Index: /trunk/src/VBox/Devices/PC/BIOS/notes.txt
===================================================================
--- /trunk/src/VBox/Devices/PC/BIOS/notes.txt	(revision 59353)
+++ /trunk/src/VBox/Devices/PC/BIOS/notes.txt	(revision 59354)
@@ -80,4 +80,9 @@
   executed on 386+ processors.
 
+- Windows NT 3.5 and 3.51 with MPS HAL requires that INT 15h/E820h return the
+  I/O APIC range as reserved, or not return any ranges at all just below 4GB.
+  Otherwise the NT kernel will crash early during init due to confusion about
+  the top of memory.
+
 
  Notes on BIOS implementation
Index: /trunk/src/VBox/Devices/PC/BIOS/system.c
===================================================================
--- /trunk/src/VBox/Devices/PC/BIOS/system.c	(revision 59353)
+++ /trunk/src/VBox/Devices/PC/BIOS/system.c	(revision 59354)
@@ -715,4 +715,16 @@
                         break;
                     case 5:
+                        set_e820_range(ES, DI,
+                                       0xfec00000,
+                                       0xfec00000 + 0x1000, 0, 0, 2); // I/O APIC
+                        EBX = 6;
+                        break;
+                    case 6:
+                        set_e820_range(ES, DI,
+                                       0xfee00000,
+                                       0xfee00000 + 0x1000, 0, 0, 2); // Local APIC
+                        EBX = 7;
+                        break;
+                    case 7:
                         /* 256KB BIOS area at the end of 4 GB */
 #ifdef VBOX
@@ -723,14 +735,14 @@
                                        0xfffc0000L, 0x00000000L, 0, 0, 2);
                         if (mcfgStart != 0)
-                            EBX = 6;
+                            EBX = 8;
                         else
                         {
                             if (extra_highbits_memory_size || extra_lowbits_memory_size)
-                                EBX = 7;
+                                EBX = 9;
                             else
                                 EBX = 0;
                         }
                         break;
-                     case 6:
+                     case 8:
                         /* PCI MMIO config space (MCFG) */
                         set_e820_range(ES, DI,
@@ -738,9 +750,9 @@
 
                         if (extra_highbits_memory_size || extra_lowbits_memory_size)
-                            EBX = 7;
+                            EBX = 9;
                         else
                             EBX = 0;
                         break;
-                    case 7:
+                    case 9:
 #ifdef VBOX /* Don't succeeded if no memory above 4 GB.  */
                         /* Mapping of memory above 4 GB if present.