->abInstr[offInstr], &pDisInfo->pbSrcInstr[offInstr], cbMaxRead);
         offInstr += cbMaxRead;
         rc = VINF_SUCCESS;
     }
     else if (   (pDis->uInstrAddr >> PAGE_SHIFT) == ((uSrcAddr + cbMinRead - 1) >> PAGE_SHIFT)
-             || PATMIsPatchGCAddr(pVM, uSrcAddr) /** @todo does CSAM actually analyze patch code, or is this just a copy&past check? */
+             || PATMIsPatchGCAddr(pDisInfo->pVM, uSrcAddr) /** @todo does CSAM actually analyze patch code, or is this just a copy&past check? */
             )
     {
-        memcpy(&pDis->abInstr[offInstr], &pbSrcInstr[offInstr], cbMaxRead);
+        memcpy(&pDis->abInstr[offInstr], &pDisInfo->pbSrcInstr[offInstr], cbMaxRead);
         offInstr += cbMinRead;
         rc = VINF_SUCCESS;
@@ -777,5 +786,5 @@
     {
         /* Crossed page boundrary, pbSrcInstr is no good... */
-        rc = PGMPhysSimpleReadGCPtr(VMMGetCpu0(pVM), &pDis->abInstr[offInstr], uSrcAddr, cbMinRead);
+        rc = PGMPhysSimpleReadGCPtr(VMMGetCpu0(pDisInfo->pVM), &pDis->abInstr[offInstr], uSrcAddr, cbMinRead);
         offInstr += cbMinRead;
     }
@@ -788,7 +797,5 @@
                                PDISCPUSTATE pCpu, uint32_t *pcbInstr, char *pszOutput, size_t cbOutput)
 {
-    /** @todo Put pVM and pbInstrHC in a stack structure and pass it to
-     *        csamR3ReadBytes via pvUser. This is the last pvUser2 usage. */
-    pCpu->pvUser2 = InstrHC;
+    CSAMDISINFO DisInfo = { pVM, InstrHC };
 #ifdef DEBUG
     return DISInstrToStrEx(InstrGC, enmCpuMode, csamR3ReadBytes, pVM, DISOPTYPE_ALL,
