Index: /trunk/src/VBox/VMM/VMMR0/GVMMR0.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR0/GVMMR0.cpp	(revision 67987)
+++ /trunk/src/VBox/VMM/VMMR0/GVMMR0.cpp	(revision 67988)
@@ -1226,14 +1226,4 @@
             gvmmR0CreateDestroyUnlock(pGVMM);
 
-            /** @todo this _must_ be the wrong place.   */
-            for (VMCPUID idCpu = 0; idCpu < pVM->cCpus; idCpu++)
-            {
-                /** @todo Can we busy wait here for all thread-context hooks to be
-                 *        deregistered before releasing (destroying) it? Only until we find a
-                 *        solution for not deregistering hooks everytime we're leaving HMR0
-                 *        context. */
-                VMMR0ThreadCtxHookDestroyForEmt(&pVM->aCpus[idCpu]);
-            }
-
             SUPR0ObjRelease(pvObj, pHandle->pSession);
         }
@@ -1277,4 +1267,14 @@
 
     GMMR0CleanupVM(pGVM);
+
+    AssertCompile((uintptr_t)NIL_RTTHREADCTXHOOK == 0); /* Depends on zero initialized memory working for NIL at the moment. */
+    for (VMCPUID idCpu = 0; idCpu < pGVM->cCpus; idCpu++)
+    {
+        /** @todo Can we busy wait here for all thread-context hooks to be
+         *        deregistered before releasing (destroying) it? Only until we find a
+         *        solution for not deregistering hooks everytime we're leaving HMR0
+         *        context. */
+        VMMR0ThreadCtxHookDestroyForEmt(&pGVM->pVM->aCpus[idCpu]);
+    }
 }