Index: /trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp.h
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp.h	(revision 61635)
+++ /trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp.h	(revision 61636)
@@ -1020,4 +1020,5 @@
 IEM_CIMPL_DEF_4(iemCImpl_BranchCallGate, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
 {
+#define IEM_IMPLEMENTS_CALLGATE
 #ifndef IEM_IMPLEMENTS_CALLGATE
     IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
@@ -1204,5 +1205,5 @@
         /* Calls are much more complicated. */
 
-        if (DescCS.Legacy.Gen.u2Dpl < pIemCpu->uCpl)
+        if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF) && (DescCS.Legacy.Gen.u2Dpl < pIemCpu->uCpl))
         {
             uint16_t    offNewStack;    /* Offset of new stack in TSS. */
@@ -1228,5 +1229,5 @@
 
             /* Figure out where the new stack pointer is stored in the TSS. */
-            uNewCSDpl = uNewCS & X86_SEL_RPL;
+            uNewCSDpl = DescCS.Legacy.Gen.u2Dpl;
             if (!IEM_IS_LONG_MODE(pIemCpu))
             {