Index: /trunk/src/VBox/VMM/VMMR3/PATM.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR3/PATM.cpp	(revision 54760)
+++ /trunk/src/VBox/VMM/VMMR3/PATM.cpp	(revision 54761)
@@ -763,5 +763,5 @@
         {
         case FIXUP_ABSOLUTE_IN_PATCH_ASM_TMPL:
-            Assert(pRec->pDest == pRec->pSource);
+            Assert(pRec->pDest == pRec->pSource); Assert(PATM_IS_FIXUP_TYPE(pRec->pSource));
             Log(("Absolute patch template fixup type %#x at %RHv -> %RHv at %RRv\n", pRec->pSource, *(RTRCUINTPTR *)pRec->pRelocPos, *(RTRCINTPTR*)pRec->pRelocPos + delta, pRec->pRelocPos));
             *(RTRCUINTPTR *)pRec->pRelocPos += delta;
@@ -916,4 +916,10 @@
             break;
         }
+
+        case FIXUP_CONSTANT_IN_PATCH_ASM_TMPL:
+            /* Only applicable when loading state. */
+            Assert(pRec->pDest == pRec->pSource);
+            Assert(PATM_IS_FIXUP_TYPE(pRec->pSource));
+            break;
 
         default:
Index: /trunk/src/VBox/VMM/VMMR3/PATMPatch.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR3/PATMPatch.cpp	(revision 54760)
+++ /trunk/src/VBox/VMM/VMMR3/PATMPatch.cpp	(revision 54761)
@@ -177,4 +177,5 @@
                  * A SAVED STATE WITH A DIFFERENT HYPERVISOR LAYOUT.
                  */
+                uint32_t uRelocType = FIXUP_ABSOLUTE_IN_PATCH_ASM_TMPL;
                 switch (pAsmRecord->aRelocs[i].uType)
                 {
@@ -353,5 +354,5 @@
                     /*
                      * The following fixups needs to be recalculated when loading saved state
-                     * Note! Earlier saved state versions had different hacks for detecting these.
+                     * Note! Earlier saved state versions had different hacks for detecting some of these.
                      */
                     case PATM_VM_FORCEDACTIONS:
@@ -367,24 +368,34 @@
                         dest = CPUMR3GetGuestCpuIdPatmArrayEndRCPtr(pVM);
                         break;
+
+                    case PATM_CPUID_STD_PTR: /* saved state only */
+                        dest = CPUMR3GetGuestCpuIdPatmStdRCPtr(pVM);
+                        break;
+                    case PATM_CPUID_EXT_PTR: /* saved state only */
+                        dest = CPUMR3GetGuestCpuIdPatmExtRCPtr(pVM);
+                        break;
+                    case PATM_CPUID_CENTAUR_PTR: /* saved state only */
+                        dest = CPUMR3GetGuestCpuIdPatmCentaurRCPtr(pVM);
+                        break;
+
+                    /*
+                     * The following fixups are constants that needs to be corrected when
+                     * loading saved state as these may change between VBox versions.
+                     */
                     case PATM_CPUID_ARRAY_ENTRY_SIZE:
                         dest = sizeof(CPUMCPUIDLEAF);
+                        uRelocType = FIXUP_CONSTANT_IN_PATCH_ASM_TMPL;
                         break;
                     case PATM_CPUID_UNKNOWN_METHOD:
                         dest = CPUMR3GetGuestCpuIdPatmUnknownLeafMethod(pVM);
-                        break;
-
-                    case PATM_CPUID_STD_PTR: /* saved state only */
-                        dest = CPUMR3GetGuestCpuIdPatmStdRCPtr(pVM);
-                        break;
-                    case PATM_CPUID_EXT_PTR: /* saved state only */
-                        dest = CPUMR3GetGuestCpuIdPatmExtRCPtr(pVM);
-                        break;
-                    case PATM_CPUID_CENTAUR_PTR: /* saved state only */
-                        dest = CPUMR3GetGuestCpuIdPatmCentaurRCPtr(pVM);
-                        break;
-
+                        uRelocType = FIXUP_CONSTANT_IN_PATCH_ASM_TMPL;
+                        break;
+
+                    /*
+                     * Unknown fixup.
+                     */
                     default:
+                        AssertReleaseMsgFailed(("Unknown fixup: %#x\n", pAsmRecord->aRelocs[i].uType));
                         dest = PATM_ILLEGAL_DESTINATION;
-                        AssertReleaseFailed();
                         break;
                 }
@@ -393,5 +404,5 @@
                 if (pAsmRecord->aRelocs[i].uType < PATM_NO_FIXUP)
                 {
-                    patmPatchAddReloc32(pVM, pPatch, &pPB[j], FIXUP_ABSOLUTE_IN_PATCH_ASM_TMPL,
+                    patmPatchAddReloc32(pVM, pPatch, &pPB[j], uRelocType,
                                         pAsmRecord->aRelocs[i].uType /*pSources*/, pAsmRecord->aRelocs[i].uType /*pDest*/);
                 }
Index: /trunk/src/VBox/VMM/VMMR3/PATMSSM.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR3/PATMSSM.cpp	(revision 54760)
+++ /trunk/src/VBox/VMM/VMMR3/PATMSSM.cpp	(revision 54761)
@@ -142,5 +142,7 @@
 *   Internal Functions                                                         *
 *******************************************************************************/
-static void patmCorrectFixup(PVM pVM, unsigned ulSSMVersion, PATM &patmInfo, PPATCHINFO pPatch, PRELOCREC pRec, int32_t offset, RTRCPTR *pFixup);
+static int patmCorrectFixup(PVM pVM, unsigned ulSSMVersion, PATM &patmInfo, PPATCHINFO pPatch, PRELOCREC pRec,
+                            int32_t offset, RTRCPTR *pFixup);
+
 
 /*******************************************************************************
@@ -981,5 +983,6 @@
                     }
 
-                    patmCorrectFixup(pVM, uVersion, patmInfo, &pPatchRec->patch, &rec, offset, pFixup);
+                    rc = patmCorrectFixup(pVM, uVersion, patmInfo, &pPatchRec->patch, &rec, offset, pFixup);
+                    AssertRCReturn(rc, rc);
                 }
 
@@ -1067,5 +1070,6 @@
 
         /* Correct fixups that refer to PATM structures in the hypervisor region (their addresses might have changed). */
-        patmCorrectFixup(pVM, uVersion, patmInfo, &pVM->patm.s.pGlobalPatchRec->patch, pRec, offset, pFixup);
+        rc = patmCorrectFixup(pVM, uVersion, patmInfo, &pVM->patm.s.pGlobalPatchRec->patch, pRec, offset, pFixup);
+        AssertRCReturn(rc, rc);
     }
 
@@ -1095,6 +1099,6 @@
  * @param   pFixup          Fixup address
  */
-static void patmCorrectFixup(PVM pVM, unsigned uVersion, PATM &patmInfo, PPATCHINFO pPatch, PRELOCREC pRec,
-                             int32_t offset, RTRCPTR *pFixup)
+static int patmCorrectFixup(PVM pVM, unsigned uVersion, PATM &patmInfo, PPATCHINFO pPatch, PRELOCREC pRec,
+                            int32_t offset, RTRCPTR *pFixup)
 {
     int32_t delta = pVM->patm.s.pPatchMemGC - patmInfo.pPatchMemGC;
@@ -1363,10 +1367,4 @@
                     *pFixup = CPUMR3GetGuestCpuIdPatmArrayEndRCPtr(pVM);
                     break;
-                case PATM_CPUID_ARRAY_ENTRY_SIZE:
-                    *pFixup = sizeof(CPUMCPUIDLEAF);
-                    break;
-                case PATM_CPUID_UNKNOWN_METHOD:
-                    *pFixup = CPUMR3GetGuestCpuIdPatmUnknownLeafMethod(pVM);
-                    break;
                 case PATM_CPUID_STD_PTR: /* Saved again patches only. */
                     *pFixup = CPUMR3GetGuestCpuIdPatmStdRCPtr(pVM);
@@ -1378,4 +1376,24 @@
                     *pFixup = CPUMR3GetGuestCpuIdPatmCentaurRCPtr(pVM);
                     break;
+            }
+        }
+        /*
+         * Constant that may change between VM version needs fixing up.
+         */
+        else if (pRec->uType == FIXUP_CONSTANT_IN_PATCH_ASM_TMPL)
+        {
+            AssertLogRelReturn(uVersion > PATM_SAVED_STATE_VERSION_NO_RAW_MEM, VERR_SSM_DATA_UNIT_FORMAT_CHANGED);
+            Assert(pRec->pSource == pRec->pDest); Assert(PATM_IS_FIXUP_TYPE(pRec->pSource));
+            switch (pRec->pSource)
+            {
+                case PATM_CPUID_ARRAY_ENTRY_SIZE:
+                    *pFixup = sizeof(CPUMCPUIDLEAF);
+                    break;
+                case PATM_CPUID_UNKNOWN_METHOD:
+                    *pFixup = CPUMR3GetGuestCpuIdPatmUnknownLeafMethod(pVM);
+                    break;
+                default:
+                    AssertLogRelMsgFailed(("Unknown FIXUP_CONSTANT_IN_PATCH_ASM_TMPL fixup: %#x\n", pRec->pSource));
+                    return VERR_SSM_DATA_UNIT_FORMAT_CHANGED;
             }
         }
@@ -1480,4 +1498,5 @@
     }
 }
+    return VINF_SUCCESS;
 }
 
Index: /trunk/src/VBox/VMM/include/PATMInternal.h
===================================================================
--- /trunk/src/VBox/VMM/include/PATMInternal.h	(revision 54760)
+++ /trunk/src/VBox/VMM/include/PATMInternal.h	(revision 54761)
@@ -114,4 +114,8 @@
  * as FIXUP_ABSOLUTE. */
 #define FIXUP_ABSOLUTE_IN_PATCH_ASM_TMPL   3
+/** Constant value that only needs fixing up when loading state.  Structure
+ * size, member offset, or similar.  The source and destination address are set
+ * like for FIXUP_ABSOLUTE_IN_PATCH_ASM_TMPL.  */
+#define FIXUP_CONSTANT_IN_PATCH_ASM_TMPL   4
 /** @} */