Index: /trunk/include/iprt/x86.h
===================================================================
--- /trunk/include/iprt/x86.h	(revision 75915)
+++ /trunk/include/iprt/x86.h	(revision 75916)
@@ -936,5 +936,5 @@
 #define X86_DR6_RTM                         RT_BIT_32(16)
 /** Value of DR6 after powerup/reset. */
-#define X86_DR6_INIT_VAL                    UINT64_C(0xFFFF0FF0)
+#define X86_DR6_INIT_VAL                    UINT64_C(0xffff0ff0)
 /** Bits which must be 1s in DR6. */
 #define X86_DR6_RA1_MASK                    UINT64_C(0xffff0ff0)
Index: /trunk/src/VBox/VMM/VMMAll/IEMAllCImplVmxInstr.cpp.h
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/IEMAllCImplVmxInstr.cpp.h	(revision 75915)
+++ /trunk/src/VBox/VMM/VMMAll/IEMAllCImplVmxInstr.cpp.h	(revision 75916)
@@ -1826,5 +1826,7 @@
     /* Nothing to do for SMI/enclave. We don't support enclaves or SMM yet. */
 
-    /* Pending debug exceptions. */
+    /*
+     * Pending debug exceptions.
+     */
     if (    uExitReason != VMX_EXIT_INIT_SIGNAL
         &&  uExitReason != VMX_EXIT_SMI
@@ -1835,4 +1837,20 @@
          *        block-by-MovSS is in effect. */
         pVmcs->u64GuestPendingDbgXcpt.u = 0;
+    }
+    else
+    {
+        /*
+         * Pending debug exception field is identical to DR6 except the RTM bit (16) which needs to be flipped.
+         * The "enabled breakpoint" bit (12) is not present in DR6, so we need to update it here.
+         *
+         * See Intel spec. 24.4.2 "Guest Non-Register State".
+         */
+        uint64_t       fPendingDbgMask = pVCpu->cpum.GstCtx.dr[6];
+        uint64_t const fBpHitMask = VMX_VMCS_GUEST_PENDING_DEBUG_XCPT_BP0 | VMX_VMCS_GUEST_PENDING_DEBUG_XCPT_BP1
+                                  | VMX_VMCS_GUEST_PENDING_DEBUG_XCPT_BP2 | VMX_VMCS_GUEST_PENDING_DEBUG_XCPT_BP3;
+        if (fPendingDbgMask & fBpHitMask)
+            fPendingDbgMask |= VMX_VMCS_GUEST_PENDING_DEBUG_XCPT_EN_BP;
+        fPendingDbgMask ^= VMX_VMCS_GUEST_PENDING_DEBUG_RTM;
+        pVmcs->u64GuestPendingDbgXcpt.u = fPendingDbgMask;
     }