Index: /trunk/src/VBox/Main/src-client/ConsoleImpl.cpp
===================================================================
--- /trunk/src/VBox/Main/src-client/ConsoleImpl.cpp	(revision 53759)
+++ /trunk/src/VBox/Main/src-client/ConsoleImpl.cpp	(revision 53760)
@@ -2267,5 +2267,5 @@
         return ptrVM.rc();
 
-    /* release the lock before a VMR3* call (EMT will call us back)! */
+    /* release the lock before a VMR3* call (EMT might wait for it, @bugref{7648})! */
     alock.release();
 
@@ -2373,11 +2373,13 @@
                            (PFNRT)i_unplugCpu, 3,
                            this, pUVM, (VMCPUID)aCpu);
-        if (vrc == VERR_TIMEOUT || RT_SUCCESS(vrc))
-        {
+    
+        /* release the lock before a VMR3* call (EMT might wait for it, @bugref{7648})! */
+        alock.release();
+
+        if (vrc == VERR_TIMEOUT)
             vrc = VMR3ReqWait(pReq, RT_INDEFINITE_WAIT);
-            AssertRC(vrc);
-            if (RT_SUCCESS(vrc))
-                vrc = pReq->iStatus;
-        }
+        AssertRC(vrc);
+        if (RT_SUCCESS(vrc))
+            vrc = pReq->iStatus;
         VMR3ReqFree(pReq);
 
@@ -2480,20 +2482,13 @@
                            this, pUVM, aCpu);
 
-    /* release the lock before a VMR3* call (EMT will call us back)! */
+    /* release the lock before a VMR3* call (EMT might wait for it, @bugref{7648})! */
     alock.release();
 
-    if (vrc == VERR_TIMEOUT || RT_SUCCESS(vrc))
-    {
+    if (vrc == VERR_TIMEOUT)
         vrc = VMR3ReqWait(pReq, RT_INDEFINITE_WAIT);
-        AssertRC(vrc);
-        if (RT_SUCCESS(vrc))
-            vrc = pReq->iStatus;
-    }
+    AssertRC(vrc);
+    if (RT_SUCCESS(vrc))
+        vrc = pReq->iStatus;
     VMR3ReqFree(pReq);
-
-    rc = RT_SUCCESS(vrc) ? S_OK :
-        setError(VBOX_E_VM_ERROR,
-                 tr("Could not add CPU to the machine (%Rrc)"),
-                 vrc);
 
     if (RT_SUCCESS(vrc))
@@ -2506,4 +2501,8 @@
         /** @todo warning if the guest doesn't support it */
     }
+    else
+        rc = setError(VBOX_E_VM_ERROR,
+                      tr("Could not add CPU to the machine (%Rrc)"),
+                      vrc);
 
     LogFlowThisFunc(("mMachineState=%d, rc=%Rhrc\n", mMachineState, rc));
@@ -3603,14 +3602,12 @@
                            this, pUVM, pszDevice, uInstance, enmBus, fUseHostIOCache, aMediumAttachment, fForce);
 
-    /* release the lock before waiting for a result (EMT will call us back!) */
+    /* release the lock before waiting for a result (EMT might wait for it, @bugref{7648})! */
     alock.release();
 
-    if (vrc == VERR_TIMEOUT || RT_SUCCESS(vrc))
-    {
+    if (vrc == VERR_TIMEOUT)
         vrc = VMR3ReqWait(pReq, RT_INDEFINITE_WAIT);
-        AssertRC(vrc);
-        if (RT_SUCCESS(vrc))
-            vrc = pReq->iStatus;
-    }
+    AssertRC(vrc);
+    if (RT_SUCCESS(vrc))
+        vrc = pReq->iStatus;
     VMR3ReqFree(pReq);
 
@@ -3799,14 +3796,12 @@
                            this, pUVM, pszDevice, uInstance, enmBus, fUseHostIOCache, aMediumAttachment, fSilent);
 
-    /* release the lock before waiting for a result (EMT will call us back!) */
+    /* release the lock before waiting for a result (EMT might wait for it, @bugref{7648})! */
     alock.release();
 
-    if (vrc == VERR_TIMEOUT || RT_SUCCESS(vrc))
-    {
+    if (vrc == VERR_TIMEOUT)
         vrc = VMR3ReqWait(pReq, RT_INDEFINITE_WAIT);
-        AssertRC(vrc);
-        if (RT_SUCCESS(vrc))
-            vrc = pReq->iStatus;
-    }
+    AssertRC(vrc);
+    if (RT_SUCCESS(vrc))
+        vrc = pReq->iStatus;
     VMR3ReqFree(pReq);
 
@@ -3991,14 +3986,12 @@
                            this, pUVM, pszDevice, uInstance, enmBus, aMediumAttachment, fSilent);
 
-    /* release the lock before waiting for a result (EMT will call us back!) */
+    /* release the lock before waiting for a result (EMT might wait for it, @bugref{7648})! */
     alock.release();
 
-    if (vrc == VERR_TIMEOUT || RT_SUCCESS(vrc))
-    {
+    if (vrc == VERR_TIMEOUT)
         vrc = VMR3ReqWait(pReq, RT_INDEFINITE_WAIT);
-        AssertRC(vrc);
-        if (RT_SUCCESS(vrc))
-            vrc = pReq->iStatus;
-    }
+    AssertRC(vrc);
+    if (RT_SUCCESS(vrc))
+        vrc = pReq->iStatus;
     VMR3ReqFree(pReq);
 
@@ -4771,16 +4764,7 @@
      */
     PVMREQ pReq;
-    int vrc = VMR3ReqCallU(pUVM, 0 /*idDstCpu*/, &pReq, 0 /* no wait! */, VMREQFLAGS_VBOX_STATUS,
-                           (PFNRT)i_changeNetworkAttachment, 6,
-                           this, pUVM, pszDevice, uInstance, uLun, aNetworkAdapter);
-
-    if (vrc == VERR_TIMEOUT || RT_SUCCESS(vrc))
-    {
-        vrc = VMR3ReqWait(pReq, RT_INDEFINITE_WAIT);
-        AssertRC(vrc);
-        if (RT_SUCCESS(vrc))
-            vrc = pReq->iStatus;
-    }
-    VMR3ReqFree(pReq);
+    int vrc = VMR3ReqCallWaitU(pUVM, 0 /*idDstCpu*/,
+                               (PFNRT)i_changeNetworkAttachment, 6,
+                               this, pUVM, pszDevice, uInstance, uLun, aNetworkAdapter);
 
     if (fResume)
@@ -6109,5 +6093,5 @@
         return ptrVM.rc();
 
-    /* release the lock before a VMR3* call (EMT will call us back)! */
+    /* release the lock before a VMR3* call (EMT might wait for it, @bugref{7648})! */
     alock.release();
 
@@ -6168,5 +6152,5 @@
         return ptrVM.rc();
 
-    /* release the lock before a VMR3* call (EMT will call us back)! */
+    /* release the lock before a VMR3* call (EMT might wait for it, @bugref{7648})! */
     alock.release();
 
@@ -6247,5 +6231,5 @@
             return ptrVM.rc();
 
-        /* release the lock before a VMR3* call (EMT will call us back)! */
+        /* release the lock before a VMR3* call (EMT might wait for it, @bugref{7648})! */
         alock.release();
         VMSUSPENDREASON enmReason = VMSUSPENDREASON_USER;
@@ -7423,5 +7407,5 @@
         LogFlowThisFunc(("Shutdown HGCM...\n"));
 
-        /* Leave the lock since EMT will call us back as addVMCaller() */
+        /* Leave the lock since EMT might wait for it and will call us back as addVMCaller() */
         alock.release();
 
@@ -8769,5 +8753,5 @@
             tr("General failure attaching to host interface"));
     }
-    LogFlowThisFunc(("rc=%d\n", rc));
+    LogFlowThisFunc(("rc=%Rhrc\n", rc));
     return rc;
 }
@@ -9938,4 +9922,7 @@
                  * isn't going to need the Console lock.
                  */
+
+                /* TODO: do alock.release here as EMT might wait on it! See other places
+                 * where we do VMR3ReqCall requests. See @bugref{7648}. */
                 vrc = VMR3ReqCallWaitU(ptrVM.rawUVM(), VMCPUID_ANY,
                                        (PFNRT)i_reconfigureMediumAttachment, 13,