Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-CpuDetect.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-CpuDetect.asm	(revision 60671)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-CpuDetect.asm	(revision 60672)
@@ -56,8 +56,9 @@
         push    xBP
         mov     xBP, xSP
-        pushf
-        push    xCX
-        push    xDX
-        push    xBX
+        pushf                           ; xBP - xCB*1
+        push    xCX                     ; xBP - xCB*2
+        push    xDX                     ; xBP - xCB*3
+        push    xBX                     ; xBP - xCB*4
+        sub     xSP, 20h                ; xBP - xCB*4 - 20h
 
 %ifndef TMPL_CMN_PAGING
@@ -131,5 +132,5 @@
         ; turned out the 386SX and AMD 486DX-40 also sets bits 4 thru 15 when
         ; using SMSW.  So, nothing conclusive to distinguish 386 from 286, but
-        ; we've probably got a save 486+ detection here.
+        ; we've probably got a safe 486+ detection here.
         ;
         ;; @todo check if LOADALL can set any of the reserved bits on a 286 or 386.
@@ -138,4 +139,24 @@
         jz      .486plus
 
+        ;
+        ; The 286 stores 0xff in the high byte of the SIDT and SGDT base
+        ; address (since it only did 24-bit addressing and the top 8-bit was
+        ; reserved for the 386).  This test prays for no NMIs while we
+        ; potentially modify the SIDT base (not an issue for bs3kit).
+        ;
+        cli
+        mov     ax, 00ffh
+        sidt    [xBP - xCB*4 - 20h]
+        xchg    ah, [xBP - xCB*4 - 20h + 2 + 3]
+        cmp     ah, al
+        jne     .386plus
+%if 1
+        lidt    [xBP - xCB*4 - 20h]
+        sidt    [xBP - xCB*4 - 20h]
+        xchg    ah, [xBP - xCB*4 - 20h + 2 + 3]
+        lidt    [xBP - xCB*4 - 20h]
+        cmp     ah, al
+        jne     .386plus
+%else
         ;
         ; Detect 80286 by checking whether the IOPL and NT bits of EFLAGS can be
@@ -171,5 +192,5 @@
         ; by a flaky POPF implementation, we assume this isn't the case in our
         ; execution environment.
-
+%endif
 .is_286:
         mov     ax, BS3CPU_80286
@@ -301,4 +322,5 @@
         ; Epilogue.
         ;
+        add     xSP, 20h
         pop     xBX
         pop     xDX