Index: /trunk/src/VBox/Devices/Bus/DevIommuAmd.cpp
===================================================================
--- /trunk/src/VBox/Devices/Bus/DevIommuAmd.cpp	(revision 84235)
+++ /trunk/src/VBox/Devices/Bus/DevIommuAmd.cpp	(revision 84236)
@@ -4276,10 +4276,13 @@
                 /* Record the translated base address (before continuing to check permission bits of any subsequent pages). */
                 if (cbChecked == 0)
-                    *pGCPhysSpa = Iotlbe.GCPhysSpa;
+                {
+                    RTGCPHYS const offSpa = ~(UINT64_C(0xffffffffffffffff) << Iotlbe.cShift);
+                    *pGCPhysSpa = Iotlbe.GCPhysSpa | offSpa;
+                }
 
                 /** @todo IOMMU: Split large pages into 4K IOTLB entries and add to IOTLB cache. */
 
                 uint64_t const cbPhysPage = UINT64_C(1) << Iotlbe.cShift;
-                cbChecked += cbPhysPage;
+                cbChecked += cbPhysPage;        /** @todo IOMMU: We need to consider the offset here. */
                 if (cbChecked >= cbAccess)
                     break;