Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3-cpu-generated-1-template.c
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3-cpu-generated-1-template.c	(revision 66101)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3-cpu-generated-1-template.c	(revision 66102)
@@ -235,4 +235,5 @@
     /* [BS3CG1DST_OP4] = */     BS3CG1DSTSIZE_OPERAND,
     /* [BS3CG1DST_EFL] = */     4,
+    /* [BS3CG1DST_EFL_UNDEF]=*/ 4,
 
     /* [BS3CG1DST_AL] = */      1,
@@ -336,4 +337,5 @@
     /* [BS3CG1DST_OP4] = */     ~0U,
     /* [BS3CG1DST_EFL] = */     RT_OFFSETOF(BS3REGCTX, rflags),
+    /* [BS3CG1DST_EFL_UNDEF]=*/ ~0, /* special field */
 
     /* [BS3CG1DST_AL] = */      RT_OFFSETOF(BS3REGCTX, rax.u8),
@@ -633,11 +635,14 @@
  *
  * @returns Success indicator (true/false).
- * @param   pThis   The state.
- * @param   pCtx    The context.
- * @param   pHdr    The program header.
- * @param   off     The program offset relative to the end of the header.
- * @param   cb      The program size.
+ * @param   pThis       The state.
+ * @param   pCtx        The context.
+ * @param   pHdr        The program header.
+ * @param   off         The program offset relative to the end of the header.
+ * @param   cb          The program size.
+ * @param   pEflCtx     The context to take undefined EFLAGS from.  (This is NULL
+ *                      if we're processing a input context modifier program.)
  */
-static bool Bs3Cg1RunContextModifier(PBS3CG1STATE pThis, PBS3REGCTX pCtx, PCBS3CG1TESTHDR pHdr, unsigned off, unsigned cb)
+static bool Bs3Cg1RunContextModifier(PBS3CG1STATE pThis, PBS3REGCTX pCtx, PCBS3CG1TESTHDR pHdr, unsigned off, unsigned cb,
+                                     PCBS3REGCTX pEflCtx)
 {
     uint8_t const BS3_FAR *pbCode = (uint8_t const BS3_FAR *)(pHdr + 1) + off;
@@ -782,4 +787,15 @@
             if (offField < sizeof(BS3REGCTX))
                 PtrField.pu8 = (uint8_t BS3_FAR *)pCtx + offField;
+            /* Special field: Copying in undefined EFLAGS from the result context. */
+            else if (idxField == BS3CG1DST_EFL_UNDEF)
+            {
+                if (!pEflCtx || (bOpcode & BS3CG1_CTXOP_OPERATOR_MASK) != BS3CG1_CTXOP_ASSIGN)
+                {
+                    Bs3TestFailed("Invalid BS3CG1DST_EFL_UNDEF usage");
+                    return false;
+                }
+                PtrField.pu32 = &pCtx->rflags.u32;
+                uValue = (*PtrField.pu32 & ~(uint32_t)uValue) | (pEflCtx->rflags.u32 & (uint32_t)uValue);
+            }
             //@todo else if (idxField <= BS3CG1DST_OP4)
             //@todo {
@@ -1044,5 +1060,5 @@
                         This.Ctx.rip.u = BS3_FP_OFF(pbCode);
 
-                        if (Bs3Cg1RunContextModifier(&This, &This.Ctx, pHdr, pHdr->cbSelector, pHdr->cbInput))
+                        if (Bs3Cg1RunContextModifier(&This, &This.Ctx, pHdr, pHdr->cbSelector, pHdr->cbInput, NULL))
                         {
                             /* Run the instruction. */
@@ -1053,10 +1069,11 @@
 
                             /* Check the control exception result first. */
-                            if (   This.TrapFrame.bXcpt == (BS3_MODE_IS_PAGED(bMode) ? X86_XCPT_PF : X86_XCPT_UD)
+                            if (   This.TrapFrame.bXcpt     == (BS3_MODE_IS_PAGED(bMode) ? X86_XCPT_PF : X86_XCPT_UD)
                                 && This.TrapFrame.Ctx.rip.u == This.Ctx.rip.u + This.cbCurInstr)
                             {
                                 /* Apply output modifications and compare the contexts. */
                                 if (Bs3Cg1RunContextModifier(&This, &This.Ctx, pHdr,
-                                                             pHdr->cbSelector + pHdr->cbInput, pHdr->cbOutput))
+                                                             pHdr->cbSelector + pHdr->cbInput, pHdr->cbOutput,
+                                                             &This.TrapFrame.Ctx))
                                 {
                                     Bs3TestCheckRegCtxEx(&This.TrapFrame.Ctx, &This.Ctx, This.cbCurInstr,  0 /*cbSpAdjust*/,
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3-cpu-generated-1.h
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3-cpu-generated-1.h	(revision 66101)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3-cpu-generated-1.h	(revision 66102)
@@ -201,4 +201,5 @@
     /* Flags. */
     BS3CG1DST_EFL,
+    BS3CG1DST_EFL_UNDEF, /**< Special field only valid in output context modifiers: EFLAGS |= Value & Ouput.EFLAGS; */
     /* 8-bit GPRs. */
     BS3CG1DST_AL,