Index: /trunk/src/VBox/VMM/VMMAll/CPUMAllRegs.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/CPUMAllRegs.cpp	(revision 69818)
+++ /trunk/src/VBox/VMM/VMMAll/CPUMAllRegs.cpp	(revision 69819)
@@ -2552,4 +2552,6 @@
  *
  * @param   pCtx        The guest-CPU context.
+ *
+ * @sa      hmR0SvmCanNstGstTakePhysIntr.
  */
 VMM_INT_DECL(bool) CPUMCanSvmNstGstTakePhysIntr(PCCPUMCTX pCtx)
@@ -2591,4 +2593,5 @@
 #else
     Assert(CPUMIsGuestInSvmNestedHwVirtMode(pCtx));
+    Assert(pCtx->hwvirt.svm.fGif);
 
     PCSVMVMCBCTRL pVmcbCtrl = &pCtx->hwvirt.svm.CTX_SUFF(pVmcb)->ctrl;
@@ -2598,7 +2601,4 @@
 
     if (!pCtx->rflags.Bits.u1IF)
-        return false;
-
-    if (!pCtx->hwvirt.svm.fGif)
         return false;
 
Index: /trunk/src/VBox/VMM/VMMR0/HMSVMR0.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR0/HMSVMR0.cpp	(revision 69818)
+++ /trunk/src/VBox/VMM/VMMR0/HMSVMR0.cpp	(revision 69819)
@@ -2737,4 +2737,5 @@
     {
         pCtx->cr2 = uFaultAddress;
+        /* The VMCB clean bit for CR2 will be updated while re-loading the guest state. */
         HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_CR2);
     }
@@ -3052,4 +3053,6 @@
  *          nested-guest VMCB which may have been suitably modified for executing
  *          using hardware-assisted SVM.
+ *
+ * @sa      CPUMCanSvmNstGstTakePhysIntr.
  */
 static bool hmR0SvmCanNstGstTakePhysIntr(PVMCPU pVCpu, PCCPUMCTX pCtx)
@@ -3179,6 +3182,6 @@
          * nested-guest VMCB interrupt control fields besides V_INTR_MASKING, see hmR0SvmVmRunCacheVmcb.
          */
-        if (   (pVmcbNstGstCache->u64InterceptCtrl & SVM_CTRL_INTERCEPT_VINTR)
-            && VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST)
+        if (   VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST)
+            && (pVmcbNstGstCache->u64InterceptCtrl & SVM_CTRL_INTERCEPT_VINTR)
             && CPUMCanSvmNstGstTakeVirtIntr(pCtx))
         {