Index: /trunk/src/VBox/VMM/VMMAll/APICAll.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/APICAll.cpp	(revision 85963)
+++ /trunk/src/VBox/VMM/VMMAll/APICAll.cpp	(revision 85964)
@@ -21,4 +21,5 @@
 *********************************************************************************************************************************/
 #define LOG_GROUP LOG_GROUP_DEV_APIC
+#define VMCPU_INCL_CPUM_GST_CTX /* for macOS hack */
 #include "APICInternal.h"
 #include <VBox/vmm/apic.h>
@@ -969,4 +970,6 @@
     PX2APICPAGE pX2ApicPage = VMCPU_TO_X2APICPAGE(pVCpu);
     uint32_t const fDest    = XAPIC_IN_X2APIC_MODE(pVCpu) ? pX2ApicPage->icr_hi.u32IcrHi : pXApicPage->icr_hi.u.u8Dest;
+    Log5(("apicSendIpi: delivery=%u mode=%u init=%u trigger=%u short=%u vector=%#x fDest=%#x\n",
+          enmDeliveryMode, enmDestMode, enmInitLevel, enmTriggerMode, enmDestShorthand, uVector, fDest));
 
 #if XAPIC_HARDWARE_VERSION == XAPIC_HARDWARE_VERSION_P4
@@ -1930,4 +1933,17 @@
             {
                 STAM_COUNTER_INC(&pVCpu->apic.s.StatIdMsrRead);
+                /* Horrible macOS hack (sample rdmsr addres: 0008:ffffff801686f21a). */
+                if (   !pApic->fMacOSWorkaround
+                    || pVCpu->cpum.GstCtx.cs.Sel != 8
+                    || pVCpu->cpum.GstCtx.rip < UINT64_C(0xffffff8000000000))
+                { /* likely */ }
+                else
+                {
+                    PCX2APICPAGE pX2ApicPage = VMCPU_TO_CX2APICPAGE(pVCpu);
+                    uint32_t const idApic = pX2ApicPage->id.u32ApicId;
+                    *pu64Value = (idApic << 24) | idApic;
+                    Log(("APIC: Applying macOS hack to MSR_IA32_X2APIC_ID: %#RX64\n", *pu64Value));
+                    break;
+                }
                 RT_FALL_THRU();
             }
Index: /trunk/src/VBox/VMM/VMMR3/APIC.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR3/APIC.cpp	(revision 85963)
+++ /trunk/src/VBox/VMM/VMMR3/APIC.cpp	(revision 85964)
@@ -1414,10 +1414,13 @@
      * Validate APIC settings.
      */
-    PDMDEV_VALIDATE_CONFIG_RETURN(pDevIns, "Mode|IOAPIC|NumCPUs", "");
-
+    PDMDEV_VALIDATE_CONFIG_RETURN(pDevIns, "Mode|IOAPIC|NumCPUs|MacOSWorkaround", "");
+
+    /** @devcfgm{apic, IOAPIC, bool, true}
+     * Indicates whether an I/O APIC is present in the system. */
     int rc = pHlp->pfnCFGMQueryBoolDef(pCfg, "IOAPIC", &pApic->fIoApicPresent, true);
     AssertLogRelRCReturn(rc, rc);
 
-    /* Max APIC feature level. */
+    /** @devcfgm{apic, Mode, PDMAPICMODE, APIC(2)}
+     * Max APIC feature level. */
     uint8_t uMaxMode;
     rc = pHlp->pfnCFGMQueryU8Def(pCfg, "Mode", &uMaxMode, PDMAPICMODE_APIC);
@@ -1434,4 +1437,16 @@
     }
     pApic->enmMaxMode = (PDMAPICMODE)uMaxMode;
+
+    /** @devcfgm{apic, MacOSWorkaround, bool, false}
+     * Enables a workaround for incorrect MSR_IA32_X2APIC_ID handling in macOS.
+     *
+     * Vital code in osfmk/i386/i386_init.c's vstart() routine incorrectly applies a
+     * 24 right shift to the ID register value (correct for legacy APIC, but
+     * entirely wrong for x2APIC), with the consequence that all CPUs use the same
+     * per-cpu data and things panic pretty quickly.   There are some shifty ID
+     * reads in lapic_native.c too, but they are for either harmless (assuming boot
+     * CPU has ID 0) or are for logging/debugging purposes only. */
+    rc = pHlp->pfnCFGMQueryBoolDef(pCfg, "MacOSWorkaround", &pApic->fMacOSWorkaround, false);
+    AssertLogRelRCReturn(rc, rc);
 
     /*
Index: /trunk/src/VBox/VMM/include/APICInternal.h
===================================================================
--- /trunk/src/VBox/VMM/include/APICInternal.h	(revision 85963)
+++ /trunk/src/VBox/VMM/include/APICInternal.h	(revision 85964)
@@ -940,6 +940,10 @@
     /** Whether Hyper-V x2APIC compatibility mode is enabled. */
     bool                        fHyperVCompatMode;
-    /** Alignment padding. */
-    bool                        afAlignment[1];
+    /** Enable horrible macOS workaround where the ID register has the value
+     * shifted up 24 bits to be compatible with buggy code in
+     * i386_init.c/vstart().  Only applied if we're in typical macOS 64-bit
+     * kernel load area and macOS kernel selector value (8), as we must not ever
+     * apply this to the EFI code. */
+    bool                        fMacOSWorkaround;
     /** The max supported APIC mode from CFGM.  */
     PDMAPICMODE                 enmMaxMode;