Index: /trunk/src/VBox/Devices/PC/DevPit-i8254.cpp
===================================================================
--- /trunk/src/VBox/Devices/PC/DevPit-i8254.cpp	(revision 71820)
+++ /trunk/src/VBox/Devices/PC/DevPit-i8254.cpp	(revision 71821)
@@ -659,4 +659,5 @@
         return VERR_IOM_IOPORT_UNUSED;
     }
+    RT_UNTRUSTED_VALIDATED_FENCE(); /* paranoia */
 
     PPITSTATE   pThis = PDMINS_2_DATA(pDevIns, PPITSTATE);
@@ -760,5 +761,6 @@
          *  . . . . . . . *  BCD/Binary mode: 0 = 16-bit binary, 1 = four-digit BCD
          */
-        unsigned channel = u32 >> 6;
+        unsigned channel = (u32 >> 6) & 0x3;
+        RT_UNTRUSTED_VALIDATED_FENCE(); /* paranoia */
         if (channel == 3)
         {
@@ -768,5 +770,6 @@
             {
                 PPITCHANNEL pChan = &pThis->channels[channel];
-                if (u32 & (2 << channel)) {
+                if (u32 & (2 << channel))
+                {
                     if (!(u32 & 0x20))
                         pit_latch_count(pChan);
@@ -777,7 +780,7 @@
                         PTMTIMER pTimer = pChan->CTX_SUFF(pPit)->channels[0].CTX_SUFF(pTimer);
                         pChan->status = (pit_get_out1(pChan, TMTimerGet(pTimer)) << 7)
-                            | (pChan->rw_mode << 4)
-                            | (pChan->mode << 1)
-                            | pChan->bcd;
+                                      | (pChan->rw_mode << 4)
+                                      | (pChan->mode << 1)
+                                      | pChan->bcd;
                         pChan->status_latched = 1;
                     }
@@ -820,4 +823,5 @@
          * Port 40-42h - Channel Data Ports.
          */
+        RT_UNTRUSTED_VALIDATED_FENCE(); /* paranoia */
         PPITCHANNEL pChan = &pThis->channels[uPort];
         DEVPIT_LOCK_BOTH_RETURN(pThis, VINF_IOM_R3_IOPORT_WRITE);