Index: /trunk/src/VBox/VMM/VMMR0/TMR0.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR0/TMR0.cpp	(revision 87795)
+++ /trunk/src/VBox/VMM/VMMR0/TMR0.cpp	(revision 87796)
@@ -76,4 +76,14 @@
 
 
+/**
+ * Grows the timer array for @a idxQueue to at least @a cMinTimers entries.
+ *
+ * @returns VBox status code.
+ * @param   pGVM            The ring-0 VM structure.
+ * @param   idxQueue        The index of the queue to grow.
+ * @param   cMinTimers      The minimum growth target.
+ * @thread  EMT
+ * @note    Caller must own the queue lock exclusively.
+ */
 VMMR0_INT_DECL(int) TMR0TimerQueueGrow(PGVM pGVM, uint32_t idxQueue, uint32_t cMinTimers)
 {
@@ -87,4 +97,7 @@
     PTMTIMERQUEUER0 pQueueR0     = &pGVM->tmr0.s.aTimerQueues[idxQueue];
     PTMTIMERQUEUE   pQueueShared = &pGVM->tm.s.aTimerQueues[idxQueue];
+    AssertMsgReturn(PDMCritSectRwIsWriteOwner(&pQueueShared->AllocLock),
+                    ("queue=%s %.*Rhxs\n", pQueueShared->szName, sizeof(pQueueShared->AllocLock), &pQueueShared->AllocLock),
+                    VERR_NOT_OWNER);
 
     uint32_t cNewTimers = cMinTimers;
Index: /trunk/src/VBox/VMM/VMMR3/TM.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR3/TM.cpp	(revision 87795)
+++ /trunk/src/VBox/VMM/VMMR3/TM.cpp	(revision 87796)
@@ -1129,8 +1129,10 @@
         if (s_aExtra[i].cExtra > pQueue->cTimersFree)
         {
+            PDMCritSectRwEnterExcl(&pQueue->AllocLock, VERR_IGNORED);
             uint32_t cTimersAlloc = pQueue->cTimersAlloc + s_aExtra[i].cExtra - pQueue->cTimersFree;
             rc = VMMR3CallR0Emt(pVM, VMMGetCpu(pVM), VMMR0_DO_TM_GROW_TIMER_QUEUE,
                                 RT_MAKE_U64(cTimersAlloc, s_aExtra[i].idxQueue), NULL);
             AssertLogRelMsgReturn(RT_SUCCESS(rc), ("rc=%Rrc cTimersAlloc=%u %s\n", rc, cTimersAlloc, pQueue->szName), rc);
+            PDMCritSectRwLeaveExcl(&pQueue->AllocLock);
         }
     }
@@ -1567,5 +1569,5 @@
  *
  * @param   pVM         The cross context VM structure.
- * @param   pTimer      The timer to register statistics for.
+ * @param   pQueue      The queue to register statistics for.
  * @param   cTimers     Number of timers to consider (in growth scenario).
  */