Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/Makefile.kmk
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/Makefile.kmk	(revision 60556)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/Makefile.kmk	(revision 60557)
@@ -219,5 +219,4 @@
 
 bs3kit-common-16_VBOX_NEAR_TO_FAR_MODE_FUNCTIONS := \
-	Bs3TestDoModes \
 	Bs3TrapInit \
 
@@ -232,4 +231,5 @@
 bs3kit-common-32_ASDEFS   = RT_ASMDEFS_INC_FIRST_FILE
 bs3kit-common-32_SOURCES  = $(VBOX_BS3KIT_COMMON_SOURCES) \
+       bs3-cmn-SwitchHlpConvFlatRetToRetfProtMode.asm \
 	bs3-cmn-UInt64Div.c \
 	bs3-wc32-U8D.asm \
@@ -247,4 +247,5 @@
 bs3kit-common-64_ASDEFS   = RT_ASMDEFS_INC_FIRST_FILE
 bs3kit-common-64_SOURCES  = $(VBOX_BS3KIT_COMMON_SOURCES) \
+       bs3-cmn-SwitchHlpConvFlatRetToRetfProtMode.asm \
        bs3-c64-Trap64Generic.asm \
        ../../../Runtime/common/asm/ASMGetIDTR.asm \
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-SelFlatCodeToRealMode.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-SelFlatCodeToRealMode.asm	(revision 60556)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-SelFlatCodeToRealMode.asm	(revision 60557)
@@ -35,6 +35,7 @@
 ;*      Global Variables                                                                                                         *
 ;*********************************************************************************************************************************
-extern Bs3X0Text16_EndOfSegment
-extern Bs3X1Text16_EndOfSegment
+BS3_EXTERN_DATA16 Bs3RmText16_EndOfSegment
+BS3_EXTERN_DATA16 Bs3X0Text16_EndOfSegment
+BS3_EXTERN_DATA16 Bs3X1Text16_EndOfSegment
 
 
@@ -43,4 +44,5 @@
 ;
 BS3_BEGIN_TEXT16
+BS3_BEGIN_RMTEXT16
 BS3_BEGIN_X0TEXT16
 BS3_BEGIN_X1TEXT16
@@ -77,10 +79,18 @@
 
         mov     ax, dx
-        sub     ax, BS3TEXT16
+        sub     ax, CGROUP16
         cmp     ax, 1000h
         jb      .bs3text16
 
         mov     ax, dx
-        sub     ax, BS3X0TEXT16
+        sub     ax, BS3GROUPRMTEXT16
+        mov     bx, Bs3RmText16_EndOfSegment wrt BS3GROUPRMTEXT16
+        add     bx, 15
+        shr     bx, cl
+        cmp     ax, bx
+        jb      .bs3rmtext16
+
+        mov     ax, dx
+        sub     ax, BS3GROUPX0TEXT16
         mov     bx, Bs3X0Text16_EndOfSegment wrt BS3GROUPX0TEXT16
         add     bx, 15
@@ -90,5 +100,5 @@
 
         mov     ax, dx
-        sub     ax, BS3X1TEXT16
+        sub     ax, BS3GROUPX1TEXT16
         mov     bx, Bs3X1Text16_EndOfSegment wrt BS3GROUPX1TEXT16
         add     bx, 15
@@ -104,11 +114,14 @@
         ;
 .bs3x1text16:
-        mov     dx, BS3X1TEXT16
+        mov     dx, BS3GROUPX1TEXT16
         jmp     .calc_return
 .bs3x0text16:
-        mov     dx, BS3X0TEXT16
+        mov     dx, BS3GROUPX0TEXT16
+        jmp     .calc_return
+.bs3rmtext16:
+        mov     dx, BS3GROUPRMTEXT16
         jmp     .calc_return
 .bs3text16:
-        mov     dx, BS3X0TEXT16
+        mov     dx, CGROUP16
 .calc_return:
         ; Convert the real-mode frame into the low 16-bit base (BX).
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-SelProtModeCodeToRealMode.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-SelProtModeCodeToRealMode.asm	(revision 60556)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-SelProtModeCodeToRealMode.asm	(revision 60557)
@@ -31,4 +31,5 @@
 ;
 BS3_BEGIN_TEXT16
+BS3_BEGIN_RMTEXT16
 BS3_BEGIN_X0TEXT16
 BS3_BEGIN_X1TEXT16
@@ -50,5 +51,5 @@
 
         ; We're allowed to use the real-mode segment value.
-        cmp     ax, BS3TEXT16
+        cmp     ax, CGROUP16
         je      .bs3text16
 
@@ -56,4 +57,6 @@
         cmp     ax, BS3_SEL_R0_CS16
         je      .bs3text16
+        cmp     ax, BS3_SEL_RMTEXT16_CS
+        je      .bs3rmtext16
         cmp     ax, BS3_SEL_X0TEXT16_CS
         je      .bs3x0text16
@@ -81,4 +84,5 @@
         je      .bs3text16
 .panic:
+hlt
         extern  BS3_CMN_NM(Bs3Panic)
         call    BS3_CMN_NM(Bs3Panic)
@@ -86,11 +90,14 @@
 
 .bs3x1text16:
-        mov     ax, BS3_SEL_X1TEXT16_CS
+        mov     ax, BS3GROUPX1TEXT16
         jmp     .return
 .bs3x0text16:
-        mov     ax, BS3_SEL_X0TEXT16_CS
+        mov     ax, BS3GROUPX0TEXT16
+        jmp     .return
+.bs3rmtext16:
+        mov     ax, BS3GROUPRMTEXT16
         jmp     .return
 .bs3text16:
-        mov     ax, BS3TEXT16
+        mov     ax, CGROUP16
 .return:
         pop     xBP
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-SelRealModeCodeToProtMode.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-SelRealModeCodeToProtMode.asm	(revision 60556)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-SelRealModeCodeToProtMode.asm	(revision 60557)
@@ -31,4 +31,5 @@
 ;
 BS3_BEGIN_TEXT16
+BS3_BEGIN_RMTEXT16
 BS3_BEGIN_X0TEXT16
 BS3_BEGIN_X1TEXT16
@@ -46,10 +47,13 @@
 
         mov     ax, [xBP + xCB + cbCurRetAddr]
-        cmp     ax, BS3TEXT16
+        cmp     ax, CGROUP16
         je      .bs3text16
-        cmp     ax, BS3X0TEXT16
+        cmp     ax, BS3GROUPRMTEXT16
+        je      .bs3rmtext16
+        cmp     ax, BS3GROUPX0TEXT16
         je      .bs3x0text16
-        cmp     ax, BS3X1TEXT16
+        cmp     ax, BS3GROUPX1TEXT16
         je      .bs3x1text16
+
         extern  BS3_CMN_NM(Bs3Panic)
         call    BS3_CMN_NM(Bs3Panic)
@@ -61,4 +65,7 @@
 .bs3x0text16:
         mov     ax, BS3_SEL_X0TEXT16_CS
+        jmp     .return
+.bs3rmtext16:
+        mov     ax, BS3_SEL_RMTEXT16_CS
         jmp     .return
 .bs3text16:
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-SwitchHlpConvFlatRetToRetfProtMode.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-SwitchHlpConvFlatRetToRetfProtMode.asm	(revision 60557)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-SwitchHlpConvFlatRetToRetfProtMode.asm	(revision 60557)
@@ -0,0 +1,68 @@
+; $Id$
+;; @file
+; BS3Kit - SwitchHlpConvFlatRetToRetfProtMode
+;
+
+;
+; Copyright (C) 2007-2016 Oracle Corporation
+;
+; This file is part of VirtualBox Open Source Edition (OSE), as
+; available from http://www.virtualbox.org. This file is free software;
+; you can redistribute it and/or modify it under the terms of the GNU
+; General Public License (GPL) as published by the Free Software
+; Foundation, in version 2 as it comes in the "COPYING" file of the
+; VirtualBox OSE distribution. VirtualBox OSE is distributed in the
+; hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
+;
+; The contents of this file may alternatively be used under the terms
+; of the Common Development and Distribution License Version 1.0
+; (CDDL) only, as it comes in the "COPYING.CDDL" file of the
+; VirtualBox OSE distribution, in which case the provisions of the
+; CDDL are applicable instead of those of the GPL.
+;
+; You may elect to license modified versions of this file under the
+; terms and conditions of either the GPL or the CDDL or both.
+;
+
+%include "bs3kit-template-header.mac"
+
+%if TMPL_BITS != 16
+BS3_EXTERN_CMN Bs3SelFlatCodeToProtFar16
+
+;;
+; SwitchToXxx helper that converts a 32-bit or 64-bit flat return address
+; into a 16-bit protected mode far return.
+;
+;
+; The caller calls this routine before switching modes. The flat return
+; to be converted is immediately after our own return address on the stack.
+;
+; @uses     Nothing.
+; @remarks  No 16-bit version.
+;
+BS3_PROC_BEGIN_CMN Bs3SwitchHlpConvFlatRetToRetfProtMode, BS3_PBC_NEAR
+ %if TMPL_BITS == 64
+        push        xAX
+        push        xCX
+        sub         xSP, 20h
+
+        mov         xCX, [xSP + xCB*3 + 20h]
+        call        Bs3SelFlatCodeToProtFar16 ; well behaved assembly function, only clobbers ecx
+        mov         [xSP + xCB*3 + 20h + 4], eax
+
+        add         xSP, 20h
+        pop         xCX
+        pop         xAX
+        ret         4
+ %else
+        xchg        eax, [xSP + xCB]
+        push        xAX
+        call        Bs3SelFlatCodeToProtFar16 ; well behaved assembly function, only clobbers eax
+        add         xSP, 4
+        xchg        [xSP + xCB], eax
+        ret
+ %endif
+BS3_PROC_END_CMN   Bs3SwitchHlpConvFlatRetToRetfProtMode
+
+%endif ; 32 || 64
+
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-SwitchHlpConvRealModeRetfPopBpDecBpAndReturn.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-SwitchHlpConvRealModeRetfPopBpDecBpAndReturn.asm	(revision 60556)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-SwitchHlpConvRealModeRetfPopBpDecBpAndReturn.asm	(revision 60557)
@@ -51,5 +51,5 @@
         push        ax
         BS3_EXTERN_CMN Bs3SelRealModeCodeToProtMode
-        call        Bs3SelRealModeCodeToProtMode ; This doesn't trash any registers (except AX).
+        call        Bs3SelRealModeCodeToProtMode    ; This doesn't trash any registers (except AX).
         add         sp, 2
         mov         [bp + 2 + 2], ax
@@ -61,26 +61,38 @@
         retf
 
-%else
+%elif TMPL_BITS == 32
         push    xAX
         push    xDX
 
-        movzx   eax, word [xSP + 4*2 + 2 + 2]   ; return segment
-        movzx   edx, word [xSP + 4*2 + 2]       ; return offset
+        movzx   eax, word [xSP + xCB*2 + 2 + 2]     ; return segment
+        movzx   edx, word [xSP + xCB*2 + 2]         ; return offset
         shl     eax, 4
         add     eax, edx
-        mov     [xSP + 4*3 + 2], eax
+        mov     [xSP + xCB*2 + 2], eax
 
         pop     xDX
         pop     xAX
- %if TMPL_BITS == 32
         pop     bp
         dec     bp
         ret
- %else
-        mov     bp, [rsp]
-        add     rsp, 2h
+%else
+        sub     rsp, 2h
+
+        push    xAX
+        push    xDX
+
+        movzx   eax, word [xSP + xCB*2 + 4 + 2]     ; return segment
+        movzx   edx, word [xSP + xCB*2 + 4]         ; return offset
+        shl     eax, 4
+        add     eax, edx
+
+        mov     bp, [xSP + xCB*2 + 2]
         dec     bp
-        o32 ret
- %endif
+
+        mov     [xSP + xCB*2], rax
+
+        pop     xDX
+        pop     xAX
+        ret
 %endif
 BS3_PROC_END_CMN   Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-TestSendCmdWithU32.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-TestSendCmdWithU32.asm	(revision 60556)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-TestSendCmdWithU32.asm	(revision 60557)
@@ -68,7 +68,4 @@
 %endif
 
-%if TMPL_BITS == 16
-        pop     sAX
-%endif
 .no_vmmdev:
         pop     xSI
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-first-common.mac
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-first-common.mac	(revision 60556)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-first-common.mac	(revision 60557)
@@ -98,10 +98,16 @@
 BS3_GLOBAL_DATA Bs3TotalImageSize, 4
     dd  BS3_DATA_NM(Bs3Data64_EndOfSegment) wrt CGROUP16
+
 BS3_GLOBAL_DATA Bs3Text16_Size, 2
     dw  BS3_DATA_NM(Bs3Text16_EndOfSegment) wrt CGROUP16
+BS3_GLOBAL_DATA Bs3RmText16_Size, 2
+    dw  BS3_DATA_NM(Bs3RmText16_EndOfSegment) wrt BS3GROUPRMTEXT16
 BS3_GLOBAL_DATA Bs3X0Text16_Size, 2
     dw  BS3_DATA_NM(Bs3X0Text16_EndOfSegment) wrt BS3GROUPX0TEXT16
 BS3_GLOBAL_DATA Bs3X1Text16_Size, 2
     dw  BS3_DATA_NM(Bs3X1Text16_EndOfSegment) wrt BS3GROUPX1TEXT16
+
+BS3_GLOBAL_DATA Bs3RmText16_FlatAddr, 4
+    dd  BS3_DATA_NM(Bs3RmText16_StartOfSegment) wrt BS3FLAT
 BS3_GLOBAL_DATA Bs3X0Text16_FlatAddr, 4
     dd  BS3_DATA_NM(Bs3X0Text16_StartOfSegment) wrt BS3FLAT
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-EnteredMode.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-EnteredMode.asm	(revision 60556)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-EnteredMode.asm	(revision 60557)
@@ -189,6 +189,6 @@
 %if BS3_MODE_IS_RM_SYS(TMPL_MODE)
         extern         _Bs3TrapSystemCallHandler_rm
-        mov     word [ss: BS3_TRAP_SYSCALL*4], _Bs3TrapSystemCallHandler_rm wrt BS3TEXT16
-        mov     word [ss: BS3_TRAP_SYSCALL*4 + 2], BS3TEXT16
+        mov     word [ss: BS3_TRAP_SYSCALL*4], _Bs3TrapSystemCallHandler_rm wrt CGROUP16
+        mov     word [ss: BS3_TRAP_SYSCALL*4 + 2], CGROUP16
 
 %elif BS3_MODE_IS_16BIT_SYS(TMPL_MODE)
@@ -198,5 +198,5 @@
         TMPL_BEGIN_TEXT
         push    0                       ; cParams
-        push    TMPL_NM(Bs3TrapSystemCallHandler) wrt BS3TEXT16
+        push    TMPL_NM(Bs3TrapSystemCallHandler) wrt CGROUP16
         push    BS3_SEL_R0_CS16
         push    3                       ; DPL
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToLM16.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToLM16.asm	(revision 60556)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToLM16.asm	(revision 60557)
@@ -41,4 +41,7 @@
 ; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
 ;
+%if TMPL_BITS == 16
+BS3_GLOBAL_NAME_EX TMPL_NM(Bs3SwitchToLM16_Safe), function , 0
+%endif
 BS3_PROC_BEGIN_MODE Bs3SwitchToLM16, BS3_PBC_NEAR
 %ifdef TMPL_LM16
@@ -106,4 +109,18 @@
  %endif
 BS3_PROC_END_MODE   Bs3SwitchToLM16
+
+%else
+;;
+; Safe far return to non-BS3TEXT16 code.
+BS3_EXTERN_CMN Bs3SwitchHlpConvFlatRetToRetfProtMode
+BS3_BEGIN_TEXT16
+BS3_SET_BITS TMPL_BITS
+BS3_PROC_BEGIN_MODE Bs3SwitchToLM16_Safe, BS3_PBC_NEAR
+        call        Bs3SwitchHlpConvFlatRetToRetfProtMode ; Special internal function.  Uses nothing, but modifies the stack.
+        call        TMPL_NM(Bs3SwitchToLM16)
+        BS3_SET_BITS 16
+        retf
+BS3_PROC_END_MODE   Bs3SwitchToLM16_Safe
+
 %endif
 
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToLM32.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToLM32.asm	(revision 60556)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToLM32.asm	(revision 60557)
@@ -44,4 +44,5 @@
 ; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
 ;
+BS3_GLOBAL_NAME_EX TMPL_NM(Bs3SwitchToLM32_Safe), function, 0
 BS3_PROC_BEGIN_MODE Bs3SwitchToLM32, BS3_PBC_NEAR
 %ifdef TMPL_LM32
@@ -168,9 +169,9 @@
         ; Jmp to common code for the tedious conversion.
  %if BS3_MODE_IS_RM_OR_V86(TMPL_MODE)
-        BS3_EXTERN_CMN Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn
-        jmp         Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn
+        extern      _Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn_c32
+        jmp         _Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn_c32
  %else
-        BS3_EXTERN_CMN Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn
-        jmp         Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn
+        extern      _Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn_c32
+        jmp         _Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn_c32
  %endif
         BS3_SET_BITS 16
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToLM64.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToLM64.asm	(revision 60556)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToLM64.asm	(revision 60557)
@@ -41,4 +41,5 @@
 ; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
 ;
+BS3_GLOBAL_NAME_EX TMPL_NM(Bs3SwitchToLM16_Safe), function, 0
 BS3_PROC_BEGIN_MODE Bs3SwitchToLM64, BS3_PBC_NEAR
 %ifdef TMPL_LM64
@@ -92,9 +93,9 @@
         ; Jmp to common code for the tedious conversion.
  %if BS3_MODE_IS_RM_OR_V86(TMPL_MODE)
-        BS3_EXTERN_CMN Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn
-        jmp         Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn
+        extern      _Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn_c64
+        jmp         _Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn_c64
  %else
-        BS3_EXTERN_CMN Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn
-        jmp         Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn
+        extern      _Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn_c64
+        jmp         _Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn_c64
  %endif
         BS3_SET_BITS 16
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAE16.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAE16.asm	(revision 60556)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAE16.asm	(revision 60557)
@@ -47,4 +47,7 @@
 ; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
 ;
+%if TMPL_BITS == 16
+BS3_GLOBAL_NAME_EX TMPL_NM(Bs3SwitchToPAE16_Safe), function , 0
+%endif
 BS3_PROC_BEGIN_MODE Bs3SwitchToPAE16, BS3_PBC_NEAR
 %ifdef TMPL_PAE16
@@ -189,4 +192,17 @@
  %endif
 BS3_PROC_END_MODE   Bs3SwitchToPAE16
-%endif
-
+
+%else
+;;
+; Safe far return to non-BS3TEXT16 code.
+BS3_EXTERN_CMN Bs3SwitchHlpConvFlatRetToRetfProtMode
+BS3_BEGIN_TEXT16
+BS3_SET_BITS TMPL_BITS
+BS3_PROC_BEGIN_MODE Bs3SwitchToPAE16_Safe, BS3_PBC_NEAR
+        call        Bs3SwitchHlpConvFlatRetToRetfProtMode ; Special internal function.  Uses nothing, but modifies the stack.
+        call        TMPL_NM(Bs3SwitchToPAE16)
+        BS3_SET_BITS 16
+        retf
+BS3_PROC_END_MODE   Bs3SwitchToPAE16_Safe
+%endif
+
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAE16_32.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAE16_32.asm	(revision 60556)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAE16_32.asm	(revision 60557)
@@ -40,4 +40,5 @@
 ; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
 ;
+BS3_GLOBAL_NAME_EX TMPL_NM(Bs3SwitchToPAE16_32_Safe), function, 0
 BS3_PROC_BEGIN_MODE Bs3SwitchToPAE16_32, BS3_PBC_NEAR
 %ifdef TMPL_PAE16_32
@@ -92,9 +93,9 @@
         ; Jmp to common code for the tedious conversion.
  %if BS3_MODE_IS_RM_OR_V86(TMPL_MODE)
-        BS3_EXTERN_CMN Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn
-        jmp         Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn
+        extern      _Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn_c32
+        jmp         _Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn_c32
  %else
-        BS3_EXTERN_CMN Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn
-        jmp         Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn
+        extern      _Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn_c32
+        jmp         _Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn_c32
  %endif
         BS3_SET_BITS 16
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAE16_V86.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAE16_V86.asm	(revision 60556)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAE16_V86.asm	(revision 60557)
@@ -40,4 +40,7 @@
 ; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
 ;
+%if TMPL_BITS == 16
+BS3_GLOBAL_NAME_EX TMPL_NM(Bs3SwitchToPAE16_V86_Safe), function , 0
+%endif
 BS3_PROC_BEGIN_MODE Bs3SwitchToPAE16_V86, BS3_PBC_NEAR
 %ifdef TMPL_PAE16_V86
@@ -95,4 +98,17 @@
  %endif
 BS3_PROC_END_MODE   Bs3SwitchToPAE16_V86
+
+%else
+;;
+; Safe far return to non-BS3TEXT16 code.
+BS3_EXTERN_CMN Bs3SwitchHlpConvFlatRetToRetfProtMode
+BS3_BEGIN_TEXT16
+BS3_SET_BITS TMPL_BITS
+BS3_PROC_BEGIN_MODE Bs3SwitchToPAE16_V86_Safe, BS3_PBC_NEAR
+        call        Bs3SwitchHlpConvFlatRetToRetfProtMode ; Special internal function.  Uses nothing, but modifies the stack.
+        call        TMPL_NM(Bs3SwitchToPAE16_V86)
+        BS3_SET_BITS 16
+        retf
+BS3_PROC_END_MODE   Bs3SwitchToPAE16_V86_Safe
 %endif
 
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAE32.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAE32.asm	(revision 60556)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAE32.asm	(revision 60557)
@@ -42,4 +42,5 @@
 ; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
 ;
+BS3_GLOBAL_NAME_EX TMPL_NM(Bs3SwitchToPAE32_Safe), function, 0
 BS3_PROC_BEGIN_MODE Bs3SwitchToPAE32, BS3_PBC_NEAR
 %ifdef TMPL_PAE32
@@ -174,9 +175,9 @@
         ; Jmp to common code for the tedious conversion.
  %if BS3_MODE_IS_RM_OR_V86(TMPL_MODE)
-        BS3_EXTERN_CMN Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn
-        jmp         Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn
+        extern      _Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn_c32
+        jmp         _Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn_c32
  %else
-        BS3_EXTERN_CMN Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn
-        jmp         Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn
+        extern      _Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn_c32
+        jmp         _Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn_c32
  %endif
         BS3_SET_BITS 16
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAE32_16.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAE32_16.asm	(revision 60556)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAE32_16.asm	(revision 60557)
@@ -40,4 +40,7 @@
 ; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
 ;
+%if TMPL_BITS == 16
+BS3_GLOBAL_NAME_EX TMPL_NM(Bs3SwitchToPAE32_16_Safe), function , 0
+%endif
 BS3_PROC_BEGIN_MODE Bs3SwitchToPAE32_16, BS3_PBC_NEAR
 %if TMPL_MODE == BS3_MODE_PAE32_16
@@ -80,4 +83,5 @@
 BS3_PROC_END_MODE   Bs3SwitchToPAE32_16
 
+
 %if TMPL_BITS == 16
 ;;
@@ -102,4 +106,17 @@
  %endif
 BS3_PROC_END_MODE   Bs3SwitchToPAE32_16
+
+%else
+;;
+; Safe far return to non-BS3TEXT16 code.
+BS3_EXTERN_CMN Bs3SwitchHlpConvFlatRetToRetfProtMode
+BS3_BEGIN_TEXT16
+BS3_SET_BITS TMPL_BITS
+BS3_PROC_BEGIN_MODE Bs3SwitchToPAE32_16_Safe, BS3_PBC_NEAR
+        call        Bs3SwitchHlpConvFlatRetToRetfProtMode ; Special internal function.  Uses nothing, but modifies the stack.
+        call        TMPL_NM(Bs3SwitchToPAE32_16)
+        BS3_SET_BITS 16
+        retf
+BS3_PROC_END_MODE   Bs3SwitchToPAE32_16_Safe
 %endif
 
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAEV86.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAEV86.asm	(revision 60556)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAEV86.asm	(revision 60557)
@@ -40,4 +40,7 @@
 ; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
 ;
+%if TMPL_BITS == 16
+BS3_GLOBAL_NAME_EX TMPL_NM(Bs3SwitchToPAEV86_Safe), function , 0
+%endif
 BS3_PROC_BEGIN_MODE Bs3SwitchToPAEV86, BS3_PBC_NEAR
 %if TMPL_MODE == BS3_MODE_PAEV86
@@ -89,4 +92,17 @@
  %endif
 BS3_PROC_END_MODE   Bs3SwitchToPAEV86
+
+%else
+;;
+; Safe far return to non-BS3TEXT16 code.
+BS3_EXTERN_CMN Bs3SwitchHlpConvFlatRetToRetfProtMode
+BS3_BEGIN_TEXT16
+BS3_SET_BITS TMPL_BITS
+BS3_PROC_BEGIN_MODE Bs3SwitchToPAEV86_Safe, BS3_PBC_NEAR
+        call        Bs3SwitchHlpConvFlatRetToRetfProtMode ; Special internal function.  Uses nothing, but modifies the stack.
+        call        TMPL_NM(Bs3SwitchToPAEV86)
+        BS3_SET_BITS 16
+        retf
+BS3_PROC_END_MODE   Bs3SwitchToPAEV86_Safe
 %endif
 
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPE16.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPE16.asm	(revision 60556)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPE16.asm	(revision 60557)
@@ -40,4 +40,7 @@
 ; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
 ;
+%if TMPL_BITS == 16
+BS3_GLOBAL_NAME_EX TMPL_NM(Bs3SwitchToPE16_Safe), function , 0
+%endif
 BS3_PROC_BEGIN_MODE Bs3SwitchToPE16, BS3_PBC_NEAR
 %ifdef TMPL_PE16
@@ -148,4 +151,17 @@
  %endif
 BS3_PROC_END_MODE   Bs3SwitchToPE16
+
+%else
+;;
+; Safe far return to non-BS3TEXT16 code.
+BS3_EXTERN_CMN Bs3SwitchHlpConvFlatRetToRetfProtMode
+BS3_BEGIN_TEXT16
+BS3_SET_BITS TMPL_BITS
+BS3_PROC_BEGIN_MODE Bs3SwitchToPE16_Safe, BS3_PBC_NEAR
+        call        Bs3SwitchHlpConvFlatRetToRetfProtMode ; Special internal function.  Uses nothing, but modifies the stack.
+        call        TMPL_NM(Bs3SwitchToPE16)
+        BS3_SET_BITS 16
+        retf
+BS3_PROC_END_MODE   Bs3SwitchToPE16_Safe
 %endif
 
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPE16_32.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPE16_32.asm	(revision 60556)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPE16_32.asm	(revision 60557)
@@ -40,4 +40,5 @@
 ; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
 ;
+BS3_GLOBAL_NAME_EX TMPL_NM(Bs3SwitchToPE16_32_Safe), function, 0
 BS3_PROC_BEGIN_MODE Bs3SwitchToPE16_32, BS3_PBC_NEAR
 %ifdef TMPL_PE16_32
@@ -92,9 +93,9 @@
         ; Jmp to common code for the tedious conversion.
  %if BS3_MODE_IS_RM_OR_V86(TMPL_MODE)
-        BS3_EXTERN_CMN Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn
-        jmp         Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn
+        extern      _Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn_c32
+        jmp         _Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn_c32
  %else
-        BS3_EXTERN_CMN Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn
-        jmp         Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn
+        extern      _Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn_c32
+        jmp         _Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn_c32
  %endif
         BS3_SET_BITS 16
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPE16_V86.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPE16_V86.asm	(revision 60556)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPE16_V86.asm	(revision 60557)
@@ -40,4 +40,7 @@
 ; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
 ;
+%if TMPL_BITS == 16
+BS3_GLOBAL_NAME_EX TMPL_NM(Bs3SwitchToPE16_V86_Safe), function , 0
+%endif
 BS3_PROC_BEGIN_MODE Bs3SwitchToPE16_V86, BS3_PBC_NEAR
 %ifdef TMPL_PE16_V86
@@ -95,4 +98,17 @@
  %endif
 BS3_PROC_END_MODE   Bs3SwitchToPE16_V86
+
+%else
+;;
+; Safe far return to non-BS3TEXT16 code.
+BS3_EXTERN_CMN Bs3SwitchHlpConvFlatRetToRetfProtMode
+BS3_BEGIN_TEXT16
+BS3_SET_BITS TMPL_BITS
+BS3_PROC_BEGIN_MODE Bs3SwitchToPE16_V86_Safe, BS3_PBC_NEAR
+        call        Bs3SwitchHlpConvFlatRetToRetfProtMode ; Special internal function.  Uses nothing, but modifies the stack.
+        call        TMPL_NM(Bs3SwitchToPE16_V86)
+        BS3_SET_BITS 16
+        retf
+BS3_PROC_END_MODE   Bs3SwitchToPE16_V86_Safe
 %endif
 
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPE32.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPE32.asm	(revision 60556)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPE32.asm	(revision 60557)
@@ -41,4 +41,5 @@
 ; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
 ;
+BS3_GLOBAL_NAME_EX TMPL_NM(Bs3SwitchToPE32_Safe), function, 0
 BS3_PROC_BEGIN_MODE Bs3SwitchToPE32, BS3_PBC_NEAR
 %ifdef TMPL_PE32
@@ -152,9 +153,9 @@
         ; Jmp to common code for the tedious conversion.
  %if BS3_MODE_IS_RM_OR_V86(TMPL_MODE)
-        BS3_EXTERN_CMN Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn
-        jmp         Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn
+        extern      _Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn_c32
+        jmp         _Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn_c32
  %else
-        BS3_EXTERN_CMN Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn
-        jmp         Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn
+        extern      _Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn_c32
+        jmp         _Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn_c32
  %endif
         BS3_SET_BITS 16
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPE32_16.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPE32_16.asm	(revision 60556)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPE32_16.asm	(revision 60557)
@@ -40,4 +40,7 @@
 ; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
 ;
+%if TMPL_BITS == 16
+BS3_GLOBAL_NAME_EX TMPL_NM(Bs3SwitchToPE32_16_Safe), function , 0
+%endif
 BS3_PROC_BEGIN_MODE Bs3SwitchToPE32_16, BS3_PBC_NEAR
 %if TMPL_MODE == BS3_MODE_PE32_16
@@ -103,4 +106,17 @@
  %endif
 BS3_PROC_END_MODE   Bs3SwitchToPE32_16
+
+%else
+;;
+; Safe far return to non-BS3TEXT16 code.
+BS3_EXTERN_CMN Bs3SwitchHlpConvFlatRetToRetfProtMode
+BS3_BEGIN_TEXT16
+BS3_SET_BITS TMPL_BITS
+BS3_PROC_BEGIN_MODE Bs3SwitchToPE32_16_Safe, BS3_PBC_NEAR
+        call        Bs3SwitchHlpConvFlatRetToRetfProtMode ; Special internal function.  Uses nothing, but modifies the stack.
+        call        TMPL_NM(Bs3SwitchToPE32_16)
+        BS3_SET_BITS 16
+        retf
+BS3_PROC_END_MODE   Bs3SwitchToPE32_16_Safe
 %endif
 
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPEV86.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPEV86.asm	(revision 60556)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPEV86.asm	(revision 60557)
@@ -40,4 +40,7 @@
 ; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
 ;
+%if TMPL_BITS == 16
+BS3_GLOBAL_NAME_EX TMPL_NM(Bs3SwitchToPEV86_Safe), function , 0
+%endif
 BS3_PROC_BEGIN_MODE Bs3SwitchToPEV86, BS3_PBC_NEAR
 %if TMPL_MODE == BS3_MODE_PEV86
@@ -89,4 +92,17 @@
  %endif
 BS3_PROC_END_MODE   Bs3SwitchToPEV86
+
+%else
+;;
+; Safe far return to non-BS3TEXT16 code.
+BS3_EXTERN_CMN Bs3SwitchHlpConvFlatRetToRetfProtMode
+BS3_BEGIN_TEXT16
+BS3_SET_BITS TMPL_BITS
+BS3_PROC_BEGIN_MODE Bs3SwitchToPEV86_Safe, BS3_PBC_NEAR
+        call        Bs3SwitchHlpConvFlatRetToRetfProtMode ; Special internal function.  Uses nothing, but modifies the stack.
+        call        TMPL_NM(Bs3SwitchToPEV86)
+        BS3_SET_BITS 16
+        retf
+BS3_PROC_END_MODE   Bs3SwitchToPEV86_Safe
 %endif
 
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPP16.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPP16.asm	(revision 60556)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPP16.asm	(revision 60557)
@@ -47,4 +47,7 @@
 ; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
 ;
+%if TMPL_BITS == 16
+BS3_GLOBAL_NAME_EX TMPL_NM(Bs3SwitchToPP16_Safe), function , 0
+%endif
 BS3_PROC_BEGIN_MODE Bs3SwitchToPP16, BS3_PBC_NEAR
 %ifdef TMPL_PP16
@@ -205,4 +208,17 @@
  %endif
 BS3_PROC_END_MODE   Bs3SwitchToPP16
-%endif
-
+
+%else
+;;
+; Safe far return to non-BS3TEXT16 code.
+BS3_EXTERN_CMN Bs3SwitchHlpConvFlatRetToRetfProtMode
+BS3_BEGIN_TEXT16
+BS3_SET_BITS TMPL_BITS
+BS3_PROC_BEGIN_MODE Bs3SwitchToPP16_Safe, BS3_PBC_NEAR
+        call        Bs3SwitchHlpConvFlatRetToRetfProtMode ; Special internal function.  Uses nothing, but modifies the stack.
+        call        TMPL_NM(Bs3SwitchToPP16)
+        BS3_SET_BITS 16
+        retf
+BS3_PROC_END_MODE   Bs3SwitchToPP16_Safe
+%endif
+
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPP16_32.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPP16_32.asm	(revision 60556)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPP16_32.asm	(revision 60557)
@@ -40,4 +40,5 @@
 ; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
 ;
+BS3_GLOBAL_NAME_EX TMPL_NM(Bs3SwitchToPP16_32_Safe), function, 0
 BS3_PROC_BEGIN_MODE Bs3SwitchToPP16_32, BS3_PBC_NEAR
 %ifdef TMPL_PP16_32
@@ -92,9 +93,9 @@
         ; Jmp to common code for the tedious conversion.
  %if BS3_MODE_IS_RM_OR_V86(TMPL_MODE)
-        BS3_EXTERN_CMN Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn
-        jmp         Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn
+        extern      _Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn_c32
+        jmp         _Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn_c32
  %else
-        BS3_EXTERN_CMN Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn
-        jmp         Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn
+        extern      _Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn_c32
+        jmp         _Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn_c32
  %endif
         BS3_SET_BITS 16
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPP16_V86.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPP16_V86.asm	(revision 60556)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPP16_V86.asm	(revision 60557)
@@ -40,4 +40,7 @@
 ; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
 ;
+%if TMPL_BITS == 16
+BS3_GLOBAL_NAME_EX TMPL_NM(Bs3SwitchToPP16_V86_Safe), function , 0
+%endif
 BS3_PROC_BEGIN_MODE Bs3SwitchToPP16_V86, BS3_PBC_NEAR
 %ifdef TMPL_PP16_V86
@@ -95,4 +98,17 @@
  %endif
 BS3_PROC_END_MODE   Bs3SwitchToPP16_V86
+
+%else
+;;
+; Safe far return to non-BS3TEXT16 code.
+BS3_EXTERN_CMN Bs3SwitchHlpConvFlatRetToRetfProtMode
+BS3_BEGIN_TEXT16
+BS3_SET_BITS TMPL_BITS
+BS3_PROC_BEGIN_MODE Bs3SwitchToPP16_V86_Safe, BS3_PBC_NEAR
+        call        Bs3SwitchHlpConvFlatRetToRetfProtMode ; Special internal function.  Uses nothing, but modifies the stack.
+        call        TMPL_NM(Bs3SwitchToPP16_V86)
+        BS3_SET_BITS 16
+        retf
+BS3_PROC_END_MODE   Bs3SwitchToPP16_V86_Safe
 %endif
 
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPP32.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPP32.asm	(revision 60556)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPP32.asm	(revision 60557)
@@ -42,4 +42,5 @@
 ; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
 ;
+BS3_GLOBAL_NAME_EX TMPL_NM(Bs3SwitchToPP32_Safe), function, 0
 BS3_PROC_BEGIN_MODE Bs3SwitchToPP32, BS3_PBC_NEAR
 %ifdef TMPL_PP32
@@ -182,9 +183,9 @@
         ; Jmp to common code for the tedious conversion.
  %if BS3_MODE_IS_RM_OR_V86(TMPL_MODE)
-        BS3_EXTERN_CMN Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn
-        jmp         Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn
+        extern      _Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn_c32
+        jmp         _Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn_c32
  %else
-        BS3_EXTERN_CMN Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn
-        jmp         Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn
+        extern      _Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn_c32
+        jmp         _Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn_c32
  %endif
         BS3_SET_BITS 16
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPP32_16.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPP32_16.asm	(revision 60556)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPP32_16.asm	(revision 60557)
@@ -40,4 +40,7 @@
 ; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
 ;
+%if TMPL_BITS == 16
+BS3_GLOBAL_NAME_EX TMPL_NM(Bs3SwitchToPP32_16_Safe), function , 0
+%endif
 BS3_PROC_BEGIN_MODE Bs3SwitchToPP32_16, BS3_PBC_NEAR
 %if TMPL_MODE == BS3_MODE_PP32_16
@@ -103,4 +106,17 @@
  %endif
 BS3_PROC_END_MODE   Bs3SwitchToPP32_16
+
+%else
+;;
+; Safe far return to non-BS3TEXT16 code.
+BS3_EXTERN_CMN Bs3SwitchHlpConvFlatRetToRetfProtMode
+BS3_BEGIN_TEXT16
+BS3_SET_BITS TMPL_BITS
+BS3_PROC_BEGIN_MODE Bs3SwitchToPP32_16_Safe, BS3_PBC_NEAR
+        call        Bs3SwitchHlpConvFlatRetToRetfProtMode ; Special internal function.  Uses nothing, but modifies the stack.
+        call        TMPL_NM(Bs3SwitchToPP32_16)
+        BS3_SET_BITS 16
+        retf
+BS3_PROC_END_MODE   Bs3SwitchToPP32_16_Safe
 %endif
 
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPPV86.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPPV86.asm	(revision 60556)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPPV86.asm	(revision 60557)
@@ -40,4 +40,7 @@
 ; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
 ;
+%if TMPL_BITS == 16
+BS3_GLOBAL_NAME_EX TMPL_NM(Bs3SwitchToPPV86_Safe), function , 0
+%endif
 BS3_PROC_BEGIN_MODE Bs3SwitchToPPV86, BS3_PBC_NEAR
 %if TMPL_MODE == BS3_MODE_PPV86
@@ -89,4 +92,17 @@
  %endif
 BS3_PROC_END_MODE   Bs3SwitchToPPV86
+
+%else
+;;
+; Safe far return to non-BS3TEXT16 code.
+BS3_EXTERN_CMN Bs3SwitchHlpConvFlatRetToRetfProtMode
+BS3_BEGIN_TEXT16
+BS3_SET_BITS TMPL_BITS
+BS3_PROC_BEGIN_MODE Bs3SwitchToPPV86_Safe, BS3_PBC_NEAR
+        call        Bs3SwitchHlpConvFlatRetToRetfProtMode ; Special internal function.  Uses nothing, but modifies the stack.
+        call        TMPL_NM(Bs3SwitchToPPV86)
+        BS3_SET_BITS 16
+        retf
+BS3_PROC_END_MODE   Bs3SwitchToPPV86_Safe
 %endif
 
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToRM.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToRM.asm	(revision 60556)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToRM.asm	(revision 60557)
@@ -55,5 +55,5 @@
 ;
 ; @uses     GPRs and EFLAGS are unchanged (except high 32-bit register (AMD64) parts).
-;           CS is loaded with BS3TEXT16.
+;           CS is loaded with CGROUP16.
 ;           SS:[RE]SP is converted to real mode address.
 ;           DS and ES are loaded with BS3DATA16_GROUP.
@@ -65,4 +65,7 @@
 ; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
 ;
+%if TMPL_BITS == 16
+BS3_GLOBAL_NAME_EX TMPL_NM(Bs3SwitchToRM_Safe), function , 0
+%endif
 BS3_PROC_BEGIN_MODE Bs3SwitchToRM, BS3_PBC_NEAR
 %ifdef TMPL_RM
@@ -265,5 +268,5 @@
         and     eax, X86_CR0_NO_PE_NO_PG
         mov     cr0, eax
-        jmp     BS3TEXT16:.reload_cs
+        jmp     CGROUP16:.reload_cs
 .reload_cs:
 
@@ -361,4 +364,36 @@
  %endif
 BS3_PROC_END_MODE   Bs3SwitchToRM
-%endif
-
+
+%else
+;;
+; Safe far return to non-BS3TEXT16 code.
+BS3_EXTERN_CMN Bs3SelFlatCodeToRealMode
+BS3_BEGIN_TEXT16
+BS3_SET_BITS TMPL_BITS
+BS3_PROC_BEGIN_MODE Bs3SwitchToRM_Safe, BS3_PBC_NEAR
+ %if TMPL_BITS == 64
+        push        xAX
+        push        xCX
+        sub         xSP, 20h
+
+        mov         xCX, [xSP + xCB*2 + 20h]
+        call        Bs3SelFlatCodeToRealMode ; well behaved assembly function, only clobbers ecx
+        mov         [xSP + xCB*2 + 20h + 4], eax
+
+        add         xSP, 20h
+        pop         xCX
+        pop         xAX
+        add         xSP, 4
+ %else
+        xchg        eax, [xSP]
+        push        xAX
+        call        Bs3SelFlatCodeToRealMode ; well behaved assembly function, only clobbers eax
+        add         xSP, 4
+        xchg        [xSP], eax
+ %endif
+        call        TMPL_NM(Bs3SwitchToRM)
+        BS3_SET_BITS 16
+        retf
+BS3_PROC_END_MODE   Bs3SwitchToRM_Safe
+%endif
+
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-TestDoModes.c
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-TestDoModes.c	(revision 60556)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-TestDoModes.c	(revision 60557)
@@ -31,6 +31,14 @@
 *   Header Files                                                                                                                 *
 *********************************************************************************************************************************/
-#include "bs3kit-template-header.h"
-#include "bs3-cmn-test.h"
+#if defined(__WATCOMC__) && TMPL_MODE == BS3_MODE_RM
+/* In real mode we move this blob of code to the RMTEXT16 segment to save space. */
+# define BS3_USE_RM_TEXT_SEG 1
+# include "bs3kit-template-header.h"
+# include "bs3-cmn-test.h"
+# pragma code_seg("BS3RMTEXT16", "BS3CLASS16RMCODE")
+#else
+# include "bs3kit-template-header.h"
+# include "bs3-cmn-test.h"
+#endif
 
 
@@ -63,26 +71,27 @@
 *   Assembly Symbols                                                                                                             *
 *********************************************************************************************************************************/
-BS3_DECL_FAR(uint8_t) TMPL_FAR_NM(Bs3TestCallDoerInRM)(uint32_t uCallbackFarPtr);
-BS3_DECL_FAR(uint8_t) TMPL_FAR_NM(Bs3TestCallDoerInPE16)(uint32_t uCallbackFarPtr);
-BS3_DECL_FAR(uint8_t) TMPL_FAR_NM(Bs3TestCallDoerInPE16_32)(uint32_t uFlatAddrCallback);
-BS3_DECL_FAR(uint8_t) TMPL_FAR_NM(Bs3TestCallDoerInPE16_V86)(uint32_t uCallbackFarPtr);
-BS3_DECL_FAR(uint8_t) TMPL_FAR_NM(Bs3TestCallDoerInPE32)(uint32_t uFlatAddrCallback);
-BS3_DECL_FAR(uint8_t) TMPL_FAR_NM(Bs3TestCallDoerInPE32_16)(uint32_t uCallbackFarPtr);
-BS3_DECL_FAR(uint8_t) TMPL_FAR_NM(Bs3TestCallDoerInPEV86)(uint32_t uCallbackFarPtr);
-BS3_DECL_FAR(uint8_t) TMPL_FAR_NM(Bs3TestCallDoerInPP16)(uint32_t uCallbackFarPtr);
-BS3_DECL_FAR(uint8_t) TMPL_FAR_NM(Bs3TestCallDoerInPP16_32)(uint32_t uFlatAddrCallback);
-BS3_DECL_FAR(uint8_t) TMPL_FAR_NM(Bs3TestCallDoerInPP16_V86)(uint32_t uCallbackFarPtr);
-BS3_DECL_FAR(uint8_t) TMPL_FAR_NM(Bs3TestCallDoerInPP32)(uint32_t uFlatAddrCallback);
-BS3_DECL_FAR(uint8_t) TMPL_FAR_NM(Bs3TestCallDoerInPP32_16)(uint32_t uCallbackFarPtr);
-BS3_DECL_FAR(uint8_t) TMPL_FAR_NM(Bs3TestCallDoerInPPV86)(uint32_t uCallbackFarPtr);
-BS3_DECL_FAR(uint8_t) TMPL_FAR_NM(Bs3TestCallDoerInPAE16)(uint32_t uCallbackFarPtr);
-BS3_DECL_FAR(uint8_t) TMPL_FAR_NM(Bs3TestCallDoerInPAE16_32)(uint32_t uFlatAddrCallback);
-BS3_DECL_FAR(uint8_t) TMPL_FAR_NM(Bs3TestCallDoerInPAE16_V86)(uint32_t uCallbackFarPtr);
-BS3_DECL_FAR(uint8_t) TMPL_FAR_NM(Bs3TestCallDoerInPAE32)(uint32_t uFlatAddrCallback);
-BS3_DECL_FAR(uint8_t) TMPL_FAR_NM(Bs3TestCallDoerInPAE32_16)(uint32_t uCallbackFarPtr);
-BS3_DECL_FAR(uint8_t) TMPL_FAR_NM(Bs3TestCallDoerInPAEV86)(uint32_t uCallbackFarPtr);
-BS3_DECL_FAR(uint8_t) TMPL_FAR_NM(Bs3TestCallDoerInLM16)(uint32_t uCallbackFarPtr);
-BS3_DECL_FAR(uint8_t) TMPL_FAR_NM(Bs3TestCallDoerInLM32)(uint32_t uFlatAddrCallback);
-BS3_DECL_FAR(uint8_t) TMPL_FAR_NM(Bs3TestCallDoerInLM64)(uint32_t uFlatAddrCallback);
+/* These are in the same code segment as this code, so no FAR necessary. */
+BS3_DECL_NEAR(uint8_t) TMPL_NM(Bs3TestCallDoerInRM)(uint32_t uCallbackFarPtr);
+BS3_DECL_NEAR(uint8_t) TMPL_NM(Bs3TestCallDoerInPE16)(uint32_t uCallbackFarPtr);
+BS3_DECL_NEAR(uint8_t) TMPL_NM(Bs3TestCallDoerInPE16_32)(uint32_t uFlatAddrCallback);
+BS3_DECL_NEAR(uint8_t) TMPL_NM(Bs3TestCallDoerInPE16_V86)(uint32_t uCallbackFarPtr);
+BS3_DECL_NEAR(uint8_t) TMPL_NM(Bs3TestCallDoerInPE32)(uint32_t uFlatAddrCallback);
+BS3_DECL_NEAR(uint8_t) TMPL_NM(Bs3TestCallDoerInPE32_16)(uint32_t uCallbackFarPtr);
+BS3_DECL_NEAR(uint8_t) TMPL_NM(Bs3TestCallDoerInPEV86)(uint32_t uCallbackFarPtr);
+BS3_DECL_NEAR(uint8_t) TMPL_NM(Bs3TestCallDoerInPP16)(uint32_t uCallbackFarPtr);
+BS3_DECL_NEAR(uint8_t) TMPL_NM(Bs3TestCallDoerInPP16_32)(uint32_t uFlatAddrCallback);
+BS3_DECL_NEAR(uint8_t) TMPL_NM(Bs3TestCallDoerInPP16_V86)(uint32_t uCallbackFarPtr);
+BS3_DECL_NEAR(uint8_t) TMPL_NM(Bs3TestCallDoerInPP32)(uint32_t uFlatAddrCallback);
+BS3_DECL_NEAR(uint8_t) TMPL_NM(Bs3TestCallDoerInPP32_16)(uint32_t uCallbackFarPtr);
+BS3_DECL_NEAR(uint8_t) TMPL_NM(Bs3TestCallDoerInPPV86)(uint32_t uCallbackFarPtr);
+BS3_DECL_NEAR(uint8_t) TMPL_NM(Bs3TestCallDoerInPAE16)(uint32_t uCallbackFarPtr);
+BS3_DECL_NEAR(uint8_t) TMPL_NM(Bs3TestCallDoerInPAE16_32)(uint32_t uFlatAddrCallback);
+BS3_DECL_NEAR(uint8_t) TMPL_NM(Bs3TestCallDoerInPAE16_V86)(uint32_t uCallbackFarPtr);
+BS3_DECL_NEAR(uint8_t) TMPL_NM(Bs3TestCallDoerInPAE32)(uint32_t uFlatAddrCallback);
+BS3_DECL_NEAR(uint8_t) TMPL_NM(Bs3TestCallDoerInPAE32_16)(uint32_t uCallbackFarPtr);
+BS3_DECL_NEAR(uint8_t) TMPL_NM(Bs3TestCallDoerInPAEV86)(uint32_t uCallbackFarPtr);
+BS3_DECL_NEAR(uint8_t) TMPL_NM(Bs3TestCallDoerInLM16)(uint32_t uCallbackFarPtr);
+BS3_DECL_NEAR(uint8_t) TMPL_NM(Bs3TestCallDoerInLM32)(uint32_t uFlatAddrCallback);
+BS3_DECL_NEAR(uint8_t) TMPL_NM(Bs3TestCallDoerInLM64)(uint32_t uFlatAddrCallback);
 
 
@@ -218,5 +227,5 @@
         {
             PRE_DO_CALL(g_szBs3ModeName_rm);
-            bErrNo = TMPL_FAR_NM(Bs3TestCallDoerInRM)(CONV_TO_RM_FAR16(paEntries[i].pfnDoRM));
+            bErrNo = TMPL_NM(Bs3TestCallDoerInRM)(CONV_TO_RM_FAR16(paEntries[i].pfnDoRM));
             CHECK_RESULT(g_szBs3ModeName_rm);
         }
@@ -235,5 +244,5 @@
         {
             PRE_DO_CALL(g_szBs3ModeName_pe16);
-            bErrNo = TMPL_FAR_NM(Bs3TestCallDoerInPE16)(CONV_TO_PROT_FAR16(paEntries[i].pfnDoPE16));
+            bErrNo = TMPL_NM(Bs3TestCallDoerInPE16)(CONV_TO_PROT_FAR16(paEntries[i].pfnDoPE16));
             CHECK_RESULT(g_szBs3ModeName_pe16);
         }
@@ -248,5 +257,5 @@
         {
             PRE_DO_CALL(g_szBs3ModeName_pe16_32);
-            bErrNo = TMPL_FAR_NM(Bs3TestCallDoerInPE16_32)(CONV_TO_FLAT(paEntries[i].pfnDoPE16_32));
+            bErrNo = TMPL_NM(Bs3TestCallDoerInPE16_32)(CONV_TO_FLAT(paEntries[i].pfnDoPE16_32));
             CHECK_RESULT(g_szBs3ModeName_pe16_32);
         }
@@ -255,5 +264,5 @@
         {
             PRE_DO_CALL(g_szBs3ModeName_pe16_v86);
-            bErrNo = TMPL_FAR_NM(Bs3TestCallDoerInPE16_V86)(CONV_TO_RM_FAR16(paEntries[i].pfnDoPE16_V86));
+            bErrNo = TMPL_NM(Bs3TestCallDoerInPE16_V86)(CONV_TO_RM_FAR16(paEntries[i].pfnDoPE16_V86));
             CHECK_RESULT(g_szBs3ModeName_pe16_v86);
         }
@@ -262,5 +271,5 @@
         {
             PRE_DO_CALL(g_szBs3ModeName_pe32);
-            bErrNo = TMPL_FAR_NM(Bs3TestCallDoerInPE32)(CONV_TO_FLAT(paEntries[i].pfnDoPE32));
+            bErrNo = TMPL_NM(Bs3TestCallDoerInPE32)(CONV_TO_FLAT(paEntries[i].pfnDoPE32));
             CHECK_RESULT(g_szBs3ModeName_pe32);
         }
@@ -269,5 +278,5 @@
         {
             PRE_DO_CALL(g_szBs3ModeName_pe32_16);
-            bErrNo = TMPL_FAR_NM(Bs3TestCallDoerInPE32_16)(CONV_TO_PROT_FAR16(paEntries[i].pfnDoPE32_16));
+            bErrNo = TMPL_NM(Bs3TestCallDoerInPE32_16)(CONV_TO_PROT_FAR16(paEntries[i].pfnDoPE32_16));
             CHECK_RESULT(g_szBs3ModeName_pe32_16);
         }
@@ -276,5 +285,5 @@
         {
             PRE_DO_CALL(g_szBs3ModeName_pev86);
-            bErrNo = TMPL_FAR_NM(Bs3TestCallDoerInPEV86)(CONV_TO_RM_FAR16(paEntries[i].pfnDoPEV86));
+            bErrNo = TMPL_NM(Bs3TestCallDoerInPEV86)(CONV_TO_RM_FAR16(paEntries[i].pfnDoPEV86));
             CHECK_RESULT(g_szBs3ModeName_pev86);
         }
@@ -286,5 +295,5 @@
         {
             PRE_DO_CALL(g_szBs3ModeName_pp16);
-            bErrNo = TMPL_FAR_NM(Bs3TestCallDoerInPP16)(CONV_TO_PROT_FAR16(paEntries[i].pfnDoPP16));
+            bErrNo = TMPL_NM(Bs3TestCallDoerInPP16)(CONV_TO_PROT_FAR16(paEntries[i].pfnDoPP16));
             CHECK_RESULT(g_szBs3ModeName_pp16);
         }
@@ -293,5 +302,5 @@
         {
             PRE_DO_CALL(g_szBs3ModeName_pp16_32);
-            bErrNo = TMPL_FAR_NM(Bs3TestCallDoerInPP16_32)(CONV_TO_FLAT(paEntries[i].pfnDoPP16_32));
+            bErrNo = TMPL_NM(Bs3TestCallDoerInPP16_32)(CONV_TO_FLAT(paEntries[i].pfnDoPP16_32));
             CHECK_RESULT(g_szBs3ModeName_pp16_32);
         }
@@ -300,5 +309,5 @@
         {
             PRE_DO_CALL(g_szBs3ModeName_pp16_v86);
-            bErrNo = TMPL_FAR_NM(Bs3TestCallDoerInPP16_V86)(CONV_TO_RM_FAR16(paEntries[i].pfnDoPP16_V86));
+            bErrNo = TMPL_NM(Bs3TestCallDoerInPP16_V86)(CONV_TO_RM_FAR16(paEntries[i].pfnDoPP16_V86));
             CHECK_RESULT(g_szBs3ModeName_pp16_v86);
         }
@@ -307,5 +316,5 @@
         {
             PRE_DO_CALL(g_szBs3ModeName_pp32);
-            bErrNo = TMPL_FAR_NM(Bs3TestCallDoerInPP32)(CONV_TO_FLAT(paEntries[i].pfnDoPP32));
+            bErrNo = TMPL_NM(Bs3TestCallDoerInPP32)(CONV_TO_FLAT(paEntries[i].pfnDoPP32));
             CHECK_RESULT(g_szBs3ModeName_pp32);
         }
@@ -314,5 +323,5 @@
         {
             PRE_DO_CALL(g_szBs3ModeName_pp32_16);
-            bErrNo = TMPL_FAR_NM(Bs3TestCallDoerInPP32_16)(CONV_TO_PROT_FAR16(paEntries[i].pfnDoPP32_16));
+            bErrNo = TMPL_NM(Bs3TestCallDoerInPP32_16)(CONV_TO_PROT_FAR16(paEntries[i].pfnDoPP32_16));
             CHECK_RESULT(g_szBs3ModeName_pp32_16);
         }
@@ -321,5 +330,5 @@
         {
             PRE_DO_CALL(g_szBs3ModeName_ppv86);
-            bErrNo = TMPL_FAR_NM(Bs3TestCallDoerInPPV86)(CONV_TO_RM_FAR16(paEntries[i].pfnDoPPV86));
+            bErrNo = TMPL_NM(Bs3TestCallDoerInPPV86)(CONV_TO_RM_FAR16(paEntries[i].pfnDoPPV86));
             CHECK_RESULT(g_szBs3ModeName_ppv86);
         }
@@ -338,5 +347,5 @@
         {
             PRE_DO_CALL(g_szBs3ModeName_pae16);
-            bErrNo = TMPL_FAR_NM(Bs3TestCallDoerInPAE16)(CONV_TO_PROT_FAR16(paEntries[i].pfnDoPAE16));
+            bErrNo = TMPL_NM(Bs3TestCallDoerInPAE16)(CONV_TO_PROT_FAR16(paEntries[i].pfnDoPAE16));
             CHECK_RESULT(g_szBs3ModeName_pae16);
         }
@@ -345,5 +354,5 @@
         {
             PRE_DO_CALL(g_szBs3ModeName_pae16_32);
-            bErrNo = TMPL_FAR_NM(Bs3TestCallDoerInPAE16_32)(CONV_TO_FLAT(paEntries[i].pfnDoPAE16_32));
+            bErrNo = TMPL_NM(Bs3TestCallDoerInPAE16_32)(CONV_TO_FLAT(paEntries[i].pfnDoPAE16_32));
             CHECK_RESULT(g_szBs3ModeName_pae16_32);
         }
@@ -352,5 +361,5 @@
         {
             PRE_DO_CALL(g_szBs3ModeName_pae16_v86);
-            bErrNo = TMPL_FAR_NM(Bs3TestCallDoerInPAE16_V86)(CONV_TO_RM_FAR16(paEntries[i].pfnDoPAE16_V86));
+            bErrNo = TMPL_NM(Bs3TestCallDoerInPAE16_V86)(CONV_TO_RM_FAR16(paEntries[i].pfnDoPAE16_V86));
             CHECK_RESULT(g_szBs3ModeName_pae16_v86);
         }
@@ -359,5 +368,5 @@
         {
             PRE_DO_CALL(g_szBs3ModeName_pae32);
-            bErrNo = TMPL_FAR_NM(Bs3TestCallDoerInPAE32)(CONV_TO_FLAT(paEntries[i].pfnDoPAE32));
+            bErrNo = TMPL_NM(Bs3TestCallDoerInPAE32)(CONV_TO_FLAT(paEntries[i].pfnDoPAE32));
             CHECK_RESULT(g_szBs3ModeName_pae32);
         }
@@ -366,5 +375,5 @@
         {
             PRE_DO_CALL(g_szBs3ModeName_pae32_16);
-            bErrNo = TMPL_FAR_NM(Bs3TestCallDoerInPAE32_16)(CONV_TO_PROT_FAR16(paEntries[i].pfnDoPAE32_16));
+            bErrNo = TMPL_NM(Bs3TestCallDoerInPAE32_16)(CONV_TO_PROT_FAR16(paEntries[i].pfnDoPAE32_16));
             CHECK_RESULT(g_szBs3ModeName_pae32_16);
         }
@@ -373,5 +382,5 @@
         {
             PRE_DO_CALL(g_szBs3ModeName_paev86);
-            bErrNo = TMPL_FAR_NM(Bs3TestCallDoerInPAEV86)(CONV_TO_RM_FAR16(paEntries[i].pfnDoPAEV86));
+            bErrNo = TMPL_NM(Bs3TestCallDoerInPAEV86)(CONV_TO_RM_FAR16(paEntries[i].pfnDoPAEV86));
             CHECK_RESULT(g_szBs3ModeName_paev86);
         }
@@ -390,5 +399,5 @@
         {
             PRE_DO_CALL(g_szBs3ModeName_lm16);
-            bErrNo = TMPL_FAR_NM(Bs3TestCallDoerInLM16)(CONV_TO_PROT_FAR16(paEntries[i].pfnDoLM16));
+            bErrNo = TMPL_NM(Bs3TestCallDoerInLM16)(CONV_TO_PROT_FAR16(paEntries[i].pfnDoLM16));
             CHECK_RESULT(g_szBs3ModeName_lm16);
         }
@@ -397,5 +406,5 @@
         {
             PRE_DO_CALL(g_szBs3ModeName_lm32);
-            bErrNo = TMPL_FAR_NM(Bs3TestCallDoerInLM32)(CONV_TO_FLAT(paEntries[i].pfnDoLM32));
+            bErrNo = TMPL_NM(Bs3TestCallDoerInLM32)(CONV_TO_FLAT(paEntries[i].pfnDoLM32));
             CHECK_RESULT(g_szBs3ModeName_lm32);
         }
@@ -404,5 +413,5 @@
         {
             PRE_DO_CALL(g_szBs3ModeName_lm64);
-            bErrNo = TMPL_FAR_NM(Bs3TestCallDoerInLM64)(CONV_TO_FLAT(paEntries[i].pfnDoLM64));
+            bErrNo = TMPL_NM(Bs3TestCallDoerInLM64)(CONV_TO_FLAT(paEntries[i].pfnDoLM64));
             CHECK_RESULT(g_szBs3ModeName_lm64);
         }
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-TestDoModesHlp.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-TestDoModesHlp.asm	(revision 60556)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-TestDoModesHlp.asm	(revision 60557)
@@ -25,5 +25,23 @@
 ;
 
+;*********************************************************************************************************************************
+;*  Header Files                                                                                                                 *
+;*********************************************************************************************************************************
 %include "bs3kit-template-header.mac"
+
+
+;*********************************************************************************************************************************
+;*  Defined Constants And Macros                                                                                                 *
+;*********************************************************************************************************************************
+;
+; We put most of this mess in the RMTEXT16 segment when in real mode.
+;
+%if TMPL_MODE == BS3_MODE_RM
+ %define MY_BEGIN_TEXT   BS3_BEGIN_RMTEXT16
+ %define MY_BEGIN_TEXT16 BS3_BEGIN_RMTEXT16
+%else
+ %define MY_BEGIN_TEXT   TMPL_BEGIN_TEXT
+ %define MY_BEGIN_TEXT16 BS3_BEGIN_TEXT16
+%endif
 
 
@@ -31,4 +49,44 @@
 ;*  External Symbols                                                                                                             *
 ;*********************************************************************************************************************************
+%if TMPL_MODE == BS3_MODE_RM
+BS3_BEGIN_TEXT16_FARSTUBS
+extern TMPL_FAR_NM(Bs3SwitchToRM)
+extern TMPL_FAR_NM(Bs3SwitchToPE16)
+extern TMPL_FAR_NM(Bs3SwitchToPE16_32)
+extern TMPL_FAR_NM(Bs3SwitchToPE16_V86)
+extern TMPL_FAR_NM(Bs3SwitchToPE32)
+extern TMPL_FAR_NM(Bs3SwitchToPE32_16)
+extern TMPL_FAR_NM(Bs3SwitchToPEV86)
+extern TMPL_FAR_NM(Bs3SwitchToPP16)
+extern TMPL_FAR_NM(Bs3SwitchToPP16_32)
+extern TMPL_FAR_NM(Bs3SwitchToPP16_V86)
+extern TMPL_FAR_NM(Bs3SwitchToPP32)
+extern TMPL_FAR_NM(Bs3SwitchToPP32_16)
+extern TMPL_FAR_NM(Bs3SwitchToPPV86)
+extern TMPL_FAR_NM(Bs3SwitchToPAE16)
+extern TMPL_FAR_NM(Bs3SwitchToPAE16_32)
+extern TMPL_FAR_NM(Bs3SwitchToPAE16_V86)
+extern TMPL_FAR_NM(Bs3SwitchToPAE32)
+extern TMPL_FAR_NM(Bs3SwitchToPAE32_16)
+extern TMPL_FAR_NM(Bs3SwitchToPAEV86)
+extern TMPL_FAR_NM(Bs3SwitchToLM16)
+extern TMPL_FAR_NM(Bs3SwitchToLM32)
+extern TMPL_FAR_NM(Bs3SwitchToLM64)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_rm_far)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pe16_far)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pe16_v86_far)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pe32_16_far)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pev86_far)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pp16_far)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pp16_v86_far)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pp32_16_far)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_ppv86_far)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pae16_far)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pae16_v86_far)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pae32_16_far)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_paev86_far)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_lm16_far)
+%else
+BS3_BEGIN_TEXT16
 extern TMPL_NM(Bs3SwitchToRM)
 extern TMPL_NM(Bs3SwitchToPE16)
@@ -53,27 +111,32 @@
 extern TMPL_NM(Bs3SwitchToLM32)
 extern TMPL_NM(Bs3SwitchToLM64)
-extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_rm)
-extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pe16)
-extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pe16_32)
-extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pe16_v86)
-extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pe32)
-extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pe32_16)
-extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pev86)
-extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pp16)
-extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pp16_32)
-extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pp16_v86)
-extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pp32)
-extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pp32_16)
-extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_ppv86)
-extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pae16)
-extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pae16_32)
-extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pae16_v86)
-extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pae32)
-extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pae32_16)
-extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_paev86)
-extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_lm16)
-extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_lm32)
-extern RT_CONCAT3(Bs3SwitchTo,TMPL_MODE_UNAME,_lm64)
-
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_rm)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pe16)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pe16_v86)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pe32_16)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pev86)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pp16)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pp16_v86)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pp32_16)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_ppv86)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pae16)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pae16_v86)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pae32_16)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_paev86)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_lm16)
+%endif
+BS3_BEGIN_TEXT16
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pe16_32):wrt BS3FLAT
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pe32):wrt BS3FLAT
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pp16_32):wrt BS3FLAT
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pp32):wrt BS3FLAT
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pae16_32):wrt BS3FLAT
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pae32):wrt BS3FLAT
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_lm32):wrt BS3FLAT
+extern RT_CONCAT3(Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_lm64):wrt BS3FLAT
+
+
+
+MY_BEGIN_TEXT
 
 ;;
@@ -154,9 +217,5 @@
         xPOPF
         pop     xBP
-%if TMPL_BITS == 16
-        retf
-%else
         ret
-%endif
 
 ;
@@ -217,8 +276,8 @@
 ; @cproto   BS3_DECL(uint8_t) Bs3TestCallDoerInRM(uint16_t offBs3Text16);
 ; @uses     rax
-BS3_PROC_BEGIN_MODE Bs3TestCallDoerInRM, BS3_PBC_FAR
-        BS3_LEA_MOV_WRT_RIP(xAX, .doit)
-        jmp     TMPL_NM(bs3TestCallDoerPrologue)
-BS3_BEGIN_TEXT16
+BS3_PROC_BEGIN_MODE Bs3TestCallDoerInRM, BS3_PBC_NEAR
+        BS3_LEA_MOV_WRT_RIP(xAX, .doit)
+        jmp     TMPL_NM(bs3TestCallDoerPrologue)
+MY_BEGIN_TEXT16
 BS3_SET_BITS TMPL_BITS
 .doit:
@@ -228,5 +287,9 @@
         ; Mode switch, make the call, switch back.
         STRICT_SAVE_REGS
+%if TMPL_MODE == BS3_MODE_RM
+        call far TMPL_FAR_NM(Bs3SwitchToRM)
+%else
         call    TMPL_NM(Bs3SwitchToRM)
+%endif
         BS3_SET_BITS 16
         STRICT_CHECK_REGS
@@ -243,9 +306,13 @@
 
         STRICT_SAVE_REGS
-        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_rm)
-        BS3_SET_BITS TMPL_BITS
-        STRICT_CHECK_REGS
-        jmp     TMPL_NM(bs3TestCallDoerEpilogue)
-TMPL_BEGIN_TEXT
+%if TMPL_MODE == BS3_MODE_RM
+        call far RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_rm_far)
+%else
+        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_rm)
+%endif
+        BS3_SET_BITS TMPL_BITS
+        STRICT_CHECK_REGS
+        jmp     TMPL_NM(bs3TestCallDoerEpilogue)
+MY_BEGIN_TEXT
 BS3_PROC_END_MODE   Bs3TestCallDoerInRM
 
@@ -258,8 +325,8 @@
 ; @cproto   BS3_DECL(uint8_t) Bs3TestCallDoerInPE16(uint16_t offBs3Text16);
 ; @uses     rax
-BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPE16, BS3_PBC_FAR
-        BS3_LEA_MOV_WRT_RIP(xAX, .doit)
-        jmp     TMPL_NM(bs3TestCallDoerPrologue)
-BS3_BEGIN_TEXT16
+BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPE16, BS3_PBC_NEAR
+        BS3_LEA_MOV_WRT_RIP(xAX, .doit)
+        jmp     TMPL_NM(bs3TestCallDoerPrologue)
+MY_BEGIN_TEXT16
 BS3_SET_BITS TMPL_BITS
 .doit:
@@ -269,5 +336,9 @@
         ; Mode switch, make the call, switch back.
         STRICT_SAVE_REGS
+%if TMPL_MODE == BS3_MODE_RM
+        call far TMPL_FAR_NM(Bs3SwitchToPE16)
+%else
         call    TMPL_NM(Bs3SwitchToPE16)
+%endif
         BS3_SET_BITS 16
         STRICT_CHECK_REGS
@@ -282,8 +353,12 @@
 
         STRICT_SAVE_REGS
-        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pe16)
-        BS3_SET_BITS TMPL_BITS
-        jmp     TMPL_NM(bs3TestCallDoerEpilogue)
-TMPL_BEGIN_TEXT
+%if TMPL_MODE == BS3_MODE_RM
+        call far RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pe16_far)
+%else
+        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pe16)
+%endif
+        BS3_SET_BITS TMPL_BITS
+        jmp     TMPL_NM(bs3TestCallDoerEpilogue)
+MY_BEGIN_TEXT
 BS3_PROC_END_MODE   Bs3TestCallDoerInPE16
 
@@ -291,5 +366,5 @@
 ; @cproto   BS3_DECL(uint8_t) Bs3TestCallDoerInPE16_32(uint16_t offBs3Text16);
 ; @uses     rax
-BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPE16_32, BS3_PBC_FAR
+BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPE16_32, BS3_PBC_NEAR
         BS3_LEA_MOV_WRT_RIP(xAX, .doit)
         jmp     TMPL_NM(bs3TestCallDoerPrologue)
@@ -299,5 +374,9 @@
         ; Mode switch, make the call, switch back.
         STRICT_SAVE_REGS
+%if TMPL_MODE == BS3_MODE_RM
+        call far TMPL_FAR_NM(Bs3SwitchToPE16_32)
+%else
         call    TMPL_NM(Bs3SwitchToPE16_32)
+%endif
         BS3_SET_BITS 32
         STRICT_CHECK_REGS
@@ -307,5 +386,5 @@
 
         STRICT_SAVE_REGS
-        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pe16_32)
+        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pe16_32)
         BS3_SET_BITS TMPL_BITS
         STRICT_CHECK_REGS
@@ -316,14 +395,18 @@
 ; @cproto   BS3_DECL(uint8_t) Bs3TestCallDoerInPE16_V86(uint16_t offBs3Text16);
 ; @uses     rax
-BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPE16_V86, BS3_PBC_FAR
-        BS3_LEA_MOV_WRT_RIP(xAX, .doit)
-        jmp     TMPL_NM(bs3TestCallDoerPrologue)
-.doit:
-        mov     ax, [xBP + xCB + cbCurRetAddr]      ; Load far function pointer.
-        mov     dx, [xBP + xCB + cbCurRetAddr + 2]
-
-        ; Mode switch, make the call, switch back.
-        STRICT_SAVE_REGS
+BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPE16_V86, BS3_PBC_NEAR
+        BS3_LEA_MOV_WRT_RIP(xAX, .doit)
+        jmp     TMPL_NM(bs3TestCallDoerPrologue)
+.doit:
+        mov     ax, [xBP + xCB + cbCurRetAddr]      ; Load far function pointer.
+        mov     dx, [xBP + xCB + cbCurRetAddr + 2]
+
+        ; Mode switch, make the call, switch back.
+        STRICT_SAVE_REGS
+%if TMPL_MODE == BS3_MODE_RM
+        call far TMPL_FAR_NM(Bs3SwitchToPE16_V86)
+%else
         call    TMPL_NM(Bs3SwitchToPE16_V86)
+%endif
         BS3_SET_BITS 16
         STRICT_CHECK_REGS
@@ -338,5 +421,9 @@
 
         STRICT_SAVE_REGS
-        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pe16_v86)
+%if TMPL_MODE == BS3_MODE_RM
+        call far RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pe16_v86_far)
+%else
+        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pe16_v86)
+%endif
         BS3_SET_BITS TMPL_BITS
         STRICT_CHECK_REGS
@@ -347,5 +434,5 @@
 ; @cproto   BS3_DECL(uint8_t) Bs3TestCallDoerInPE32(uint16_t offBs3Text16);
 ; @uses     rax
-BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPE32, BS3_PBC_FAR
+BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPE32, BS3_PBC_NEAR
         BS3_LEA_MOV_WRT_RIP(xAX, .doit)
         jmp     TMPL_NM(bs3TestCallDoerPrologue)
@@ -355,5 +442,9 @@
         ; Mode switch, make the call, switch back.
         STRICT_SAVE_REGS
+%if TMPL_MODE == BS3_MODE_RM
+        call far TMPL_FAR_NM(Bs3SwitchToPE32)
+%else
         call    TMPL_NM(Bs3SwitchToPE32)
+%endif
         BS3_SET_BITS 32
         STRICT_CHECK_REGS
@@ -363,5 +454,5 @@
 
         STRICT_SAVE_REGS
-        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pe32)
+        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pe32)
         BS3_SET_BITS TMPL_BITS
         STRICT_CHECK_REGS
@@ -372,8 +463,8 @@
 ; @cproto   BS3_DECL(uint8_t) Bs3TestCallDoerInPE32_16(uint16_t offBs3Text16);
 ; @uses     rax
-BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPE32_16, BS3_PBC_FAR
-        BS3_LEA_MOV_WRT_RIP(xAX, .doit)
-        jmp     TMPL_NM(bs3TestCallDoerPrologue)
-BS3_BEGIN_TEXT16
+BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPE32_16, BS3_PBC_NEAR
+        BS3_LEA_MOV_WRT_RIP(xAX, .doit)
+        jmp     TMPL_NM(bs3TestCallDoerPrologue)
+MY_BEGIN_TEXT16
 BS3_SET_BITS TMPL_BITS
 .doit:
@@ -383,5 +474,9 @@
         ; Mode switch, make the call, switch back.
         STRICT_SAVE_REGS
+%if TMPL_MODE == BS3_MODE_RM
+        call far TMPL_FAR_NM(Bs3SwitchToPE32_16)
+%else
         call    TMPL_NM(Bs3SwitchToPE32_16)
+%endif
         BS3_SET_BITS 16
         STRICT_CHECK_REGS
@@ -396,9 +491,13 @@
 
         STRICT_SAVE_REGS
-        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pe32_16)
-        BS3_SET_BITS TMPL_BITS
-        STRICT_CHECK_REGS
-        jmp     TMPL_NM(bs3TestCallDoerEpilogue)
-TMPL_BEGIN_TEXT
+%if TMPL_MODE == BS3_MODE_RM
+        call far RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pe32_16_far)
+%else
+        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pe32_16)
+%endif
+        BS3_SET_BITS TMPL_BITS
+        STRICT_CHECK_REGS
+        jmp     TMPL_NM(bs3TestCallDoerEpilogue)
+MY_BEGIN_TEXT
 BS3_PROC_END_MODE   Bs3TestCallDoerInPE32_16
 
@@ -406,8 +505,8 @@
 ; @cproto   BS3_DECL(uint8_t) Bs3TestCallDoerInPEV86(uint16_t offBs3Text16);
 ; @uses     rax
-BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPEV86, BS3_PBC_FAR
-        BS3_LEA_MOV_WRT_RIP(xAX, .doit)
-        jmp     TMPL_NM(bs3TestCallDoerPrologue)
-BS3_BEGIN_TEXT16
+BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPEV86, BS3_PBC_NEAR
+        BS3_LEA_MOV_WRT_RIP(xAX, .doit)
+        jmp     TMPL_NM(bs3TestCallDoerPrologue)
+MY_BEGIN_TEXT16
 BS3_SET_BITS TMPL_BITS
 .doit:
@@ -417,5 +516,9 @@
         ; Mode switch, make the call, switch back.
         STRICT_SAVE_REGS
+%if TMPL_MODE == BS3_MODE_RM
+        call far TMPL_FAR_NM(Bs3SwitchToPEV86)
+%else
         call    TMPL_NM(Bs3SwitchToPEV86)
+%endif
         BS3_SET_BITS 16
         STRICT_CHECK_REGS
@@ -430,9 +533,13 @@
 
         STRICT_SAVE_REGS
-        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pev86)
-        BS3_SET_BITS TMPL_BITS
-        STRICT_CHECK_REGS
-        jmp     TMPL_NM(bs3TestCallDoerEpilogue)
-TMPL_BEGIN_TEXT
+%if TMPL_MODE == BS3_MODE_RM
+        call far RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pev86_far)
+%else
+        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pev86)
+%endif
+        BS3_SET_BITS TMPL_BITS
+        STRICT_CHECK_REGS
+        jmp     TMPL_NM(bs3TestCallDoerEpilogue)
+MY_BEGIN_TEXT
 BS3_PROC_END_MODE   Bs3TestCallDoerInPEV86
 
@@ -446,8 +553,8 @@
 ; @cproto   BS3_DECL(uint8_t) Bs3TestCallDoerInPP16(uint16_t offBs3Text16);
 ; @uses     rax
-BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPP16, BS3_PBC_FAR
-        BS3_LEA_MOV_WRT_RIP(xAX, .doit)
-        jmp     TMPL_NM(bs3TestCallDoerPrologue)
-BS3_BEGIN_TEXT16
+BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPP16, BS3_PBC_NEAR
+        BS3_LEA_MOV_WRT_RIP(xAX, .doit)
+        jmp     TMPL_NM(bs3TestCallDoerPrologue)
+MY_BEGIN_TEXT16
 BS3_SET_BITS TMPL_BITS
 .doit:
@@ -457,5 +564,9 @@
         ; Mode switch, make the call, switch back.
         STRICT_SAVE_REGS
+%if TMPL_MODE == BS3_MODE_RM
+        call far TMPL_FAR_NM(Bs3SwitchToPP16)
+%else
         call    TMPL_NM(Bs3SwitchToPP16)
+%endif
         BS3_SET_BITS 16
         STRICT_CHECK_REGS
@@ -470,9 +581,13 @@
 
         STRICT_SAVE_REGS
-        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pp16)
-        BS3_SET_BITS TMPL_BITS
-        STRICT_CHECK_REGS
-        jmp     TMPL_NM(bs3TestCallDoerEpilogue)
-TMPL_BEGIN_TEXT
+%if TMPL_MODE == BS3_MODE_RM
+        call far RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pp16_far)
+%else
+        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pp16)
+%endif
+        BS3_SET_BITS TMPL_BITS
+        STRICT_CHECK_REGS
+        jmp     TMPL_NM(bs3TestCallDoerEpilogue)
+MY_BEGIN_TEXT
 BS3_PROC_END_MODE   Bs3TestCallDoerInPP16
 
@@ -480,5 +595,5 @@
 ; @cproto   BS3_DECL(uint8_t) Bs3TestCallDoerInPP16_32(uint16_t offBs3Text16);
 ; @uses     rax
-BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPP16_32, BS3_PBC_FAR
+BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPP16_32, BS3_PBC_NEAR
         BS3_LEA_MOV_WRT_RIP(xAX, .doit)
         jmp     TMPL_NM(bs3TestCallDoerPrologue)
@@ -488,5 +603,9 @@
         ; Mode switch, make the call, switch back.
         STRICT_SAVE_REGS
+%if TMPL_MODE == BS3_MODE_RM
+        call far TMPL_FAR_NM(Bs3SwitchToPP16_32)
+%else
         call    TMPL_NM(Bs3SwitchToPP16_32)
+%endif
         BS3_SET_BITS 32
         STRICT_CHECK_REGS
@@ -496,5 +615,5 @@
 
         STRICT_SAVE_REGS
-        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pp16_32)
+        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pp16_32)
         BS3_SET_BITS TMPL_BITS
         STRICT_CHECK_REGS
@@ -505,14 +624,18 @@
 ; @cproto   BS3_DECL(uint8_t) Bs3TestCallDoerInPP16_V86(uint16_t offBs3Text16);
 ; @uses     rax
-BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPP16_V86, BS3_PBC_FAR
-        BS3_LEA_MOV_WRT_RIP(xAX, .doit)
-        jmp     TMPL_NM(bs3TestCallDoerPrologue)
-.doit:
-        mov     ax, [xBP + xCB + cbCurRetAddr]      ; Load far function pointer.
-        mov     dx, [xBP + xCB + cbCurRetAddr + 2]
-
-        ; Mode switch, make the call, switch back.
-        STRICT_SAVE_REGS
+BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPP16_V86, BS3_PBC_NEAR
+        BS3_LEA_MOV_WRT_RIP(xAX, .doit)
+        jmp     TMPL_NM(bs3TestCallDoerPrologue)
+.doit:
+        mov     ax, [xBP + xCB + cbCurRetAddr]      ; Load far function pointer.
+        mov     dx, [xBP + xCB + cbCurRetAddr + 2]
+
+        ; Mode switch, make the call, switch back.
+        STRICT_SAVE_REGS
+%if TMPL_MODE == BS3_MODE_RM
+        call far TMPL_FAR_NM(Bs3SwitchToPP16_V86)
+%else
         call    TMPL_NM(Bs3SwitchToPP16_V86)
+%endif
         BS3_SET_BITS 16
         STRICT_CHECK_REGS
@@ -527,5 +650,9 @@
 
         STRICT_SAVE_REGS
-        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pp16_v86)
+%if TMPL_MODE == BS3_MODE_RM
+        call far RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pp16_v86_far)
+%else
+        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pp16_v86)
+%endif
         BS3_SET_BITS TMPL_BITS
         STRICT_CHECK_REGS
@@ -536,5 +663,5 @@
 ; @cproto   BS3_DECL(uint8_t) Bs3TestCallDoerInPP32(uint16_t offBs3Text16);
 ; @uses     rax
-BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPP32, BS3_PBC_FAR
+BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPP32, BS3_PBC_NEAR
         BS3_LEA_MOV_WRT_RIP(xAX, .doit)
         jmp     TMPL_NM(bs3TestCallDoerPrologue)
@@ -544,5 +671,9 @@
         ; Mode switch, make the call, switch back.
         STRICT_SAVE_REGS
+%if TMPL_MODE == BS3_MODE_RM
+        call far TMPL_FAR_NM(Bs3SwitchToPP32)
+%else
         call    TMPL_NM(Bs3SwitchToPP32)
+%endif
         BS3_SET_BITS 32
         STRICT_CHECK_REGS
@@ -552,5 +683,5 @@
 
         STRICT_SAVE_REGS
-        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pp32)
+        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pp32)
         BS3_SET_BITS TMPL_BITS
         STRICT_CHECK_REGS
@@ -561,8 +692,8 @@
 ; @cproto   BS3_DECL(uint8_t) Bs3TestCallDoerInPP32_16(uint16_t offBs3Text16);
 ; @uses     rax
-BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPP32_16, BS3_PBC_FAR
-        BS3_LEA_MOV_WRT_RIP(xAX, .doit)
-        jmp     TMPL_NM(bs3TestCallDoerPrologue)
-BS3_BEGIN_TEXT16
+BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPP32_16, BS3_PBC_NEAR
+        BS3_LEA_MOV_WRT_RIP(xAX, .doit)
+        jmp     TMPL_NM(bs3TestCallDoerPrologue)
+MY_BEGIN_TEXT16
 BS3_SET_BITS TMPL_BITS
 .doit:
@@ -572,5 +703,9 @@
         ; Mode switch, make the call, switch back.
         STRICT_SAVE_REGS
+%if TMPL_MODE == BS3_MODE_RM
+        call far TMPL_FAR_NM(Bs3SwitchToPP32_16)
+%else
         call    TMPL_NM(Bs3SwitchToPP32_16)
+%endif
         BS3_SET_BITS 16
         STRICT_CHECK_REGS
@@ -585,9 +720,13 @@
 
         STRICT_SAVE_REGS
-        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pp32_16)
-        BS3_SET_BITS TMPL_BITS
-        STRICT_CHECK_REGS
-        jmp     TMPL_NM(bs3TestCallDoerEpilogue)
-TMPL_BEGIN_TEXT
+%if TMPL_MODE == BS3_MODE_RM
+        call far RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pp32_16_far)
+%else
+        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pp32_16)
+%endif
+        BS3_SET_BITS TMPL_BITS
+        STRICT_CHECK_REGS
+        jmp     TMPL_NM(bs3TestCallDoerEpilogue)
+MY_BEGIN_TEXT
 BS3_PROC_END_MODE   Bs3TestCallDoerInPP32_16
 
@@ -595,8 +734,8 @@
 ; @cproto   BS3_DECL(uint8_t) Bs3TestCallDoerInPPV86(uint16_t offBs3Text16);
 ; @uses     rax
-BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPPV86, BS3_PBC_FAR
-        BS3_LEA_MOV_WRT_RIP(xAX, .doit)
-        jmp     TMPL_NM(bs3TestCallDoerPrologue)
-BS3_BEGIN_TEXT16
+BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPPV86, BS3_PBC_NEAR
+        BS3_LEA_MOV_WRT_RIP(xAX, .doit)
+        jmp     TMPL_NM(bs3TestCallDoerPrologue)
+MY_BEGIN_TEXT16
 BS3_SET_BITS TMPL_BITS
 .doit:
@@ -606,5 +745,9 @@
         ; Mode switch, make the call, switch back.
         STRICT_SAVE_REGS
+%if TMPL_MODE == BS3_MODE_RM
+        call far TMPL_FAR_NM(Bs3SwitchToPPV86)
+%else
         call    TMPL_NM(Bs3SwitchToPPV86)
+%endif
         BS3_SET_BITS 16
         STRICT_CHECK_REGS
@@ -619,9 +762,13 @@
 
         STRICT_SAVE_REGS
-        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_ppv86)
-        BS3_SET_BITS TMPL_BITS
-        STRICT_CHECK_REGS
-        jmp     TMPL_NM(bs3TestCallDoerEpilogue)
-TMPL_BEGIN_TEXT
+%if TMPL_MODE == BS3_MODE_RM
+        call far RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_ppv86_far)
+%else
+        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_ppv86)
+%endif
+        BS3_SET_BITS TMPL_BITS
+        STRICT_CHECK_REGS
+        jmp     TMPL_NM(bs3TestCallDoerEpilogue)
+MY_BEGIN_TEXT
 BS3_PROC_END_MODE   Bs3TestCallDoerInPPV86
 
@@ -635,8 +782,8 @@
 ; @cproto   BS3_DECL(uint8_t) Bs3TestCallDoerInPAE16(uint16_t offBs3Text16);
 ; @uses     rax
-BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPAE16, BS3_PBC_FAR
-        BS3_LEA_MOV_WRT_RIP(xAX, .doit)
-        jmp     TMPL_NM(bs3TestCallDoerPrologue)
-BS3_BEGIN_TEXT16
+BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPAE16, BS3_PBC_NEAR
+        BS3_LEA_MOV_WRT_RIP(xAX, .doit)
+        jmp     TMPL_NM(bs3TestCallDoerPrologue)
+MY_BEGIN_TEXT16
 BS3_SET_BITS TMPL_BITS
 .doit:
@@ -646,5 +793,9 @@
         ; Mode switch, make the call, switch back.
         STRICT_SAVE_REGS
+%if TMPL_MODE == BS3_MODE_RM
+        call far TMPL_FAR_NM(Bs3SwitchToPAE16)
+%else
         call    TMPL_NM(Bs3SwitchToPAE16)
+%endif
         BS3_SET_BITS 16
         STRICT_CHECK_REGS
@@ -659,9 +810,13 @@
 
         STRICT_SAVE_REGS
-        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pae16)
-        BS3_SET_BITS TMPL_BITS
-        STRICT_CHECK_REGS
-        jmp     TMPL_NM(bs3TestCallDoerEpilogue)
-TMPL_BEGIN_TEXT
+%if TMPL_MODE == BS3_MODE_RM
+        call far RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pae16_far)
+%else
+        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pae16)
+%endif
+        BS3_SET_BITS TMPL_BITS
+        STRICT_CHECK_REGS
+        jmp     TMPL_NM(bs3TestCallDoerEpilogue)
+MY_BEGIN_TEXT
 BS3_PROC_END_MODE   Bs3TestCallDoerInPAE16
 
@@ -669,5 +824,5 @@
 ; @cproto   BS3_DECL(uint8_t) Bs3TestCallDoerInPAE16_32(uint16_t offBs3Text16);
 ; @uses     rax
-BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPAE16_32, BS3_PBC_FAR
+BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPAE16_32, BS3_PBC_NEAR
         BS3_LEA_MOV_WRT_RIP(xAX, .doit)
         jmp     TMPL_NM(bs3TestCallDoerPrologue)
@@ -677,5 +832,9 @@
         ; Mode switch, make the call, switch back.
         STRICT_SAVE_REGS
+%if TMPL_MODE == BS3_MODE_RM
+        call far TMPL_FAR_NM(Bs3SwitchToPAE16_32)
+%else
         call    TMPL_NM(Bs3SwitchToPAE16_32)
+%endif
         BS3_SET_BITS 32
         STRICT_CHECK_REGS
@@ -685,5 +844,5 @@
 
         STRICT_SAVE_REGS
-        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pae16_32)
+        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pae16_32)
         BS3_SET_BITS TMPL_BITS
         STRICT_CHECK_REGS
@@ -694,14 +853,18 @@
 ; @cproto   BS3_DECL(uint8_t) Bs3TestCallDoerInPAE16_V86(uint16_t offBs3Text16);
 ; @uses     rax
-BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPAE16_V86, BS3_PBC_FAR
-        BS3_LEA_MOV_WRT_RIP(xAX, .doit)
-        jmp     TMPL_NM(bs3TestCallDoerPrologue)
-.doit:
-        mov     ax, [xBP + xCB + cbCurRetAddr]      ; Load far function pointer.
-        mov     dx, [xBP + xCB + cbCurRetAddr + 2]
-
-        ; Mode switch, make the call, switch back.
-        STRICT_SAVE_REGS
+BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPAE16_V86, BS3_PBC_NEAR
+        BS3_LEA_MOV_WRT_RIP(xAX, .doit)
+        jmp     TMPL_NM(bs3TestCallDoerPrologue)
+.doit:
+        mov     ax, [xBP + xCB + cbCurRetAddr]      ; Load far function pointer.
+        mov     dx, [xBP + xCB + cbCurRetAddr + 2]
+
+        ; Mode switch, make the call, switch back.
+        STRICT_SAVE_REGS
+%if TMPL_MODE == BS3_MODE_RM
+        call far TMPL_FAR_NM(Bs3SwitchToPAE16_V86)
+%else
         call    TMPL_NM(Bs3SwitchToPAE16_V86)
+%endif
         BS3_SET_BITS 16
         STRICT_CHECK_REGS
@@ -716,5 +879,9 @@
 
         STRICT_SAVE_REGS
-        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pae16_v86)
+%if TMPL_MODE == BS3_MODE_RM
+        call far RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pae16_v86_far)
+%else
+        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pae16_v86)
+%endif
         BS3_SET_BITS TMPL_BITS
         STRICT_CHECK_REGS
@@ -725,5 +892,5 @@
 ; @cproto   BS3_DECL(uint8_t) Bs3TestCallDoerInPAE32(uint16_t offBs3Text16);
 ; @uses     rax
-BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPAE32, BS3_PBC_FAR
+BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPAE32, BS3_PBC_NEAR
         BS3_LEA_MOV_WRT_RIP(xAX, .doit)
         jmp     TMPL_NM(bs3TestCallDoerPrologue)
@@ -733,5 +900,9 @@
         ; Mode switch, make the call, switch back.
         STRICT_SAVE_REGS
+%if TMPL_MODE == BS3_MODE_RM
+        call far TMPL_FAR_NM(Bs3SwitchToPAE32)
+%else
         call    TMPL_NM(Bs3SwitchToPAE32)
+%endif
         BS3_SET_BITS 32
         STRICT_CHECK_REGS
@@ -741,5 +912,5 @@
 
         STRICT_SAVE_REGS
-        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pae32)
+        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pae32)
         BS3_SET_BITS TMPL_BITS
         STRICT_CHECK_REGS
@@ -750,8 +921,8 @@
 ; @cproto   BS3_DECL(uint8_t) Bs3TestCallDoerInPAE32_16(uint16_t offBs3Text16);
 ; @uses     rax
-BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPAE32_16, BS3_PBC_FAR
-        BS3_LEA_MOV_WRT_RIP(xAX, .doit)
-        jmp     TMPL_NM(bs3TestCallDoerPrologue)
-BS3_BEGIN_TEXT16
+BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPAE32_16, BS3_PBC_NEAR
+        BS3_LEA_MOV_WRT_RIP(xAX, .doit)
+        jmp     TMPL_NM(bs3TestCallDoerPrologue)
+MY_BEGIN_TEXT16
 BS3_SET_BITS TMPL_BITS
 .doit:
@@ -761,5 +932,9 @@
         ; Mode switch, make the call, switch back.
         STRICT_SAVE_REGS
+%if TMPL_MODE == BS3_MODE_RM
+        call far TMPL_FAR_NM(Bs3SwitchToPAE32_16)
+%else
         call    TMPL_NM(Bs3SwitchToPAE32_16)
+%endif
         BS3_SET_BITS 16
         STRICT_CHECK_REGS
@@ -774,9 +949,13 @@
 
         STRICT_SAVE_REGS
-        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pae32_16)
-        BS3_SET_BITS TMPL_BITS
-        STRICT_CHECK_REGS
-        jmp     TMPL_NM(bs3TestCallDoerEpilogue)
-TMPL_BEGIN_TEXT
+%if TMPL_MODE == BS3_MODE_RM
+        call far RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pae32_16_far)
+%else
+        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pae32_16)
+%endif
+        BS3_SET_BITS TMPL_BITS
+        STRICT_CHECK_REGS
+        jmp     TMPL_NM(bs3TestCallDoerEpilogue)
+MY_BEGIN_TEXT
 BS3_PROC_END_MODE   Bs3TestCallDoerInPAE32_16
 
@@ -784,8 +963,8 @@
 ; @cproto   BS3_DECL(uint8_t) Bs3TestCallDoerInPAEV86(uint16_t offBs3Text16);
 ; @uses     rax
-BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPAEV86, BS3_PBC_FAR
-        BS3_LEA_MOV_WRT_RIP(xAX, .doit)
-        jmp     TMPL_NM(bs3TestCallDoerPrologue)
-BS3_BEGIN_TEXT16
+BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPAEV86, BS3_PBC_NEAR
+        BS3_LEA_MOV_WRT_RIP(xAX, .doit)
+        jmp     TMPL_NM(bs3TestCallDoerPrologue)
+MY_BEGIN_TEXT16
 BS3_SET_BITS TMPL_BITS
 .doit:
@@ -795,5 +974,9 @@
         ; Mode switch, make the call, switch back.
         STRICT_SAVE_REGS
+%if TMPL_MODE == BS3_MODE_RM
+        call far TMPL_FAR_NM(Bs3SwitchToPAEV86)
+%else
         call    TMPL_NM(Bs3SwitchToPAEV86)
+%endif
         BS3_SET_BITS 16
         STRICT_CHECK_REGS
@@ -808,9 +991,13 @@
 
         STRICT_SAVE_REGS
-        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_paev86)
-        BS3_SET_BITS TMPL_BITS
-        STRICT_CHECK_REGS
-        jmp     TMPL_NM(bs3TestCallDoerEpilogue)
-TMPL_BEGIN_TEXT
+%if TMPL_MODE == BS3_MODE_RM
+        call far RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_paev86_far)
+%else
+        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_paev86)
+%endif
+        BS3_SET_BITS TMPL_BITS
+        STRICT_CHECK_REGS
+        jmp     TMPL_NM(bs3TestCallDoerEpilogue)
+MY_BEGIN_TEXT
 BS3_PROC_END_MODE   Bs3TestCallDoerInPAEV86
 
@@ -824,8 +1011,8 @@
 ; @cproto   BS3_DECL(uint8_t) Bs3TestCallDoerInLM16(uint16_t offBs3Text16);
 ; @uses     rax
-BS3_PROC_BEGIN_MODE Bs3TestCallDoerInLM16, BS3_PBC_FAR
-        BS3_LEA_MOV_WRT_RIP(xAX, .doit)
-        jmp     TMPL_NM(bs3TestCallDoerPrologue)
-BS3_BEGIN_TEXT16
+BS3_PROC_BEGIN_MODE Bs3TestCallDoerInLM16, BS3_PBC_NEAR
+        BS3_LEA_MOV_WRT_RIP(xAX, .doit)
+        jmp     TMPL_NM(bs3TestCallDoerPrologue)
+MY_BEGIN_TEXT16
 BS3_SET_BITS TMPL_BITS
 .doit:
@@ -835,5 +1022,9 @@
         ; Mode switch, make the call, switch back.
         STRICT_SAVE_REGS
+%if TMPL_MODE == BS3_MODE_RM
+        call far TMPL_FAR_NM(Bs3SwitchToLM16)
+%else
         call    TMPL_NM(Bs3SwitchToLM16)
+%endif
         BS3_SET_BITS 16
         STRICT_CHECK_REGS
@@ -848,9 +1039,13 @@
 
         STRICT_SAVE_REGS
-        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_lm16)
-        BS3_SET_BITS TMPL_BITS
-        STRICT_CHECK_REGS
-        jmp     TMPL_NM(bs3TestCallDoerEpilogue)
-TMPL_BEGIN_TEXT
+%if TMPL_MODE == BS3_MODE_RM
+        call far RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_lm16_far)
+%else
+        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_lm16)
+%endif
+        BS3_SET_BITS TMPL_BITS
+        STRICT_CHECK_REGS
+        jmp     TMPL_NM(bs3TestCallDoerEpilogue)
+MY_BEGIN_TEXT
 BS3_PROC_END_MODE   Bs3TestCallDoerInLM16
 
@@ -858,5 +1053,5 @@
 ; @cproto   BS3_DECL(uint8_t) Bs3TestCallDoerInLM32(uint16_t offBs3Text16);
 ; @uses     rax
-BS3_PROC_BEGIN_MODE Bs3TestCallDoerInLM32, BS3_PBC_FAR
+BS3_PROC_BEGIN_MODE Bs3TestCallDoerInLM32, BS3_PBC_NEAR
         BS3_LEA_MOV_WRT_RIP(xAX, .doit)
         jmp     TMPL_NM(bs3TestCallDoerPrologue)
@@ -866,5 +1061,9 @@
         ; Mode switch, make the call, switch back.
         STRICT_SAVE_REGS
+%if TMPL_MODE == BS3_MODE_RM
+        call far TMPL_FAR_NM(Bs3SwitchToLM32)
+%else
         call    TMPL_NM(Bs3SwitchToLM32)
+%endif
         BS3_SET_BITS 32
         STRICT_CHECK_REGS
@@ -875,5 +1074,5 @@
 
         STRICT_SAVE_REGS
-        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_lm32)
+        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_lm32)
         BS3_SET_BITS TMPL_BITS
         STRICT_CHECK_REGS
@@ -884,5 +1083,5 @@
 ; @cproto   BS3_DECL(uint8_t) Bs3TestCallDoerInLM64(uint16_t offBs3Text16);
 ; @uses     rax
-BS3_PROC_BEGIN_MODE Bs3TestCallDoerInLM64, BS3_PBC_FAR
+BS3_PROC_BEGIN_MODE Bs3TestCallDoerInLM64, BS3_PBC_NEAR
         BS3_LEA_MOV_WRT_RIP(xAX, .doit)
         jmp     TMPL_NM(bs3TestCallDoerPrologue)
@@ -892,5 +1091,9 @@
         ; Mode switch, make the call, switch back.
         STRICT_SAVE_REGS
+%if TMPL_MODE == BS3_MODE_RM
+        call far TMPL_FAR_NM(Bs3SwitchToLM64)
+%else
         call    TMPL_NM(Bs3SwitchToLM64)
+%endif
         BS3_SET_BITS 64
         STRICT_CHECK_REGS
@@ -902,5 +1105,5 @@
 
         STRICT_SAVE_REGS
-        call    RT_CONCAT3(Bs3SwitchTo,TMPL_MODE_UNAME,_lm64)
+        call    RT_CONCAT3(Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_lm64)
         BS3_SET_BITS TMPL_BITS
         STRICT_CHECK_REGS
@@ -908,2 +1111,24 @@
 BS3_PROC_END_MODE   Bs3TestCallDoerInLM64
 
+
+;
+; Finally near stub for the API call (16-bit only).
+;
+%if TMPL_BITS == 16
+BS3_BEGIN_TEXT16_NEARSTUBS
+BS3_PROC_BEGIN_MODE Bs3TestDoModes, BS3_PBC_NEAR
+        pop     ax
+ %if TMPL_MODE == BS3_MODE_RM
+        push    cs
+        push    ax
+        extern TMPL_FAR_NM(Bs3TestDoModes):wrt BS3GROUPRMTEXT16
+        jmp far TMPL_FAR_NM(Bs3TestDoModes)
+ %else
+        push    cs
+        push    ax
+        extern TMPL_FAR_NM(Bs3TestDoModes):wrt CGROUP16
+        jmp     TMPL_NM(Bs3TestDoModes)
+ %endif
+BS3_PROC_END_MODE   Bs3TestDoModes
+
+%endif
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-TrapSystemCallHandler.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-TrapSystemCallHandler.asm	(revision 60556)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-TrapSystemCallHandler.asm	(revision 60557)
@@ -67,5 +67,5 @@
 ;       CPUs too!
 ;
-BS3_PROC_BEGIN_MODE Bs3TrapSystemCallHandler, BS3_PBC_NEAR ; Near because we'll probably only ever need this from BS3TEXT16.
+BS3_PROC_BEGIN_MODE Bs3TrapSystemCallHandler, BS3_PBC_NEAR ; Near because we'll probably only ever need this from CGROUP16.
         ;
         ; This prologue is kind of complicated because of 80286 and older CPUs
@@ -168,12 +168,12 @@
 .aoffSyscallHandlers:
 %ifdef TMPL_16BIT
-        dw      .invalid_syscall wrt BS3TEXT16
-        dw      .print_chr       wrt BS3TEXT16
-        dw      .print_str       wrt BS3TEXT16
-        dw      .to_ringX        wrt BS3TEXT16
-        dw      .to_ringX        wrt BS3TEXT16
-        dw      .to_ringX        wrt BS3TEXT16
-        dw      .to_ringX        wrt BS3TEXT16
-        dw      .restore_ctx     wrt BS3TEXT16
+        dw      .invalid_syscall wrt CGROUP16
+        dw      .print_chr       wrt CGROUP16
+        dw      .print_str       wrt CGROUP16
+        dw      .to_ringX        wrt CGROUP16
+        dw      .to_ringX        wrt CGROUP16
+        dw      .to_ringX        wrt CGROUP16
+        dw      .to_ringX        wrt CGROUP16
+        dw      .restore_ctx     wrt CGROUP16
 %else
         dd      .invalid_syscall wrt FLAT
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-rm-InitGdt.c
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-rm-InitGdt.c	(revision 60556)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-rm-InitGdt.c	(revision 60557)
@@ -44,8 +44,19 @@
 BS3_DECL_FAR(void) Bs3InitGdt_rm_far(void)
 {
+#if 1
+    Bs3Gdte_R0_CS16.Gen.u16LimitLow     = Bs3Text16_Size - 1;
+    Bs3Gdte_R1_CS16.Gen.u16LimitLow     = Bs3Text16_Size - 1;
+    Bs3Gdte_R2_CS16.Gen.u16LimitLow     = Bs3Text16_Size - 1;
+    Bs3Gdte_R3_CS16.Gen.u16LimitLow     = Bs3Text16_Size - 1;
+#endif
+    Bs3Gdte_RMTEXT16_CS.Gen.u16LimitLow = Bs3RmText16_Size - 1;
     Bs3Gdte_X0TEXT16_CS.Gen.u16LimitLow = Bs3X0Text16_Size - 1;
-    Bs3Gdte_X1TEXT16_CS.Gen.u16LimitLow = Bs3X0Text16_Size - 1;
+    Bs3Gdte_X1TEXT16_CS.Gen.u16LimitLow = Bs3X1Text16_Size - 1;
+
+    Bs3Gdte_RMTEXT16_CS.Gen.u16BaseLow  = (uint16_t)Bs3RmText16_FlatAddr;
     Bs3Gdte_X0TEXT16_CS.Gen.u16BaseLow  = (uint16_t)Bs3X0Text16_FlatAddr;
     Bs3Gdte_X1TEXT16_CS.Gen.u16BaseLow  = (uint16_t)Bs3X1Text16_FlatAddr;
+
+    Bs3Gdte_RMTEXT16_CS.Gen.u8BaseHigh1 = (uint8_t)(Bs3RmText16_FlatAddr >> 16);
     Bs3Gdte_X0TEXT16_CS.Gen.u8BaseHigh1 = (uint8_t)(Bs3X0Text16_FlatAddr >> 16);
     Bs3Gdte_X1TEXT16_CS.Gen.u8BaseHigh1 = (uint8_t)(Bs3X1Text16_FlatAddr >> 16);
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-system-data.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-system-data.asm	(revision 60556)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-system-data.asm	(revision 60557)
@@ -177,7 +177,9 @@
         dw  00000h, 00000h, 00000h, 00000h      ; Entry 0d0h - currently unused
         dw  00000h, 00000h, 00000h, 00000h      ; Entry 0d8h - currently unused
-        dw  00000h, 00000h, 00000h, 00000h      ; Entry 0e0h - currently unused
 
         ; Misc selectors.
+BS3_GLOBAL_DATA Bs3Gdte_RMTEXT16_CS, 8          ; Entry 0e0h
+        dw  0fffeh, 00000h                      ; 16-bit conforming code (read+exec) segment, accessed. Will be finalized at startup.
+        dw  09f00h, 00000h
 BS3_GLOBAL_DATA Bs3Gdte_X0TEXT16_CS, 8          ; Entry 0e8h
         dw  0fffeh, 00000h                      ; 16-bit conforming code (read+exec) segment, accessed. Will be finalized at startup.
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3kit-mangling-data.h
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3kit-mangling-data.h	(revision 60556)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3kit-mangling-data.h	(revision 60557)
@@ -50,4 +50,7 @@
 # define Bs3Gdte_Tss64Spare1                    BS3_DATA_NM(Bs3Gdte_Tss64Spare1)
 # define Bs3Gdte_Tss64Iobp                      BS3_DATA_NM(Bs3Gdte_Tss64Iobp)
+# define Bs3Gdte_RMTEXT16_CS                    BS3_DATA_NM(Bs3Gdte_RMTEXT16_CS)
+# define Bs3Gdte_X0TEXT16_CS                    BS3_DATA_NM(Bs3Gdte_X0TEXT16_CS)
+# define Bs3Gdte_X1TEXT16_CS                    BS3_DATA_NM(Bs3Gdte_X1TEXT16_CS)
 # define Bs3Gdte_R0_MMIO16                      BS3_DATA_NM(Bs3Gdte_R0_MMIO16)
 
@@ -220,14 +223,35 @@
 # define Bs3Text16_EndOfSegment                 BS3_DATA_NM(Bs3Text16_EndOfSegment)
 # define Bs3Text16_Size                         BS3_DATA_NM(Bs3Text16_Size)
+
 # define Bs3System16_StartOfSegment             BS3_DATA_NM(Bs3System16_StartOfSegment)
 # define Bs3System16_EndOfSegment               BS3_DATA_NM(Bs3System16_EndOfSegment)
+
 # define Bs3Data16_StartOfSegment               BS3_DATA_NM(Bs3Data16_StartOfSegment)
 # define Bs3Data16_EndOfSegment                 BS3_DATA_NM(Bs3Data16_EndOfSegment)
+
+# define Bs3RmText16_StartOfSegment             BS3_DATA_NM(Bs3RmText16_StartOfSegment)
+# define Bs3RmText16_EndOfSegment               BS3_DATA_NM(Bs3RmText16_EndOfSegment)
+# define Bs3RmText16_Size                       BS3_DATA_NM(Bs3RmText16_Size)
+# define Bs3RmText16_FlatAddr                   BS3_DATA_NM(Bs3RmText16_FlatAddr)
+
+# define Bs3X0Text16_StartOfSegment             BS3_DATA_NM(Bs3X0Text16_StartOfSegment)
+# define Bs3X0Text16_EndOfSegment               BS3_DATA_NM(Bs3X0Text16_EndOfSegment)
+# define Bs3X0Text16_Size                       BS3_DATA_NM(Bs3X0Text16_Size)
+# define Bs3X0Text16_FlatAddr                   BS3_DATA_NM(Bs3X0Text16_FlatAddr)
+
+# define Bs3X1Text16_StartOfSegment             BS3_DATA_NM(Bs3X1Text16_StartOfSegment)
+# define Bs3X1Text16_EndOfSegment               BS3_DATA_NM(Bs3X1Text16_EndOfSegment)
+# define Bs3X1Text16_Size                       BS3_DATA_NM(Bs3X1Text16_Size)
+# define Bs3X1Text16_FlatAddr                   BS3_DATA_NM(Bs3X1Text16_FlatAddr)
+
 # define Bs3Text32_StartOfSegment               BS3_DATA_NM(Bs3Text32_StartOfSegment)
 # define Bs3Text32_EndOfSegment                 BS3_DATA_NM(Bs3Text32_EndOfSegment)
+
 # define Bs3Data32_StartOfSegment               BS3_DATA_NM(Bs3Data32_StartOfSegment)
 # define Bs3Data32_EndOfSegment                 BS3_DATA_NM(Bs3Data32_EndOfSegment)
+
 # define Bs3Text64_StartOfSegment               BS3_DATA_NM(Bs3Text64_StartOfSegment)
 # define Bs3Text64_EndOfSegment                 BS3_DATA_NM(Bs3Text64_EndOfSegment)
+
 # define Bs3Data64_StartOfSegment               BS3_DATA_NM(Bs3Data64_StartOfSegment)
 # define Bs3Data64_EndOfSegment                 BS3_DATA_NM(Bs3Data64_EndOfSegment)
@@ -235,4 +259,5 @@
 # define Bs3Data16Thru64Text32And64_TotalSize   BS3_DATA_NM(Bs3Data16Thru64Text32And64_TotalSize)
 # define Bs3TotalImageSize                      BS3_DATA_NM(Bs3TotalImageSize)
+
 # define g_achBs3HexDigits                      BS3_DATA_NM(g_achBs3HexDigits)
 # define g_achBs3HexDigitsUpper                 BS3_DATA_NM(g_achBs3HexDigitsUpper)
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3kit.h
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3kit.h	(revision 60556)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3kit.h	(revision 60557)
@@ -228,6 +228,7 @@
 #define BS3_SEL_TSS64_IOBP          0x00a0 /**< The 64-bit TSS selector. */
 
+#define BS3_SEL_RMTEXT16_CS         0x00e0 /**< Conforming code selector for accessing the BS3RMTEXT16 segment. Runtime config. */
 #define BS3_SEL_X0TEXT16_CS         0x00e8 /**< Conforming code selector for accessing the BS3X0TEXT16 segment. Runtime config. */
-#define BS3_SEL_X1TEXT16_CS         0x00f0 /**< Conforming code selector for accessing the BS3X0TEXT16 segment. Runtime config. */
+#define BS3_SEL_X1TEXT16_CS         0x00f0 /**< Conforming code selector for accessing the BS3X1TEXT16 segment. Runtime config. */
 #define BS3_SEL_VMMDEV_MMIO16       0x00f8 /**< Selector for accessing the VMMDev MMIO segment at 0100000h from 16-bit code. */
 
@@ -705,4 +706,5 @@
 extern X86DESC BS3_FAR_DATA Bs3Gdte_Tss64Spare1;            /**< @see BS3_SEL_TSS64_SPARE1 */
 extern X86DESC BS3_FAR_DATA Bs3Gdte_Tss64Iobp;              /**< @see BS3_SEL_TSS64_IOBP */
+extern X86DESC BS3_FAR_DATA Bs3Gdte_RMTEXT16_CS;            /**< @see BS3_SEL_RMTEXT16_CS */
 extern X86DESC BS3_FAR_DATA Bs3Gdte_X0TEXT16_CS;            /**< @see BS3_SEL_X0TEXT16_CS */
 extern X86DESC BS3_FAR_DATA Bs3Gdte_X1TEXT16_CS;            /**< @see BS3_SEL_X1TEXT16_CS */
@@ -930,4 +932,8 @@
 /** End of the BS3RMTEXT16 segment.   */
 extern uint8_t  BS3_FAR_DATA Bs3RmText16_EndOfSegment;
+/** The size of the BS3RMTEXT16 segment.   */
+extern uint16_t BS3_FAR_DATA Bs3RmText16_Size;
+/** The flat start address of the BS3X0TEXT16 segment.   */
+extern uint32_t BS3_FAR_DATA Bs3RmText16_FlatAddr;
 
 /** Start of the BS3X0TEXT16 segment.   */
@@ -937,5 +943,5 @@
 /** The size of the BS3X0TEXT16 segment.   */
 extern uint16_t BS3_FAR_DATA Bs3X0Text16_Size;
-/** The flat start address of the BS3X1TEXT16 segment.   */
+/** The flat start address of the BS3X0TEXT16 segment.   */
 extern uint32_t BS3_FAR_DATA Bs3X0Text16_FlatAddr;
 
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3kit.mac
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3kit.mac	(revision 60556)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3kit.mac	(revision 60557)
@@ -1477,6 +1477,7 @@
 %define BS3_SEL_TSS64_IOBP          00a0h ;;< The 64-bit TSS selector.
 
+%define BS3_SEL_RMTEXT16_CS         00e0h ;;< Conforming code selector for accessing the BS3RMTEXT16 segment. Runtime config.
 %define BS3_SEL_X0TEXT16_CS         00e8h ;;< Conforming code selector for accessing the BS3X0TEXT16 segment. Runtime config.
-%define BS3_SEL_X1TEXT16_CS         00f0h ;;< Conforming code selector for accessing the BS3X0TEXT16 segment. Runtime config.
+%define BS3_SEL_X1TEXT16_CS         00f0h ;;< Conforming code selector for accessing the BS3X1TEXT16 segment. Runtime config.
 %define BS3_SEL_VMMDEV_MMIO16       00f8h ;;< Selector for accessing the VMMDev MMIO segment at 0100000h from 16-bit code.
 
