Index: /trunk/src/VBox/Devices/Graphics/DevVGA_VBVA.cpp
===================================================================
--- /trunk/src/VBox/Devices/Graphics/DevVGA_VBVA.cpp	(revision 71611)
+++ /trunk/src/VBox/Devices/Graphics/DevVGA_VBVA.cpp	(revision 71612)
@@ -2469,6 +2469,6 @@
             if (cbBuffer >= VBoxSHGSMIBufferHeaderSize() + sizeof(VBOXCMDVBVA_CTL))
             {
-                VBOXCMDVBVA_CTL RT_UNTRUSTED_VOLATILE_GUEST *pCtl;
-                pCtl = (VBOXCMDVBVA_CTL RT_UNTRUSTED_VOLATILE_GUEST *)VBoxSHGSMIBufferData((VBOXSHGSMIHEADER RT_UNTRUSTED_VOLATILE_GUEST *)pvBuffer);
+                VBOXCMDVBVA_CTL RT_UNTRUSTED_VOLATILE_GUEST *pCtl
+                    = (VBOXCMDVBVA_CTL RT_UNTRUSTED_VOLATILE_GUEST *)VBoxSHGSMIBufferData((VBOXSHGSMIHEADER RT_UNTRUSTED_VOLATILE_GUEST *)pvBuffer);
                 rc = vboxCmdVBVACmdCtl(pVGAState, pCtl, cbBuffer - VBoxSHGSMIBufferHeaderSize());
             }
@@ -2482,6 +2482,6 @@
             if (cbBuffer >= VBoxSHGSMIBufferHeaderSize() + sizeof(VBOXVDMACBUF_DR))
             {
-                VBOXVDMACBUF_DR RT_UNTRUSTED_VOLATILE_GUEST *pCmd;
-                pCmd = (VBOXVDMACBUF_DR RT_UNTRUSTED_VOLATILE_GUEST *)VBoxSHGSMIBufferData((VBOXSHGSMIHEADER RT_UNTRUSTED_VOLATILE_GUEST *)pvBuffer);
+                VBOXVDMACBUF_DR RT_UNTRUSTED_VOLATILE_GUEST *pCmd
+                    = (VBOXVDMACBUF_DR RT_UNTRUSTED_VOLATILE_GUEST *)VBoxSHGSMIBufferData((VBOXSHGSMIHEADER RT_UNTRUSTED_VOLATILE_GUEST *)pvBuffer);
                 vboxVDMACommand(pVGAState->pVdma, pCmd, cbBuffer - VBoxSHGSMIBufferHeaderSize());
                 rc = VINF_SUCCESS;
@@ -2494,6 +2494,6 @@
             if (cbBuffer >= VBoxSHGSMIBufferHeaderSize() + sizeof(VBOXVDMA_CTL))
             {
-                VBOXVDMA_CTL RT_UNTRUSTED_VOLATILE_GUEST *pCmd;
-                pCmd = (VBOXVDMA_CTL RT_UNTRUSTED_VOLATILE_GUEST *)VBoxSHGSMIBufferData((VBOXSHGSMIHEADER RT_UNTRUSTED_VOLATILE_GUEST *)pvBuffer);
+                VBOXVDMA_CTL RT_UNTRUSTED_VOLATILE_GUEST *pCmd
+                    = (VBOXVDMA_CTL RT_UNTRUSTED_VOLATILE_GUEST *)VBoxSHGSMIBufferData((VBOXSHGSMIHEADER RT_UNTRUSTED_VOLATILE_GUEST *)pvBuffer);
                 vboxVDMAControl(pVGAState->pVdma, pCmd, cbBuffer - VBoxSHGSMIBufferHeaderSize());
             }
Index: /trunk/src/VBox/Devices/Graphics/DevVGA_VDMA.cpp
===================================================================
--- /trunk/src/VBox/Devices/Graphics/DevVGA_VDMA.cpp	(revision 71611)
+++ /trunk/src/VBox/Devices/Graphics/DevVGA_VDMA.cpp	(revision 71612)
@@ -3730,20 +3730,25 @@
     RT_UNTRUSTED_NONVOLATILE_COPY_FENCE();
 
-    switch (uType)
-    {
-        case VBOXCMDVBVACTL_TYPE_3DCTL:
-            return vdmaVBVACtlGenericGuestSubmit(pVdma, VBVAEXHOSTCTL_TYPE_GHH_BE_OPAQUE, pCtl, cbCtl);
-
-        case VBOXCMDVBVACTL_TYPE_RESIZE:
-            return vdmaVBVACtlGenericGuestSubmit(pVdma, VBVAEXHOSTCTL_TYPE_GHH_RESIZE, pCtl, cbCtl);
-
-        case VBOXCMDVBVACTL_TYPE_ENABLE:
-            if (cbCtl == sizeof(VBOXCMDVBVA_CTL_ENABLE))
+    if (   uType == VBOXCMDVBVACTL_TYPE_3DCTL
+        || uType == VBOXCMDVBVACTL_TYPE_RESIZE
+        || uType == VBOXCMDVBVACTL_TYPE_ENABLE)
+    {
+        RT_UNTRUSTED_VALIDATED_FENCE();
+
+        switch (uType)
+        {
+            case VBOXCMDVBVACTL_TYPE_3DCTL:
+                return vdmaVBVACtlGenericGuestSubmit(pVdma, VBVAEXHOSTCTL_TYPE_GHH_BE_OPAQUE, pCtl, cbCtl);
+
+            case VBOXCMDVBVACTL_TYPE_RESIZE:
+                return vdmaVBVACtlGenericGuestSubmit(pVdma, VBVAEXHOSTCTL_TYPE_GHH_RESIZE, pCtl, cbCtl);
+
+            case VBOXCMDVBVACTL_TYPE_ENABLE:
+                ASSERT_GUEST_BREAK(cbCtl == sizeof(VBOXCMDVBVA_CTL_ENABLE));
                 return vdmaVBVACtlEnableDisableSubmit(pVdma, (VBOXCMDVBVA_CTL_ENABLE RT_UNTRUSTED_VOLATILE_GUEST *)pCtl);
-            WARN(("incorrect enable size\n"));
-            break;
-        default:
-            WARN(("unsupported type\n"));
-            break;
+
+            default:
+                AssertFailed();
+        }
     }