Index: /trunk/src/VBox/Devices/Network/DevE1000.cpp
===================================================================
--- /trunk/src/VBox/Devices/Network/DevE1000.cpp	(revision 71787)
+++ /trunk/src/VBox/Devices/Network/DevE1000.cpp	(revision 71788)
@@ -5880,4 +5880,5 @@
     if (index != -1)
     {
+        RT_UNTRUSTED_VALIDATED_FENCE(); /* paranoia because of port I/O. */
         if (g_aE1kRegMap[index].readable)
         {
@@ -5944,4 +5945,5 @@
     if (RT_LIKELY(idxReg != -1))
     {
+        RT_UNTRUSTED_VALIDATED_FENCE(); /* paranoia because of port I/O. */
         if (RT_UNLIKELY(g_aE1kRegMap[idxReg].readable))
         {
@@ -5990,4 +5992,5 @@
     if (RT_LIKELY(index != -1))
     {
+        RT_UNTRUSTED_VALIDATED_FENCE(); /* paranoia because of port I/O. */
         if (RT_LIKELY(g_aE1kRegMap[index].writable))
         {
Index: /trunk/src/VBox/Devices/Network/DevVirtioNet.cpp
===================================================================
--- /trunk/src/VBox/Devices/Network/DevVirtioNet.cpp	(revision 71787)
+++ /trunk/src/VBox/Devices/Network/DevVirtioNet.cpp	(revision 71788)
@@ -515,4 +515,11 @@
         STAM_COUNTER_INC(&pThis->StatRxOverflowWakeup);
         Log(("%s Waking up Out-of-RX-space semaphore\n",  INSTANCE(pThis)));
+/**
+ * @todo r=bird: We can wake stuff up from ring-0 too, see vmsvga, nvme,
+ *        buslogic, lsilogic, ata, ahci, xhci.  Also, please address similar
+ *        TODO in E1000.
+ *
+ *        The API Is SUPSem*, btw.
+ */
         RTSemEventSignal(pThis->hEventMoreRxDescAvail);
     }
@@ -587,4 +594,11 @@
     PVNETSTATE pThis = (PVNETSTATE)pvState;
     Log(("%s Driver became ready, waking up RX thread...\n", INSTANCE(pThis)));
+/**
+ * @todo r=bird: We can wake stuff up from ring-0 too, see vmsvga, nvme,
+ *        buslogic, lsilogic, ata, ahci, xhci.  Also, please address similar
+ *        TODO in E1000.
+ *
+ *        The API Is SUPSem*, btw.
+ */
 #ifdef IN_RING3
     vnetWakeupReceive(pThis->VPCI.CTX_SUFF(pDevIns));
@@ -1288,9 +1302,9 @@
     vpciSetWriteLed(&pThis->VPCI, true);
 
-    VQUEUEELEM elem;
     /*
      * Do not remove descriptors from available ring yet, try to allocate the
      * buffer first.
      */
+    VQUEUEELEM elem; /* This bugger is big! ~48KB on 64-bit hosts. */
     while (vqueuePeek(&pThis->VPCI, pQueue, &elem))
     {
@@ -1993,6 +2007,6 @@
 static DECLCALLBACK(int) vnetDestruct(PPDMDEVINS pDevIns)
 {
+    PDMDEV_CHECK_VERSIONS_RETURN_QUIET(pDevIns);
     PVNETSTATE pThis = PDMINS_2_DATA(pDevIns, PVNETSTATE);
-    PDMDEV_CHECK_VERSIONS_RETURN_QUIET(pDevIns);
 
     LogRel(("TxTimer stats (avg/min/max): %7d usec %7d usec %7d usec\n",
@@ -2018,7 +2032,7 @@
 static DECLCALLBACK(int) vnetConstruct(PPDMDEVINS pDevIns, int iInstance, PCFGMNODE pCfg)
 {
+    PDMDEV_CHECK_VERSIONS_RETURN(pDevIns);
     PVNETSTATE pThis = PDMINS_2_DATA(pDevIns, PVNETSTATE);
     int        rc;
-    PDMDEV_CHECK_VERSIONS_RETURN(pDevIns);
 
     /* Initialize the instance data suffiencently for the destructor not to blow up. */
@@ -2044,6 +2058,5 @@
      */
     if (!CFGMR3AreValuesValid(pCfg, "MAC\0" "CableConnected\0" "LineSpeed\0" "LinkUpDelay\0"))
-                    return PDMDEV_SET_ERROR(pDevIns, VERR_PDM_DEVINS_UNKNOWN_CFG_VALUES,
-                                            N_("Invalid configuration for VirtioNet device"));
+        return PDMDEV_SET_ERROR(pDevIns, VERR_PDM_DEVINS_UNKNOWN_CFG_VALUES, N_("Invalid configuration for VirtioNet device"));
 
     /* Get config params */
Index: /trunk/src/VBox/Devices/VirtIO/Virtio.cpp
===================================================================
--- /trunk/src/VBox/Devices/VirtIO/Virtio.cpp	(revision 71787)
+++ /trunk/src/VBox/Devices/VirtIO/Virtio.cpp	(revision 71788)
@@ -165,4 +165,5 @@
             break;
         }
+        RT_UNTRUSTED_VALIDATED_FENCE();
 
         vringReadDesc(pState, &pQueue->VRing, idx, &desc);
@@ -551,4 +552,6 @@
             u32 &= 0xFFFF;
             if (u32 < pState->nQueues)
+            {
+                RT_UNTRUSTED_VALIDATED_FENCE();
                 if (pState->Queues[u32].VRing.addrDescriptors)
                 {
@@ -563,4 +566,5 @@
                     Log(("%s The queue (#%d) being notified has not been initialized.\n",
                          INSTANCE(pState), u32));
+            }
             else
                 Log(("%s Invalid queue number (%d)\n", INSTANCE(pState), u32));
@@ -799,4 +803,9 @@
         else
             pState->nQueues = nQueues;
+        AssertLogRelMsgReturn(pState->nQueues <= VIRTIO_MAX_NQUEUES, ("%#x\n", pState->nQueues), VERR_SSM_LOAD_CONFIG_MISMATCH);
+        AssertLogRelMsgReturn(pState->uQueueSelector < pState->nQueues || (pState->nQueues == 0 && pState->uQueueSelector),
+                              ("uQueueSelector=%u nQueues=%u\n", pState->uQueueSelector, pState->nQueues),
+                              VERR_SSM_LOAD_CONFIG_MISMATCH);
+
         for (unsigned i = 0; i < pState->nQueues; i++)
         {
@@ -1010,2 +1019,3 @@
 
 #endif /* VBOX_DEVICE_STRUCT_TESTCASE */
+