Index: /trunk/src/VBox/VMM/VMMAll/IEMAll.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/IEMAll.cpp	(revision 61639)
+++ /trunk/src/VBox/VMM/VMMAll/IEMAll.cpp	(revision 61640)
@@ -3536,4 +3536,5 @@
 
         /* Set the new CPL so that stack accesses use it. */
+        uint8_t const uOldCpl = pIemCpu->uCpl;
         pIemCpu->uCpl = uNewCpl;
 
@@ -3550,5 +3551,5 @@
                 *uStackFrame.pu32++ = uErr;
             uStackFrame.pu32[0] = (fFlags & IEM_XCPT_FLAGS_T_SOFT_INT) ? pCtx->eip + cbInstr : pCtx->eip;
-            uStackFrame.pu32[1] = (pCtx->cs.Sel & ~X86_SEL_RPL) | (pCtx->ss.Sel & X86_SEL_RPL);
+            uStackFrame.pu32[1] = (pCtx->cs.Sel & ~X86_SEL_RPL) | uOldCpl;
             uStackFrame.pu32[2] = fEfl;
             uStackFrame.pu32[3] = pCtx->esp;
@@ -3568,5 +3569,5 @@
                 *uStackFrame.pu16++ = uErr;
             uStackFrame.pu16[0] = (fFlags & IEM_XCPT_FLAGS_T_SOFT_INT) ? pCtx->ip + cbInstr : pCtx->ip;
-            uStackFrame.pu16[1] = (pCtx->cs.Sel & ~X86_SEL_RPL) | (pCtx->ss.Sel & X86_SEL_RPL);
+            uStackFrame.pu16[1] = (pCtx->cs.Sel & ~X86_SEL_RPL) | uOldCpl;
             uStackFrame.pu16[2] = fEfl;
             uStackFrame.pu16[3] = pCtx->sp;
@@ -3624,5 +3625,4 @@
         else
             pCtx->rsp           = uNewEsp - cbStackFrame;
-        pIemCpu->uCpl           = uNewCpl;
 
         if (fEfl & X86_EFL_VM)
@@ -3879,4 +3879,5 @@
      */
     /* Set the new CPL so that stack accesses use it. */
+    uint8_t const uOldCpl = pIemCpu->uCpl;
     pIemCpu->uCpl = uNewCpl;
 
@@ -3893,5 +3894,5 @@
         *uStackFrame.pu64++ = uErr;
     uStackFrame.pu64[0] = fFlags & IEM_XCPT_FLAGS_T_SOFT_INT ? pCtx->rip + cbInstr : pCtx->rip;
-    uStackFrame.pu64[1] = (pCtx->cs.Sel & ~X86_SEL_RPL) | pIemCpu->uCpl; /* CPL paranoia */
+    uStackFrame.pu64[1] = (pCtx->cs.Sel & ~X86_SEL_RPL) | uOldCpl; /* CPL paranoia */
     uStackFrame.pu64[2] = fEfl;
     uStackFrame.pu64[3] = pCtx->rsp;
@@ -3918,5 +3919,5 @@
     /** @todo research/testcase: Figure out what VT-x and AMD-V loads into the
      *        hidden registers when interrupting 32-bit or 16-bit code! */
-    if (uNewCpl != pIemCpu->uCpl)
+    if (uNewCpl != uOldCpl)
     {
         pCtx->ss.Sel        = 0 | uNewCpl;
@@ -3935,5 +3936,4 @@
     pCtx->cs.Attr.u     = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
     pCtx->rip           = uNewRip;
-    pIemCpu->uCpl       = uNewCpl;
 
     fEfl &= ~fEflToClear;