Index: /trunk/src/VBox/GuestHost/OpenGL/glapi_parser/apiutil.py
===================================================================
--- /trunk/src/VBox/GuestHost/OpenGL/glapi_parser/apiutil.py	(revision 78115)
+++ /trunk/src/VBox/GuestHost/OpenGL/glapi_parser/apiutil.py	(revision 78116)
@@ -558,4 +558,7 @@
 #======================================================================
 
+def _needPointerOrigin(name, type):
+	return type == 'const GLvoid *' and (name == 'pointer' or name == 'NULL');
+
 def MakeCallString(params):
 	"""Given a list of (name, type, vectorSize) parameters, make a C-style
@@ -575,4 +578,17 @@
 #enddef
 
+def MakeCallStringForDispatcher(params):
+	"""Same as MakeCallString, but with 'pointer' origin hack for bugref:9407."""
+	strResult = ''
+	fFirst    = True;
+	for (name, type, vecSize) in params:
+		if not fFirst:  strResult += ', ';
+		else:           fFirst     = False;
+		strResult += name;
+		if _needPointerOrigin(name, type):
+			if name != 'NULL': strResult += ', fRealPtr';
+			else:   		   strResult += ', 0 /*fRealPtr*/';
+	return strResult;
+
 
 def MakeDeclarationString(params):
@@ -596,4 +612,18 @@
 	#endif
 #enddef
+
+def MakeDeclarationStringForDispatcher(params):
+	"""Same as MakeDeclarationString, but with 'pointer' origin hack for bugref:9407."""
+	if len(params) == 0:
+		return 'void';
+	strResult = '';
+	fFirst    = True;
+	for (name, type, vecSize) in params:
+		if not fFirst:  strResult += ', ';
+		else:           fFirst     = False;
+		strResult = strResult + type + ' ' + name;
+		if _needPointerOrigin(name, type):
+			strResult = strResult + ' CRVBOX_HOST_ONLY_PARAM(int fRealPtr)';
+	return strResult;
 
 def MakeDeclarationStringWithContext(ctx_macro_prefix, params):
@@ -632,4 +662,18 @@
 	#endif
 #enddef
+
+def MakePrototypeStringForDispatcher(params):
+	"""Same as MakePrototypeString, but with 'pointer' origin hack for bugref:9407."""
+	if len(params) == 0:
+		return 'void'
+	strResult = ''
+	fFirst    = True;
+	for (name, type, vecSize) in params:
+		if not fFirst:  strResult += ', ';
+		else:           fFirst     = False;
+		strResult = strResult + type
+		if _needPointerOrigin(name, type):
+			strResult += ' CRVBOX_HOST_ONLY_PARAM(int)';
+	return strResult;
 
 
Index: /trunk/src/VBox/GuestHost/OpenGL/include/chromium.h
===================================================================
--- /trunk/src/VBox/GuestHost/OpenGL/include/chromium.h	(revision 78115)
+++ /trunk/src/VBox/GuestHost/OpenGL/include/chromium.h	(revision 78116)
@@ -138,4 +138,11 @@
 #ifndef APIENTRY
 #define APIENTRY
+#endif
+
+/** For the pointer hack, bugref:9407. */
+#ifdef IN_GUEST
+# define CRVBOX_HOST_ONLY_PARAM(a_Stuff)
+#else
+# define CRVBOX_HOST_ONLY_PARAM(a_Stuff)    , a_Stuff
 #endif
 
Index: /trunk/src/VBox/GuestHost/OpenGL/include/state/cr_client.h
===================================================================
--- /trunk/src/VBox/GuestHost/OpenGL/include/state/cr_client.h	(revision 78115)
+++ /trunk/src/VBox/GuestHost/OpenGL/include/state/cr_client.h	(revision 78116)
@@ -62,4 +62,7 @@
     GLboolean enabled;
     GLboolean normalized; /* Added with GL_ARB_vertex_program */
+# ifndef IN_GUEST
+    GLboolean fRealPtr;   /**< @bugref{9407} */
+# endif
     int bytesPerIndex;
 #ifdef CR_ARB_vertex_buffer_object
@@ -68,4 +71,7 @@
 #ifdef CR_EXT_compiled_vertex_array
     GLboolean locked;
+# ifndef IN_GUEST
+    GLboolean fPrevRealPtr; /**< @bugref{9407} */
+# endif
     unsigned char *prevPtr;
     GLint   prevStride;
Index: /trunk/src/VBox/GuestHost/OpenGL/spu_loader/dispatchheader.py
===================================================================
--- /trunk/src/VBox/GuestHost/OpenGL/spu_loader/dispatchheader.py	(revision 78115)
+++ /trunk/src/VBox/GuestHost/OpenGL/spu_loader/dispatchheader.py	(revision 78116)
@@ -45,5 +45,5 @@
 	params = apiutil.Parameters(func_name)
 
-	print('typedef %s (SPU_APIENTRY *%sFunc_t)(%s);' % (return_type, func_name, apiutil.MakePrototypeString(params)))
+	print('typedef %s (SPU_APIENTRY *%sFunc_t)(%s);' % (return_type, func_name, apiutil.MakePrototypeStringForDispatcher(params)))
 print('')
 
Index: /trunk/src/VBox/GuestHost/OpenGL/state_tracker/state_bufferobject.c
===================================================================
--- /trunk/src/VBox/GuestHost/OpenGL/state_tracker/state_bufferobject.c	(revision 78115)
+++ /trunk/src/VBox/GuestHost/OpenGL/state_tracker/state_bufferobject.c	(revision 78116)
@@ -1041,5 +1041,5 @@
         {
             diff_api.BindBufferARB(GL_ARRAY_BUFFER_ARB, cp->buffer->hwid);
-            diff_api.VertexPointer(cp->size, cp->type, cp->stride, cp->p);
+            diff_api.VertexPointer(cp->size, cp->type, cp->stride, cp->p CRVBOX_HOST_ONLY_PARAM(-1 /*fRealPtr*/));
         }
 
@@ -1048,5 +1048,5 @@
         {
             diff_api.BindBufferARB(GL_ARRAY_BUFFER_ARB, cp->buffer->hwid);
-            diff_api.ColorPointer(cp->size, cp->type, cp->stride, cp->p);
+            diff_api.ColorPointer(cp->size, cp->type, cp->stride, cp->p CRVBOX_HOST_ONLY_PARAM(-1 /*fRealPtr*/));
         }
 
@@ -1055,5 +1055,5 @@
         {
             diff_api.BindBufferARB(GL_ARRAY_BUFFER_ARB, cp->buffer->hwid);
-            diff_api.FogCoordPointerEXT(cp->type, cp->stride, cp->p);
+            diff_api.FogCoordPointerEXT(cp->type, cp->stride, cp->p CRVBOX_HOST_ONLY_PARAM(-1 /*fRealPtr*/));
         }
 
@@ -1062,5 +1062,5 @@
         {
             diff_api.BindBufferARB(GL_ARRAY_BUFFER_ARB, cp->buffer->hwid);
-            diff_api.SecondaryColorPointerEXT(cp->size, cp->type, cp->stride, cp->p);
+            diff_api.SecondaryColorPointerEXT(cp->size, cp->type, cp->stride, cp->p CRVBOX_HOST_ONLY_PARAM(-1 /*fRealPtr*/));
         }
 
@@ -1069,5 +1069,5 @@
         {
             diff_api.BindBufferARB(GL_ARRAY_BUFFER_ARB, cp->buffer->hwid);
-            diff_api.EdgeFlagPointer(cp->stride, cp->p);
+            diff_api.EdgeFlagPointer(cp->stride, cp->p CRVBOX_HOST_ONLY_PARAM(-1 /*fRealPtr*/));
         }
 
@@ -1076,5 +1076,5 @@
         {
             diff_api.BindBufferARB(GL_ARRAY_BUFFER_ARB, cp->buffer->hwid);
-            diff_api.IndexPointer(cp->type, cp->stride, cp->p);
+            diff_api.IndexPointer(cp->type, cp->stride, cp->p CRVBOX_HOST_ONLY_PARAM(-1 /*fRealPtr*/));
         }
 
@@ -1083,5 +1083,5 @@
         {
             diff_api.BindBufferARB(GL_ARRAY_BUFFER_ARB, cp->buffer->hwid);
-            diff_api.NormalPointer(cp->type, cp->stride, cp->p);
+            diff_api.NormalPointer(cp->type, cp->stride, cp->p CRVBOX_HOST_ONLY_PARAM(-1 /*fRealPtr*/));
         }
 
@@ -1094,5 +1094,5 @@
                     diff_api.ActiveTextureARB(i+GL_TEXTURE0_ARB);
                 diff_api.BindBufferARB(GL_ARRAY_BUFFER_ARB, cp->buffer->hwid);
-                diff_api.TexCoordPointer(cp->size, cp->type, cp->stride, cp->p);
+                diff_api.TexCoordPointer(cp->size, cp->type, cp->stride, cp->p CRVBOX_HOST_ONLY_PARAM(-1 /*fRealPtr*/));
             }
         }
@@ -1108,5 +1108,5 @@
             {
                 diff_api.BindBufferARB(GL_ARRAY_BUFFER_ARB, cp->buffer->hwid);
-                diff_api.VertexAttribPointerARB(i, cp->size, cp->type, cp->normalized, cp->stride, cp->p);
+                diff_api.VertexAttribPointerARB(i, cp->size, cp->type, cp->normalized, cp->stride, cp->p CRVBOX_HOST_ONLY_PARAM(-1 /*fRealPtr*/));
             }
         }
Index: /trunk/src/VBox/GuestHost/OpenGL/state_tracker/state_client.c
===================================================================
--- /trunk/src/VBox/GuestHost/OpenGL/state_tracker/state_client.c	(revision 78115)
+++ /trunk/src/VBox/GuestHost/OpenGL/state_tracker/state_client.c	(revision 78116)
@@ -73,10 +73,20 @@
 }
 
-static void crStateUnlockClientPointer(CRClientPointer* cp)
+static void crStateUnlockClientPointer(CRClientPointer* cp, int fFreePointer)
 {
     if (cp->locked)
     {
 #ifndef IN_GUEST
-        if (cp->p) crFree(cp->p);
+        if (cp->p && fFreePointer != 0)
+        {
+            if (cp->fRealPtr)
+            {
+                crFree(cp->p);
+                cp->fRealPtr = 0;
+            }
+            cp->p = NULL;
+        }
+#else
+        RT_NOREF(fFreePointer);
 #endif
         cp->locked = GL_FALSE;
@@ -92,18 +102,18 @@
         unsigned int i;
 
-        crStateUnlockClientPointer(&c->array.v);
-        crStateUnlockClientPointer(&c->array.c);
-        crStateUnlockClientPointer(&c->array.f);
-        crStateUnlockClientPointer(&c->array.s);
-        crStateUnlockClientPointer(&c->array.e);
-        crStateUnlockClientPointer(&c->array.i);
-        crStateUnlockClientPointer(&c->array.n);
+        crStateUnlockClientPointer(&c->array.v, 1 /*fFreePointer*/);
+        crStateUnlockClientPointer(&c->array.c, 1 /*fFreePointer*/);
+        crStateUnlockClientPointer(&c->array.f, 1 /*fFreePointer*/);
+        crStateUnlockClientPointer(&c->array.s, 1 /*fFreePointer*/);
+        crStateUnlockClientPointer(&c->array.e, 1 /*fFreePointer*/);
+        crStateUnlockClientPointer(&c->array.i, 1 /*fFreePointer*/);
+        crStateUnlockClientPointer(&c->array.n, 1 /*fFreePointer*/);
         for (i = 0 ; i < CR_MAX_TEXTURE_UNITS ; i++)
         {
-            crStateUnlockClientPointer(&c->array.t[i]);
+            crStateUnlockClientPointer(&c->array.t[i], 1 /*fFreePointer*/);
         }
         for (i = 0; i < CR_MAX_VERTEX_ATTRIBS; i++)
         {
-            crStateUnlockClientPointer(&c->array.a[i]);
+            crStateUnlockClientPointer(&c->array.a[i], 1 /*fFreePointer*/);
         }
     }
@@ -152,4 +162,7 @@
     c->array.v.stride = 0;
     c->array.v.enabled = 0;
+#ifndef IN_GUEST
+    c->array.v.fRealPtr = 0;
+#endif
 #ifdef CR_ARB_vertex_buffer_object
     c->array.v.buffer = ctx->bufferobject.arrayBuffer;
@@ -161,4 +174,7 @@
     c->array.v.prevPtr = NULL;
     c->array.v.prevStride = 0;
+# ifndef IN_GUEST
+    c->array.v.fPrevRealPtr = 0;
+# endif
 #endif
 
@@ -169,4 +185,7 @@
     c->array.c.stride = 0;
     c->array.c.enabled = 0;
+#ifndef IN_GUEST
+    c->array.c.fRealPtr = 0;
+#endif
 #ifdef CR_ARB_vertex_buffer_object
     c->array.c.buffer = ctx->bufferobject.arrayBuffer;
@@ -178,4 +197,7 @@
     c->array.c.prevPtr = NULL;
     c->array.c.prevStride = 0;
+# ifndef IN_GUEST
+    c->array.c.fPrevRealPtr = 0;
+# endif
 #endif
 
@@ -186,4 +208,7 @@
     c->array.f.stride = 0;
     c->array.f.enabled = 0;
+#ifndef IN_GUEST
+    c->array.f.fRealPtr = 0;
+#endif
 #ifdef CR_ARB_vertex_buffer_object
     c->array.f.buffer = ctx->bufferobject.arrayBuffer;
@@ -195,4 +220,7 @@
     c->array.f.prevPtr = NULL;
     c->array.f.prevStride = 0;
+# ifndef IN_GUEST
+    c->array.f.fPrevRealPtr = 0;
+# endif
 #endif
 
@@ -203,4 +231,7 @@
     c->array.s.stride = 0;
     c->array.s.enabled = 0;
+#ifndef IN_GUEST
+    c->array.s.fRealPtr = 0;
+#endif
 #ifdef CR_ARB_vertex_buffer_object
     c->array.s.buffer = ctx->bufferobject.arrayBuffer;
@@ -212,4 +243,7 @@
     c->array.s.prevPtr = NULL;
     c->array.s.prevStride = 0;
+# ifndef IN_GUEST
+    c->array.s.fPrevRealPtr = 0;
+# endif
 #endif
 
@@ -220,4 +254,7 @@
     c->array.e.stride = 0;
     c->array.e.enabled = 0;
+#ifndef IN_GUEST
+    c->array.e.fRealPtr = 0;
+#endif
 #ifdef CR_ARB_vertex_buffer_object
     c->array.e.buffer = ctx->bufferobject.arrayBuffer;
@@ -229,4 +266,7 @@
     c->array.e.prevPtr = NULL;
     c->array.e.prevStride = 0;
+# ifndef IN_GUEST
+    c->array.e.fPrevRealPtr = 0;
+# endif
 #endif
 
@@ -237,4 +277,7 @@
     c->array.i.stride = 0;
     c->array.i.enabled = 0;
+#ifndef IN_GUEST
+    c->array.i.fRealPtr = 0;
+#endif
 #ifdef CR_ARB_vertex_buffer_object
     c->array.i.buffer = ctx->bufferobject.arrayBuffer;
@@ -246,4 +289,7 @@
     c->array.i.prevPtr = NULL;
     c->array.i.prevStride = 0;
+# ifndef IN_GUEST
+    c->array.i.fPrevRealPtr = 0;
+# endif
 #endif
 
@@ -254,4 +300,7 @@
     c->array.n.stride = 0;
     c->array.n.enabled = 0;
+#ifndef IN_GUEST
+    c->array.n.fRealPtr = 0;
+#endif
 #ifdef CR_ARB_vertex_buffer_object
     c->array.n.buffer = ctx->bufferobject.arrayBuffer;
@@ -263,4 +312,7 @@
     c->array.n.prevPtr = NULL;
     c->array.n.prevStride = 0;
+# ifndef IN_GUEST
+    c->array.n.fPrevRealPtr = 0;
+# endif
 #endif
 
@@ -273,4 +325,7 @@
         c->array.t[i].stride = 0;
         c->array.t[i].enabled = 0;
+#ifndef IN_GUEST
+        c->array.t[i].fRealPtr = 0;
+#endif
 #ifdef CR_ARB_vertex_buffer_object
         c->array.t[i].buffer = ctx->bufferobject.arrayBuffer;
@@ -283,4 +338,7 @@
         c->array.t[i].prevStride = 0;
 #endif
+# ifndef IN_GUEST
+        c->array.t[i].fPrevRealPtr = 0;
+# endif
     }
 
@@ -292,4 +350,7 @@
         c->array.a[i].size = 4;
         c->array.a[i].stride = 0;
+# ifndef IN_GUEST
+        c->array.a[i].fRealPtr = 0;
+# endif
 #ifdef CR_ARB_vertex_buffer_object
         c->array.a[i].buffer = ctx->bufferobject.arrayBuffer;
@@ -301,4 +362,7 @@
         c->array.a[i].prevPtr = NULL;
         c->array.a[i].prevStride = 0;
+#  ifndef IN_GUEST
+        c->array.a[i].fPrevRealPtr = 0;
+#  endif
 #endif
     }
@@ -586,14 +650,23 @@
 
 static void
-crStateClientSetPointer(CRClientPointer *cp, GLint size, 
-                                                GLenum type, GLboolean normalized,
-                                                GLsizei stride, const GLvoid *pointer) 
+crStateClientSetPointer(CRClientPointer *cp, GLint size, GLenum type, GLboolean normalized, GLsizei stride,
+                        const GLvoid *pointer  CRVBOX_HOST_ONLY_PARAM(int fRealPtr))
 {
     CRContext *g = GetCurrentContext();
 
 #ifdef CR_EXT_compiled_vertex_array
-    crStateUnlockClientPointer(cp);
+    crStateUnlockClientPointer(cp, 0 /*fFreePointer*/);
+# ifndef IN_GUEST
+    if (cp->prevPtr && cp->fPrevRealPtr)
+    {
+        crFree(cp->prevPtr);
+        cp->fPrevRealPtr = 0;
+    }
+# endif
     cp->prevPtr = cp->p;
     cp->prevStride = cp->stride;
+# ifndef IN_GUEST
+    cp->fPrevRealPtr = cp->fRealPtr;
+# endif
 #endif
 
@@ -602,4 +675,7 @@
     cp->type = type;
     cp->normalized = normalized;
+#ifndef IN_GUEST
+    cp->fRealPtr = fRealPtr;
+#endif
 
     /* Calculate the bytes per index for address calculation */
@@ -653,6 +729,5 @@
 }
 
-void STATE_APIENTRY crStateVertexPointer(GLint size, GLenum type, 
-        GLsizei stride, const GLvoid *p) 
+void STATE_APIENTRY crStateVertexPointer(GLint size, GLenum type, GLsizei stride, const GLvoid *p CRVBOX_HOST_ONLY_PARAM(int fRealPtr))
 {
     CRContext *g = GetCurrentContext();
@@ -680,5 +755,5 @@
     }
 
-    crStateClientSetPointer(&(c->array.v), size, type, GL_FALSE, stride, p);
+    crStateClientSetPointer(&(c->array.v), size, type, GL_FALSE, stride, p CRVBOX_HOST_ONLY_PARAM(fRealPtr));
     DIRTY(cb->dirty, g->neg_bitid);
     DIRTY(cb->clientPointer, g->neg_bitid);
@@ -686,6 +761,5 @@
 }
 
-void STATE_APIENTRY crStateColorPointer(GLint size, GLenum type, 
-        GLsizei stride, const GLvoid *p) 
+void STATE_APIENTRY crStateColorPointer(GLint size, GLenum type, GLsizei stride, const GLvoid *p CRVBOX_HOST_ONLY_PARAM(int fRealPtr))
 {
     CRContext *g = GetCurrentContext();
@@ -715,5 +789,5 @@
     }
 
-    crStateClientSetPointer(&(c->array.c), size, type, GL_TRUE, stride, p);
+    crStateClientSetPointer(&(c->array.c), size, type, GL_TRUE, stride, p CRVBOX_HOST_ONLY_PARAM(fRealPtr));
     DIRTY(cb->dirty, g->neg_bitid);
     DIRTY(cb->clientPointer, g->neg_bitid);
@@ -721,6 +795,5 @@
 }
 
-void STATE_APIENTRY crStateSecondaryColorPointerEXT(GLint size,
-        GLenum type, GLsizei stride, const GLvoid *p)
+void STATE_APIENTRY crStateSecondaryColorPointerEXT(GLint size, GLenum type, GLsizei stride, const GLvoid *p CRVBOX_HOST_ONLY_PARAM(int fRealPtr))
 {
     CRContext *g = GetCurrentContext();
@@ -765,5 +838,5 @@
     }
 
-    crStateClientSetPointer(&(c->array.s), size, type, GL_TRUE, stride, p);
+    crStateClientSetPointer(&(c->array.s), size, type, GL_TRUE, stride, p CRVBOX_HOST_ONLY_PARAM(fRealPtr));
     DIRTY(cb->dirty, g->neg_bitid);
     DIRTY(cb->clientPointer, g->neg_bitid);
@@ -771,6 +844,5 @@
 }
 
-void STATE_APIENTRY crStateIndexPointer(GLenum type, GLsizei stride, 
-        const GLvoid *p) 
+void STATE_APIENTRY crStateIndexPointer(GLenum type, GLsizei stride, const GLvoid *p CRVBOX_HOST_ONLY_PARAM(int fRealPtr))
 {
     CRContext *g = GetCurrentContext();
@@ -793,5 +865,5 @@
     }
 
-    crStateClientSetPointer(&(c->array.i), 1, type, GL_TRUE, stride, p);
+    crStateClientSetPointer(&(c->array.i), 1, type, GL_TRUE, stride, p CRVBOX_HOST_ONLY_PARAM(fRealPtr));
     DIRTY(cb->dirty, g->neg_bitid);
     DIRTY(cb->clientPointer, g->neg_bitid);
@@ -799,6 +871,5 @@
 }
 
-void STATE_APIENTRY crStateNormalPointer(GLenum type, GLsizei stride, 
-        const GLvoid *p) 
+void STATE_APIENTRY crStateNormalPointer(GLenum type, GLsizei stride, const GLvoid *p CRVBOX_HOST_ONLY_PARAM(int fRealPtr))
 {
     CRContext *g = GetCurrentContext();
@@ -822,5 +893,5 @@
     }
 
-    crStateClientSetPointer(&(c->array.n), 3, type, GL_TRUE, stride, p);
+    crStateClientSetPointer(&(c->array.n), 3, type, GL_TRUE, stride, p CRVBOX_HOST_ONLY_PARAM(fRealPtr));
     DIRTY(cb->dirty, g->neg_bitid);
     DIRTY(cb->clientPointer, g->neg_bitid);
@@ -828,6 +899,5 @@
 }
 
-void STATE_APIENTRY crStateTexCoordPointer(GLint size, GLenum type, 
-        GLsizei stride, const GLvoid *p) 
+void STATE_APIENTRY crStateTexCoordPointer(GLint size, GLenum type, GLsizei stride, const GLvoid *p CRVBOX_HOST_ONLY_PARAM(int fRealPtr))
 {
     CRContext *g = GetCurrentContext();
@@ -855,5 +925,5 @@
     }
 
-    crStateClientSetPointer(&(c->array.t[c->curClientTextureUnit]), size, type, GL_FALSE, stride, p);
+    crStateClientSetPointer(&(c->array.t[c->curClientTextureUnit]), size, type, GL_FALSE, stride, p CRVBOX_HOST_ONLY_PARAM(fRealPtr));
     DIRTY(cb->dirty, g->neg_bitid);
     DIRTY(cb->clientPointer, g->neg_bitid);
@@ -861,5 +931,5 @@
 }
 
-void STATE_APIENTRY crStateEdgeFlagPointer(GLsizei stride, const GLvoid *p) 
+void STATE_APIENTRY crStateEdgeFlagPointer(GLsizei stride, const GLvoid *p CRVBOX_HOST_ONLY_PARAM(int fRealPtr))
 {
     CRContext *g = GetCurrentContext();
@@ -876,5 +946,5 @@
     }
 
-    crStateClientSetPointer(&(c->array.e), 1, GL_UNSIGNED_BYTE, GL_FALSE, stride, p);
+    crStateClientSetPointer(&(c->array.e), 1, GL_UNSIGNED_BYTE, GL_FALSE, stride, p CRVBOX_HOST_ONLY_PARAM(fRealPtr));
     DIRTY(cb->dirty, g->neg_bitid);
     DIRTY(cb->clientPointer, g->neg_bitid);
@@ -882,5 +952,5 @@
 }
 
-void STATE_APIENTRY crStateFogCoordPointerEXT(GLenum type, GLsizei stride, const GLvoid *p) 
+void STATE_APIENTRY crStateFogCoordPointerEXT(GLenum type, GLsizei stride, const GLvoid *p CRVBOX_HOST_ONLY_PARAM(int fRealPtr))
 {
     CRContext *g = GetCurrentContext();
@@ -905,5 +975,5 @@
     }
 
-    crStateClientSetPointer(&(c->array.f), 1, type, GL_FALSE, stride, p);
+    crStateClientSetPointer(&(c->array.f), 1, type, GL_FALSE, stride, p CRVBOX_HOST_ONLY_PARAM(fRealPtr));
     DIRTY(cb->dirty, g->neg_bitid);
     DIRTY(cb->clientPointer, g->neg_bitid);
@@ -912,5 +982,5 @@
 
 
-void STATE_APIENTRY crStateVertexAttribPointerNV(GLuint index, GLint size, GLenum type, GLsizei stride, const GLvoid *p) 
+void STATE_APIENTRY crStateVertexAttribPointerNV(GLuint index, GLint size, GLenum type, GLsizei stride, const GLvoid *p CRVBOX_HOST_ONLY_PARAM(int fRealPtr))
 {
     GLboolean normalized = GL_FALSE;
@@ -922,9 +992,10 @@
         return;
     }
-    crStateVertexAttribPointerARB(index, size, type, normalized, stride, p);
-}
-
-
-void STATE_APIENTRY crStateVertexAttribPointerARB(GLuint index, GLint size, GLenum type, GLboolean normalized, GLsizei stride, const GLvoid *p) 
+    crStateVertexAttribPointerARB(index, size, type, normalized, stride, p CRVBOX_HOST_ONLY_PARAM(fRealPtr));
+}
+
+
+void STATE_APIENTRY crStateVertexAttribPointerARB(GLuint index, GLint size, GLenum type, GLboolean normalized,
+                                                  GLsizei stride, const GLvoid *p CRVBOX_HOST_ONLY_PARAM(int fRealPtr))
 {
     CRContext *g = GetCurrentContext();
@@ -959,5 +1030,5 @@
     }
 
-    crStateClientSetPointer(&(c->array.a[index]), size, type, normalized, stride, p);
+    crStateClientSetPointer(&(c->array.a[index]), size, type, normalized, stride, p CRVBOX_HOST_ONLY_PARAM(fRealPtr));
     DIRTY(cb->dirty, g->neg_bitid);
     DIRTY(cb->clientPointer, g->neg_bitid);
@@ -1005,5 +1076,5 @@
 ** lets me use the same glDrawArrays method.
 */
-void STATE_APIENTRY crStateInterleavedArrays(GLenum format, GLsizei stride, const GLvoid *p) 
+void STATE_APIENTRY crStateInterleavedArrays(GLenum format, GLsizei stride, const GLvoid *p CRVBOX_HOST_ONLY_PARAM(int fRealPtr))
 {
     CRContext *g = GetCurrentContext();
@@ -1063,5 +1134,5 @@
 
 #ifdef CR_EXT_compiled_vertex_array
-    crStateUnlockClientPointer(cp);
+    crStateUnlockClientPointer(cp, 1 /*fFreePointer*/);
 #endif
 
@@ -1143,5 +1214,5 @@
     cp->stride = stride;
 #ifdef CR_EXT_compiled_vertex_array
-    crStateUnlockClientPointer(cp);
+    crStateUnlockClientPointer(cp, 1 /*fFreePointer*/);
 #endif
 
@@ -1194,5 +1265,5 @@
     cp->stride = stride;
 #ifdef CR_EXT_compiled_vertex_array
-    crStateUnlockClientPointer(cp);
+    crStateUnlockClientPointer(cp, 1 /*fFreePointer*/);
 #endif
 
@@ -1268,5 +1339,5 @@
     cp->stride = stride;
 #ifdef CR_EXT_compiled_vertex_array
-    crStateUnlockClientPointer(cp);
+    crStateUnlockClientPointer(cp, 1 /*fFreePointer*/);
 #endif
 
@@ -1464,5 +1535,5 @@
 static void crStateLockClientPointer(CRClientPointer* cp)
 {
-    crStateUnlockClientPointer(cp);
+    crStateUnlockClientPointer(cp, 1 /*fFreePointer*/);
     if (cp->enabled)
     {
@@ -1527,13 +1598,13 @@
     for (i=0; i<CRSTATECLIENT_MAX_VERTEXARRAYS; ++i)
     {
-        crStateUnlockClientPointer(crStateGetClientPointerByIndex(i, &c->array));
-    }
-}
-
-void STATE_APIENTRY crStateVertexArrayRangeNV(GLsizei length, const GLvoid *pointer)
+        crStateUnlockClientPointer(crStateGetClientPointerByIndex(i, &c->array), 1 /*fFreePointer*/);
+    }
+}
+
+void STATE_APIENTRY crStateVertexArrayRangeNV(GLsizei length, const GLvoid *pointer CRVBOX_HOST_ONLY_PARAM(int fRealPtr))
 {
   /* XXX todo */
     crWarning("crStateVertexArrayRangeNV not implemented");
-    (void)length; (void)pointer;
+    (void)length; (void)pointer CRVBOX_HOST_ONLY_PARAM((void)fRealPtr);
 }
 
@@ -1736,6 +1807,5 @@
                     idHwArrayBuffer = idHwArrayBufferUsed;
                 }
-                diff_api.VertexPointer(to->array.v.size, to->array.v.type,
-                                                             to->array.v.stride, to->array.v.p);
+                diff_api.VertexPointer(to->array.v.size, to->array.v.type, to->array.v.stride, to->array.v.p CRVBOX_HOST_ONLY_PARAM(to->array.v.fRealPtr));
                 from->array.v.size = to->array.v.size;
                 from->array.v.type = to->array.v.type;
@@ -1758,6 +1828,5 @@
                     idHwArrayBuffer = idHwArrayBufferUsed;
                 }
-                diff_api.NormalPointer(to->array.n.type,
-                                                             to->array.n.stride, to->array.n.p);
+                diff_api.NormalPointer(to->array.n.type, to->array.n.stride, to->array.n.p CRVBOX_HOST_ONLY_PARAM(to->array.n.fRealPtr));
                 from->array.n.type = to->array.n.type;
                 from->array.n.stride = to->array.n.stride;
@@ -1780,6 +1849,5 @@
                     idHwArrayBuffer = idHwArrayBufferUsed;
                 }
-                diff_api.ColorPointer(to->array.c.size, to->array.c.type,
-                                                            to->array.c.stride, to->array.c.p);
+                diff_api.ColorPointer(to->array.c.size, to->array.c.type, to->array.c.stride, to->array.c.p CRVBOX_HOST_ONLY_PARAM(to->array.c.fRealPtr));
                 from->array.c.size = to->array.c.size;
                 from->array.c.type = to->array.c.type;
@@ -1802,6 +1870,5 @@
                     idHwArrayBuffer = idHwArrayBufferUsed;
                 }
-                diff_api.IndexPointer(to->array.i.type,
-                                                            to->array.i.stride, to->array.i.p);
+                diff_api.IndexPointer(to->array.i.type, to->array.i.stride, to->array.i.p CRVBOX_HOST_ONLY_PARAM(to->array.i.fRealPtr));
                 from->array.i.type = to->array.i.type;
                 from->array.i.stride = to->array.i.stride;
@@ -1827,6 +1894,5 @@
                     diff_api.ClientActiveTextureARB(GL_TEXTURE0_ARB + i);
                     curClientTextureUnit = i;
-                    diff_api.TexCoordPointer(to->array.t[i].size, to->array.t[i].type,
-                                                                to->array.t[i].stride, to->array.t[i].p);
+                    diff_api.TexCoordPointer(to->array.t[i].size, to->array.t[i].type, to->array.t[i].stride, to->array.t[i].p CRVBOX_HOST_ONLY_PARAM(to->array.t[i].fRealPtr));
                     from->array.t[i].size = to->array.t[i].size;
                     from->array.t[i].type = to->array.t[i].type;
@@ -1849,5 +1915,5 @@
                     idHwArrayBuffer = idHwArrayBufferUsed;
                 }
-                diff_api.EdgeFlagPointer(to->array.e.stride, to->array.e.p);
+                diff_api.EdgeFlagPointer(to->array.e.stride, to->array.e.p CRVBOX_HOST_ONLY_PARAM(to->array.e.fRealPtr));
                 from->array.e.stride = to->array.e.stride;
                 from->array.e.p = to->array.e.p;
@@ -1869,6 +1935,5 @@
                     idHwArrayBuffer = idHwArrayBufferUsed;
                 }
-                diff_api.SecondaryColorPointerEXT(to->array.s.size, to->array.s.type,
-                                                                                    to->array.s.stride, to->array.s.p);
+                diff_api.SecondaryColorPointerEXT(to->array.s.size, to->array.s.type, to->array.s.stride, to->array.s.p CRVBOX_HOST_ONLY_PARAM(to->array.s.fRealPtr));
                 from->array.s.size = to->array.s.size;
                 from->array.s.type = to->array.s.type;
@@ -1891,6 +1956,5 @@
                     idHwArrayBuffer = idHwArrayBufferUsed;
                 }
-                diff_api.FogCoordPointerEXT(to->array.f.type,
-                                                                        to->array.f.stride, to->array.f.p);
+                diff_api.FogCoordPointerEXT(to->array.f.type, to->array.f.stride, to->array.f.p CRVBOX_HOST_ONLY_PARAM(to->array.f.fRealPtr));
                 from->array.f.type = to->array.f.type;
                 from->array.f.stride = to->array.f.stride;
@@ -1916,9 +1980,6 @@
                         idHwArrayBuffer = idHwArrayBufferUsed;
                     }
-                    diff_api.VertexAttribPointerARB(i, to->array.a[i].size,
-                                                                                    to->array.a[i].type,
-                                                                                    to->array.a[i].normalized,
-                                                                                    to->array.a[i].stride,
-                                                                                    to->array.a[i].p);
+                    diff_api.VertexAttribPointerARB(i, to->array.a[i].size, to->array.a[i].type, to->array.a[i].normalized,
+                                                    to->array.a[i].stride, to->array.a[i].p CRVBOX_HOST_ONLY_PARAM(to->array.a[i].fRealPtr));
                     from->array.a[i].size = to->array.a[i].size;
                     from->array.a[i].type = to->array.a[i].type;
@@ -2032,6 +2093,5 @@
                     idHwArrayBuffer = idHwArrayBufferUsed;
                 }
-                diff_api.VertexPointer(to->array.v.size, to->array.v.type,
-                                                             to->array.v.stride, to->array.v.p);
+                diff_api.VertexPointer(to->array.v.size, to->array.v.type, to->array.v.stride, to->array.v.p CRVBOX_HOST_ONLY_PARAM(to->array.v.fRealPtr));
                 FILLDIRTY(cb->v);
                 FILLDIRTY(cb->clientPointer);
@@ -2052,6 +2112,5 @@
                     idHwArrayBuffer = idHwArrayBufferUsed;
                 }
-                diff_api.NormalPointer(to->array.n.type,
-                                                             to->array.n.stride, to->array.n.p);
+                diff_api.NormalPointer(to->array.n.type, to->array.n.stride, to->array.n.p CRVBOX_HOST_ONLY_PARAM(to->array.n.fRealPtr));
                 FILLDIRTY(cb->n);
                 FILLDIRTY(cb->clientPointer);
@@ -2073,6 +2132,5 @@
                     idHwArrayBuffer = idHwArrayBufferUsed;
                 }
-                diff_api.ColorPointer(to->array.c.size, to->array.c.type,
-                                                            to->array.c.stride, to->array.c.p);
+                diff_api.ColorPointer(to->array.c.size, to->array.c.type, to->array.c.stride, to->array.c.p CRVBOX_HOST_ONLY_PARAM(to->array.c.fRealPtr));
                 FILLDIRTY(cb->c);
                 FILLDIRTY(cb->clientPointer);
@@ -2093,6 +2151,5 @@
                     idHwArrayBuffer = idHwArrayBufferUsed;
                 }
-                diff_api.IndexPointer(to->array.i.type,
-                                                            to->array.i.stride, to->array.i.p);
+                diff_api.IndexPointer(to->array.i.type, to->array.i.stride, to->array.i.p CRVBOX_HOST_ONLY_PARAM(to->array.i.fRealPtr));
                 FILLDIRTY(cb->i);
                 FILLDIRTY(cb->dirty);
@@ -2117,6 +2174,5 @@
                     diff_api.ClientActiveTextureARB(GL_TEXTURE0_ARB + i);
                     curClientTextureUnit = i;
-                    diff_api.TexCoordPointer(to->array.t[i].size, to->array.t[i].type,
-                                                                to->array.t[i].stride, to->array.t[i].p);
+                    diff_api.TexCoordPointer(to->array.t[i].size, to->array.t[i].type, to->array.t[i].stride, to->array.t[i].p CRVBOX_HOST_ONLY_PARAM(to->array.t[i].fRealPtr));
                     FILLDIRTY(cb->t[i]);
                     FILLDIRTY(cb->clientPointer);
@@ -2137,5 +2193,5 @@
                     idHwArrayBuffer = idHwArrayBufferUsed;
                 }
-                diff_api.EdgeFlagPointer(to->array.e.stride, to->array.e.p);
+                diff_api.EdgeFlagPointer(to->array.e.stride, to->array.e.p CRVBOX_HOST_ONLY_PARAM(to->array.e.fRealPtr));
                 FILLDIRTY(cb->e);
                 FILLDIRTY(cb->clientPointer);
@@ -2157,6 +2213,5 @@
                     idHwArrayBuffer = idHwArrayBufferUsed;
                 }
-                diff_api.SecondaryColorPointerEXT(to->array.s.size, to->array.s.type,
-                                                                                    to->array.s.stride, to->array.s.p);
+                diff_api.SecondaryColorPointerEXT(to->array.s.size, to->array.s.type, to->array.s.stride, to->array.s.p CRVBOX_HOST_ONLY_PARAM(to->array.s.fRealPtr));
                 FILLDIRTY(cb->s);
                 FILLDIRTY(cb->clientPointer);
@@ -2177,6 +2232,5 @@
                     idHwArrayBuffer = idHwArrayBufferUsed;
                 }
-                diff_api.FogCoordPointerEXT(to->array.f.type,
-                                                                        to->array.f.stride, to->array.f.p);
+                diff_api.FogCoordPointerEXT(to->array.f.type, to->array.f.stride, to->array.f.p CRVBOX_HOST_ONLY_PARAM(to->array.f.fRealPtr));
                 FILLDIRTY(cb->f);
                 FILLDIRTY(cb->clientPointer);
@@ -2201,9 +2255,6 @@
                         idHwArrayBuffer = idHwArrayBufferUsed;
                     }
-                    diff_api.VertexAttribPointerARB(i, to->array.a[i].size,
-                                                                                    to->array.a[i].type,
-                                                                                    to->array.a[i].normalized,
-                                                                                    to->array.a[i].stride,
-                                                                                    to->array.a[i].p);
+                    diff_api.VertexAttribPointerARB(i, to->array.a[i].size, to->array.a[i].type, to->array.a[i].normalized,
+                                                    to->array.a[i].stride, to->array.a[i].p  CRVBOX_HOST_ONLY_PARAM(to->array.a[i].fRealPtr));
                     FILLDIRTY(cb->a[i]);
                     FILLDIRTY(cb->clientPointer);
Index: /trunk/src/VBox/GuestHost/OpenGL/state_tracker/state_funcs.py
===================================================================
--- /trunk/src/VBox/GuestHost/OpenGL/state_tracker/state_funcs.py	(revision 78115)
+++ /trunk/src/VBox/GuestHost/OpenGL/state_tracker/state_funcs.py	(revision 78116)
@@ -41,15 +41,15 @@
 	return_type = apiutil.ReturnType(func_name)
 	params = apiutil.Parameters(func_name)
-	print('DECLEXPORT(%s) STATE_APIENTRY crState%s(%s);' % (return_type, func_name, apiutil.MakeDeclarationString(params)))
+	print('DECLEXPORT(%s) STATE_APIENTRY crState%s(%s);' % (return_type, func_name, apiutil.MakeDeclarationStringForDispatcher(params)))
 
 for func_name in apiutil.AllSpecials( "state_feedback" ):
 	return_type = apiutil.ReturnType(func_name)
 	params = apiutil.Parameters(func_name)
-	print('DECLEXPORT(%s) STATE_APIENTRY crStateFeedback%s(%s);' % (return_type, func_name, apiutil.MakeDeclarationString(params)))
+	print('DECLEXPORT(%s) STATE_APIENTRY crStateFeedback%s(%s);' % (return_type, func_name, apiutil.MakeDeclarationStringForDispatcher(params)))
 
 for func_name in apiutil.AllSpecials( "state_select" ):
 	return_type = apiutil.ReturnType(func_name)
 	params = apiutil.Parameters(func_name)
-	print('DECLEXPORT(%s) STATE_APIENTRY crStateSelect%s(%s);' % (return_type, func_name, apiutil.MakeDeclarationString(params)))
+	print('DECLEXPORT(%s) STATE_APIENTRY crStateSelect%s(%s);' % (return_type, func_name, apiutil.MakeDeclarationStringForDispatcher(params)))
 
 
Index: /trunk/src/VBox/GuestHost/OpenGL/state_tracker/state_snapshot.c
===================================================================
--- /trunk/src/VBox/GuestHost/OpenGL/state_tracker/state_snapshot.c	(revision 78115)
+++ /trunk/src/VBox/GuestHost/OpenGL/state_tracker/state_snapshot.c	(revision 78116)
@@ -1259,6 +1259,14 @@
     {
         CRASSERT(cp->p);
-        rc = SSMR3PutMem(pSSM, cp->p, cp->stride*(pArrays->lockFirst+pArrays->lockCount));
-        AssertRCReturn(rc, rc);
+        if (cp->fRealPtr)
+        {
+            rc = SSMR3PutMem(pSSM, cp->p, cp->stride*(pArrays->lockFirst+pArrays->lockCount));
+            AssertRCReturn(rc, rc);
+        }
+        else
+        {
+            crError("crStateSaveClientPointer: cp=%#p doesn't point to host memory!\n", cp);
+            return VERR_INVALID_STATE;
+        }
     }
 #endif
Index: /trunk/src/VBox/GuestHost/OpenGL/util/blitter.cpp
===================================================================
--- /trunk/src/VBox/GuestHost/OpenGL/util/blitter.cpp	(revision 78115)
+++ /trunk/src/VBox/GuestHost/OpenGL/util/blitter.cpp	(revision 78116)
@@ -767,8 +767,8 @@
 
         pBlitter->pDispatch->EnableClientState(GL_VERTEX_ARRAY);
-        pBlitter->pDispatch->VertexPointer(2, GL_FLOAT, 0, pVerticies);
+        pBlitter->pDispatch->VertexPointer(2, GL_FLOAT, 0, pVerticies CRVBOX_HOST_ONLY_PARAM(1 /*fRealPtr*/));
 
         pBlitter->pDispatch->EnableClientState(GL_TEXTURE_COORD_ARRAY);
-        pBlitter->pDispatch->TexCoordPointer(2, GL_FLOAT, 0, pTexCoords);
+        pBlitter->pDispatch->TexCoordPointer(2, GL_FLOAT, 0, pTexCoords CRVBOX_HOST_ONLY_PARAM(1 /*fRealPtr*/));
 
         pBlitter->pDispatch->Enable(pSrc->target);
@@ -795,8 +795,8 @@
 
         pBlitter->pDispatch->EnableClientState(GL_VERTEX_ARRAY);
-        pBlitter->pDispatch->VertexPointer(2, GL_FLOAT, 0, pVerticies);
+        pBlitter->pDispatch->VertexPointer(2, GL_FLOAT, 0, pVerticies CRVBOX_HOST_ONLY_PARAM(1 /*fRealPtr*/));
 
         pBlitter->pDispatch->EnableClientState(GL_TEXTURE_COORD_ARRAY);
-        pBlitter->pDispatch->TexCoordPointer(2, GL_FLOAT, 0, pTexCoords);
+        pBlitter->pDispatch->TexCoordPointer(2, GL_FLOAT, 0, pTexCoords CRVBOX_HOST_ONLY_PARAM(1 /*fRealPtr*/));
 
         pBlitter->pDispatch->Enable(pSrc->target);
Index: /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch.py
===================================================================
--- /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch.py	(revision 78115)
+++ /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch.py	(revision 78116)
@@ -35,8 +35,8 @@
     if wrap:
         print('#if defined(CR_%s)' % wrap)
-    print('void SERVER_DISPATCH_APIENTRY crServerDispatch%s(%s)' % ( func_name, apiutil.MakeDeclarationString( params ) ))
+    print('void SERVER_DISPATCH_APIENTRY crServerDispatch%s(%s)' % ( func_name, apiutil.MakeDeclarationStringForDispatcher( params ) ))
     print('{')
-    print('\tcrState%s(%s);' % (func_name, apiutil.MakeCallString( params ) ))
-    print('\tcr_server.head_spu->dispatch_table.%s(%s);' % (func_name, apiutil.MakeCallString( params ) ))
+    print('\tcrState%s(%s);' % (func_name, apiutil.MakeCallStringForDispatcher( params ) ))
+    print('\tcr_server.head_spu->dispatch_table.%s(%s);' % (func_name, apiutil.MakeCallStringForDispatcher( params ) ))
     print('}')
     if wrap:
@@ -109,5 +109,5 @@
         print('\t%s' % (condition))
         print('\t{')
-        print('\t\tcr_server.head_spu->dispatch_table.%s(%s);' % (func_name, apiutil.MakeCallString(params) ))
+        print('\t\tcr_server.head_spu->dispatch_table.%s(%s);' % (func_name, apiutil.MakeCallStringForDispatcher(params) ))
         print("\t\tcr_server.current.c.%s.%s%s = cr_unpackData;" % (name,type,array))
         print('\t}')
Index: /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch_header.py
===================================================================
--- /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch_header.py	(revision 78115)
+++ /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch_header.py	(revision 78116)
@@ -41,5 +41,5 @@
         return_type = apiutil.ReturnType(func_name)
         
-        print('%s SERVER_DISPATCH_APIENTRY crServerDispatch%s(%s);' % (return_type, func_name, apiutil.MakeDeclarationString( params )))
+        print('%s SERVER_DISPATCH_APIENTRY crServerDispatch%s(%s);' % (return_type, func_name, apiutil.MakeDeclarationStringForDispatcher( params )))
 
 print("""
Index: /trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack.py
===================================================================
--- /trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack.py	(revision 78115)
+++ /trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack.py	(revision 78116)
@@ -122,5 +122,5 @@
     else:
         print("\t", end="")
-    print("cr_unpackDispatch.%s(%s);" % (func_name, apiutil.MakeCallString(params)))
+    print("cr_unpackDispatch.%s(%s);" % (func_name, apiutil.MakeCallStringForDispatcher(params)))
 
 
Index: /trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack_arrays.c
===================================================================
--- /trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack_arrays.c	(revision 78115)
+++ /trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack_arrays.c	(revision 78116)
@@ -26,5 +26,5 @@
     GLsizei stride = READ_DATA( 16, GLsizei );
     GLintptrARB pointer = (GLintptrARB) READ_DATA( 20, GLuint );
-    cr_unpackDispatch.VertexPointer( size, type, stride, (void *) pointer );
+    cr_unpackDispatch.VertexPointer( size, type, stride, (void *) pointer, false /*fRealPtr*/ );
 }
 
@@ -35,5 +35,5 @@
     GLsizei stride = READ_DATA( 16, GLsizei );
     GLintptrARB pointer = READ_DATA( 20, GLuint );
-    cr_unpackDispatch.TexCoordPointer( size, type, stride, (void *) pointer );
+    cr_unpackDispatch.TexCoordPointer( size, type, stride, (void *) pointer, false /*fRealPtr*/ );
 }
 
@@ -43,5 +43,5 @@
     GLsizei stride = READ_DATA( 12, GLsizei );
     GLintptrARB pointer = READ_DATA( 16, GLuint );
-    cr_unpackDispatch.NormalPointer( type, stride, (void *) pointer );
+    cr_unpackDispatch.NormalPointer( type, stride, (void *) pointer, false /*fRealPtr*/ );
 }
 
@@ -51,5 +51,5 @@
     GLsizei stride = READ_DATA( 12, GLsizei );
     GLintptrARB pointer = READ_DATA( 16, GLuint );
-    cr_unpackDispatch.IndexPointer( type, stride, (void *) pointer );
+    cr_unpackDispatch.IndexPointer( type, stride, (void *) pointer, false /*fRealPtr*/ );
 }
 
@@ -58,5 +58,5 @@
     GLsizei stride = READ_DATA( 8, GLsizei );
     GLintptrARB pointer = READ_DATA( 12, GLuint );
-    cr_unpackDispatch.EdgeFlagPointer( stride, (void *) pointer );
+    cr_unpackDispatch.EdgeFlagPointer( stride, (void *) pointer, false /*fRealPtr*/ );
 }
 
@@ -67,5 +67,5 @@
     GLsizei stride = READ_DATA( 16, GLsizei );
     GLintptrARB pointer = READ_DATA( 20, GLuint );
-    cr_unpackDispatch.ColorPointer( size, type, stride, (void *) pointer );
+    cr_unpackDispatch.ColorPointer( size, type, stride, (void *) pointer, false /*fRealPtr*/ );
 }
 
@@ -75,5 +75,5 @@
     GLsizei stride = READ_DATA( 12, GLsizei );
     GLintptrARB pointer = READ_DATA( 16, GLuint );
-    cr_unpackDispatch.FogCoordPointerEXT( type, stride, (void *) pointer );
+    cr_unpackDispatch.FogCoordPointerEXT( type, stride, (void *) pointer, false /*fRealPtr*/ );
 }
 
@@ -84,5 +84,5 @@
     GLsizei stride = READ_DATA( 16, GLsizei );
     GLintptrARB pointer = READ_DATA( 20, GLuint );
-    cr_unpackDispatch.SecondaryColorPointerEXT( size, type, stride, (void *) pointer );
+    cr_unpackDispatch.SecondaryColorPointerEXT( size, type, stride, (void *) pointer, false /*fRealPtr*/ );
 }
 
@@ -95,5 +95,5 @@
     GLsizei stride = READ_DATA( 24, GLsizei );
     GLintptrARB pointer = READ_DATA( 28, GLuint );
-    cr_unpackDispatch.VertexAttribPointerARB( index, size, type, normalized, stride, (void *) pointer );
+    cr_unpackDispatch.VertexAttribPointerARB( index, size, type, normalized, stride, (void *) pointer, false /*fRealPtr*/ );
 }
 
@@ -105,5 +105,5 @@
     GLsizei stride = READ_DATA( 20, GLsizei );
     GLintptrARB pointer = READ_DATA( 24, GLuint );
-    cr_unpackDispatch.VertexAttribPointerNV( index, size, type, stride, (void *) pointer );
+    cr_unpackDispatch.VertexAttribPointerNV( index, size, type, stride, (void *) pointer, false /*fRealPtr*/ );
 }
 
@@ -113,5 +113,5 @@
     GLsizei stride = READ_DATA( 12, GLsizei );
     GLintptrARB pointer = READ_DATA( 16, GLuint );
-    cr_unpackDispatch.InterleavedArrays( format, stride, (void *) pointer );
+    cr_unpackDispatch.InterleavedArrays( format, stride, (void *) pointer, false /*fRealPtr*/ );
 }
 
@@ -162,5 +162,5 @@
 static void crUnpackSetClientPointerByIndex(int index, GLint size, 
                                             GLenum type, GLboolean normalized,
-                                            GLsizei stride, const GLvoid *pointer, CRClientState *c)
+                                            GLsizei stride, const GLvoid *pointer, CRClientState *c, int fRealPtr)
 {
     /*crDebug("crUnpackSetClientPointerByIndex: %i(s=%i, t=0x%x, n=%i, str=%i) -> %p", index, size, type, normalized, stride, pointer);*/
@@ -171,23 +171,23 @@
         {
             case 0:
-                cr_unpackDispatch.VertexPointer(size, type, stride, pointer);
+                cr_unpackDispatch.VertexPointer(size, type, stride, pointer, fRealPtr);
                 break;
             case 1:
-                cr_unpackDispatch.ColorPointer(size, type, stride, pointer);
+                cr_unpackDispatch.ColorPointer(size, type, stride, pointer, fRealPtr);
                 break;
             case 2:
-                cr_unpackDispatch.FogCoordPointerEXT(type, stride, pointer);
+                cr_unpackDispatch.FogCoordPointerEXT(type, stride, pointer, fRealPtr);
                 break;
             case 3:
-                cr_unpackDispatch.SecondaryColorPointerEXT(size, type, stride, pointer);
+                cr_unpackDispatch.SecondaryColorPointerEXT(size, type, stride, pointer, fRealPtr);
                 break;
             case 4:
-                cr_unpackDispatch.EdgeFlagPointer(stride, pointer);
+                cr_unpackDispatch.EdgeFlagPointer(stride, pointer, fRealPtr);
                 break;
             case 5:
-                cr_unpackDispatch.IndexPointer(type, stride, pointer);
+                cr_unpackDispatch.IndexPointer(type, stride, pointer, fRealPtr);
                 break;
             case 6:
-                cr_unpackDispatch.NormalPointer(type, stride, pointer);
+                cr_unpackDispatch.NormalPointer(type, stride, pointer, fRealPtr);
                 break;
         }
@@ -200,5 +200,5 @@
             cr_unpackDispatch.ClientActiveTextureARB(GL_TEXTURE0_ARB+index-7);
         }
-        cr_unpackDispatch.TexCoordPointer(size, type, stride, pointer);
+        cr_unpackDispatch.TexCoordPointer(size, type, stride, pointer, fRealPtr);
         if ((index-7)!=curTexUnit)
         {
@@ -209,5 +209,5 @@
     {
         cr_unpackDispatch.VertexAttribPointerARB(index-7-CR_MAX_TEXTURE_UNITS,
-                                                 size, type, normalized, stride, pointer);
+                                                 size, type, normalized, stride, pointer, fRealPtr);
     }
 }
@@ -265,5 +265,5 @@
                 /*crDebug("crUnpackExtendLockArraysEXT: old cp(%i): en/l=%i(%i) p=%p size=%i type=0x%x n=%i str=%i pp=%p pstr=%i",
                         index, cp->enabled, cp->locked, cp->p, cp->size, cp->type, cp->normalized, cp->stride, cp->prevPtr, cp->prevStride);*/
-                crUnpackSetClientPointerByIndex(index, cp->size, cp->type, cp->normalized, 0, data, c);
+                crUnpackSetClientPointerByIndex(index, cp->size, cp->type, cp->normalized, 0, data, c, 1 /*fRealPtr*/);
                 /*crDebug("crUnpackExtendLockArraysEXT: new cp(%i): en/l=%i(%i) p=%p size=%i type=0x%x n=%i str=%i pp=%p pstr=%i",
                         index, cp->enabled, cp->locked, cp->p, cp->size, cp->type, cp->normalized, cp->stride, cp->prevPtr, cp->prevStride);*/
@@ -305,5 +305,9 @@
             /*crDebug("crUnpackExtendUnlockArraysEXT: old cp(%i): en/l=%i(%i) p=%p size=%i type=0x%x n=%i str=%i pp=%p pstr=%i",
                     i, cp->enabled, cp->locked, cp->p, cp->size, cp->type, cp->normalized, cp->stride, cp->prevPtr, cp->prevStride);*/
-            crUnpackSetClientPointerByIndex(i, cp->size, cp->type, cp->normalized, cp->prevStride, cp->prevPtr, c);
+            unsigned char *prevPtr = cp->prevPtr;
+            int fRealPtr = cp->fPrevRealPtr;
+            cp->prevPtr = NULL;
+            cp->fPrevRealPtr = 0;
+            crUnpackSetClientPointerByIndex(i, cp->size, cp->type, cp->normalized, cp->prevStride, prevPtr, c, cp->fPrevRealPtr);
             /*crDebug("crUnpackExtendUnlockArraysEXT: new cp(%i): en/l=%i(%i) p=%p size=%i type=0x%x n=%i str=%i pp=%p pstr=%i",
                     i, cp->enabled, cp->locked, cp->p, cp->size, cp->type, cp->normalized, cp->stride, cp->prevPtr, cp->prevStride);*/
