Index: /trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp.h
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp.h	(revision 65096)
+++ /trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp.h	(revision 65097)
@@ -2296,4 +2296,5 @@
             uNewOuterSs  = uPtrFrame.pu16[4];
         }
+        uPtrFrame.pu8 -= cbPop; /* Put uPtrFrame back the way it was. */
         rcStrict = iemMemStackPopDoneSpecial(pVCpu, uPtrFrame.pv);
         if (RT_LIKELY(rcStrict == VINF_SUCCESS))
@@ -2422,5 +2423,4 @@
 
         /* commit */
-        pCtx->rsp               = uNewRsp;
         if (enmEffOpSize == IEMMODE_16BIT)
             pCtx->rip           = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */