bs3kit: move real mode version of Bs3TestDoModes out of the default 16-bit code segment.

git-svn-id: https://www.virtualbox.org/svn/vbox/trunk@60557 cfe28804-0f27-0410-a406-dd0f0b0b656f

39 files changed, 862 insertions, 219 deletions

diff --git a/src/VBox/ValidationKit/bootsectors/bs3kit/Makefile.kmk b/src/VBox/ValidationKit/bootsectors/bs3kit/Makefile.kmk
index d9fbb0d19d7..5584b976769 100644
--- a/src/VBox/ValidationKit/bootsectors/bs3kit/Makefile.kmk
+++ b/src/VBox/ValidationKit/bootsectors/bs3kit/Makefile.kmk
@@ -218,7 +218,6 @@ bs3kit-common-16_VBOX_NEAR_TO_FAR_FUNCTIONS := \
        Bs3Trap16InitEx \
 
 bs3kit-common-16_VBOX_NEAR_TO_FAR_MODE_FUNCTIONS := \
-	Bs3TestDoModes \
 	Bs3TrapInit \
 
 $(call BS3KIT_FN_GEN_NEARSTUBS,bs3kit-common-16,$(bs3kit-common-16_VBOX_NEAR_TO_FAR_FUNCTIONS))
@@ -231,6 +230,7 @@ bs3kit-common-32_INSTTYPE = none
 bs3kit-common-32_DEFS     = TMPL_PE32 BS3_CMN_ONLY
 bs3kit-common-32_ASDEFS   = RT_ASMDEFS_INC_FIRST_FILE
 bs3kit-common-32_SOURCES  = $(VBOX_BS3KIT_COMMON_SOURCES) \
+       bs3-cmn-SwitchHlpConvFlatRetToRetfProtMode.asm \
 	bs3-cmn-UInt64Div.c \
 	bs3-wc32-U8D.asm \
 	bs3-wc32-I8D.asm \
@@ -246,6 +246,7 @@ bs3kit-common-64_INSTTYPE = none
 bs3kit-common-64_DEFS     = TMPL_LM64 BS3_CMN_ONLY
 bs3kit-common-64_ASDEFS   = RT_ASMDEFS_INC_FIRST_FILE
 bs3kit-common-64_SOURCES  = $(VBOX_BS3KIT_COMMON_SOURCES) \
+       bs3-cmn-SwitchHlpConvFlatRetToRetfProtMode.asm \
        bs3-c64-Trap64Generic.asm \
        ../../../Runtime/common/asm/ASMGetIDTR.asm \
        ../../../Runtime/common/asm/ASMSetIDTR.asm \
diff --git a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-SelFlatCodeToRealMode.asm b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-SelFlatCodeToRealMode.asm
index 0d57e71981b..ff2ec398b0a 100644
--- a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-SelFlatCodeToRealMode.asm
+++ b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-SelFlatCodeToRealMode.asm
@@ -34,14 +34,16 @@
 ;*********************************************************************************************************************************
 ;*      Global Variables                                                                                                         *
 ;*********************************************************************************************************************************
-extern Bs3X0Text16_EndOfSegment
-extern Bs3X1Text16_EndOfSegment
+BS3_EXTERN_DATA16 Bs3RmText16_EndOfSegment
+BS3_EXTERN_DATA16 Bs3X0Text16_EndOfSegment
+BS3_EXTERN_DATA16 Bs3X1Text16_EndOfSegment
 
 
 ;
 ; Make sure we can get at all the segments.
 ;
 BS3_BEGIN_TEXT16
+BS3_BEGIN_RMTEXT16
 BS3_BEGIN_X0TEXT16
 BS3_BEGIN_X1TEXT16
 TMPL_BEGIN_TEXT
@@ -76,12 +78,20 @@ BS3_PROC_BEGIN_CMN Bs3SelFlatCodeToRealMode, BS3_PBC_NEAR
         or      dl, al                                  ; dx =  0x5432
 
         mov     ax, dx
-        sub     ax, BS3TEXT16
+        sub     ax, CGROUP16
         cmp     ax, 1000h
         jb      .bs3text16
 
         mov     ax, dx
-        sub     ax, BS3X0TEXT16
+        sub     ax, BS3GROUPRMTEXT16
+        mov     bx, Bs3RmText16_EndOfSegment wrt BS3GROUPRMTEXT16
+        add     bx, 15
+        shr     bx, cl
+        cmp     ax, bx
+        jb      .bs3rmtext16
+
+        mov     ax, dx
+        sub     ax, BS3GROUPX0TEXT16
         mov     bx, Bs3X0Text16_EndOfSegment wrt BS3GROUPX0TEXT16
         add     bx, 15
         shr     bx, cl
@@ -89,7 +99,7 @@ BS3_PROC_BEGIN_CMN Bs3SelFlatCodeToRealMode, BS3_PBC_NEAR
         jb      .bs3x0text16
 
         mov     ax, dx
-        sub     ax, BS3X1TEXT16
+        sub     ax, BS3GROUPX1TEXT16
         mov     bx, Bs3X1Text16_EndOfSegment wrt BS3GROUPX1TEXT16
         add     bx, 15
         shr     bx, cl
@@ -103,13 +113,16 @@ BS3_PROC_BEGIN_CMN Bs3SelFlatCodeToRealMode, BS3_PBC_NEAR
         ; Load the real-mode frame into DX and calc the offset in AX.
         ;
 .bs3x1text16:
-        mov     dx, BS3X1TEXT16
+        mov     dx, BS3GROUPX1TEXT16
         jmp     .calc_return
 .bs3x0text16:
-        mov     dx, BS3X0TEXT16
+        mov     dx, BS3GROUPX0TEXT16
+        jmp     .calc_return
+.bs3rmtext16:
+        mov     dx, BS3GROUPRMTEXT16
         jmp     .calc_return
 .bs3text16:
-        mov     dx, BS3X0TEXT16
+        mov     dx, CGROUP16
 .calc_return:
         ; Convert the real-mode frame into the low 16-bit base (BX).
         mov     bx, dx
diff --git a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-SelProtModeCodeToRealMode.asm b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-SelProtModeCodeToRealMode.asm
index 9b5e5553840..9196c3d4f88 100644
--- a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-SelProtModeCodeToRealMode.asm
+++ b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-SelProtModeCodeToRealMode.asm
@@ -30,6 +30,7 @@
 ; Make sure we can get at all the segments.
 ;
 BS3_BEGIN_TEXT16
+BS3_BEGIN_RMTEXT16
 BS3_BEGIN_X0TEXT16
 BS3_BEGIN_X1TEXT16
 TMPL_BEGIN_TEXT
@@ -49,12 +50,14 @@ BS3_PROC_BEGIN_CMN Bs3SelProtModeCodeToRealMode, BS3_PBC_NEAR
         and     ax, X86_SEL_MASK_OFF_RPL
 
         ; We're allowed to use the real-mode segment value.
-        cmp     ax, BS3TEXT16
+        cmp     ax, CGROUP16
         je      .bs3text16
 
         ; Check for typical code segments.
         cmp     ax, BS3_SEL_R0_CS16
         je      .bs3text16
+        cmp     ax, BS3_SEL_RMTEXT16_CS
+        je      .bs3rmtext16
         cmp     ax, BS3_SEL_X0TEXT16_CS
         je      .bs3x0text16
         cmp     ax, BS3_SEL_X1TEXT16_CS
@@ -80,18 +83,22 @@ AssertCompile(BS3_SEL_RING_SHIFT == 8)
         cmp     ax, BS3_SEL_R0_CS16_CNF_EO & 0xff
         je      .bs3text16
 .panic:
+hlt
         extern  BS3_CMN_NM(Bs3Panic)
         call    BS3_CMN_NM(Bs3Panic)
         jmp     .return
 
 .bs3x1text16:
-        mov     ax, BS3_SEL_X1TEXT16_CS
+        mov     ax, BS3GROUPX1TEXT16
         jmp     .return
 .bs3x0text16:
-        mov     ax, BS3_SEL_X0TEXT16_CS
+        mov     ax, BS3GROUPX0TEXT16
+        jmp     .return
+.bs3rmtext16:
+        mov     ax, BS3GROUPRMTEXT16
         jmp     .return
 .bs3text16:
-        mov     ax, BS3TEXT16
+        mov     ax, CGROUP16
 .return:
         pop     xBP
         BS3_CALL_CONV_EPILOG 1
diff --git a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-SelRealModeCodeToProtMode.asm b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-SelRealModeCodeToProtMode.asm
index 63e0b81108c..74af32657cd 100644
--- a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-SelRealModeCodeToProtMode.asm
+++ b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-SelRealModeCodeToProtMode.asm
@@ -30,6 +30,7 @@
 ; Make sure we can get at all the segments.
 ;
 BS3_BEGIN_TEXT16
+BS3_BEGIN_RMTEXT16
 BS3_BEGIN_X0TEXT16
 BS3_BEGIN_X1TEXT16
 TMPL_BEGIN_TEXT
@@ -45,12 +46,15 @@ BS3_PROC_BEGIN_CMN Bs3SelRealModeCodeToProtMode, BS3_PBC_NEAR
         mov     xBP, xSP
 
         mov     ax, [xBP + xCB + cbCurRetAddr]
-        cmp     ax, BS3TEXT16
+        cmp     ax, CGROUP16
         je      .bs3text16
-        cmp     ax, BS3X0TEXT16
+        cmp     ax, BS3GROUPRMTEXT16
+        je      .bs3rmtext16
+        cmp     ax, BS3GROUPX0TEXT16
         je      .bs3x0text16
-        cmp     ax, BS3X1TEXT16
+        cmp     ax, BS3GROUPX1TEXT16
         je      .bs3x1text16
+
         extern  BS3_CMN_NM(Bs3Panic)
         call    BS3_CMN_NM(Bs3Panic)
         jmp     .return
@@ -61,6 +65,9 @@ BS3_PROC_BEGIN_CMN Bs3SelRealModeCodeToProtMode, BS3_PBC_NEAR
 .bs3x0text16:
         mov     ax, BS3_SEL_X0TEXT16_CS
         jmp     .return
+.bs3rmtext16:
+        mov     ax, BS3_SEL_RMTEXT16_CS
+        jmp     .return
 .bs3text16:
         mov     ax, BS3_SEL_R0_CS16
 .return:
diff --git a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-SwitchHlpConvFlatRetToRetfProtMode.asm b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-SwitchHlpConvFlatRetToRetfProtMode.asm
new file mode 100644
index 00000000000..2518b8432d8
--- /dev/null
+++ b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-SwitchHlpConvFlatRetToRetfProtMode.asm
@@ -0,0 +1,68 @@
+; $Id$
+;; @file
+; BS3Kit - SwitchHlpConvFlatRetToRetfProtMode
+;
+
+;
+; Copyright (C) 2007-2016 Oracle Corporation
+;
+; This file is part of VirtualBox Open Source Edition (OSE), as
+; available from http://www.virtualbox.org. This file is free software;
+; you can redistribute it and/or modify it under the terms of the GNU
+; General Public License (GPL) as published by the Free Software
+; Foundation, in version 2 as it comes in the "COPYING" file of the
+; VirtualBox OSE distribution. VirtualBox OSE is distributed in the
+; hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
+;
+; The contents of this file may alternatively be used under the terms
+; of the Common Development and Distribution License Version 1.0
+; (CDDL) only, as it comes in the "COPYING.CDDL" file of the
+; VirtualBox OSE distribution, in which case the provisions of the
+; CDDL are applicable instead of those of the GPL.
+;
+; You may elect to license modified versions of this file under the
+; terms and conditions of either the GPL or the CDDL or both.
+;
+
+%include "bs3kit-template-header.mac"
+
+%if TMPL_BITS != 16
+BS3_EXTERN_CMN Bs3SelFlatCodeToProtFar16
+
+;;
+; SwitchToXxx helper that converts a 32-bit or 64-bit flat return address
+; into a 16-bit protected mode far return.
+;
+;
+; The caller calls this routine before switching modes. The flat return
+; to be converted is immediately after our own return address on the stack.
+;
+; @uses     Nothing.
+; @remarks  No 16-bit version.
+;
+BS3_PROC_BEGIN_CMN Bs3SwitchHlpConvFlatRetToRetfProtMode, BS3_PBC_NEAR
+ %if TMPL_BITS == 64
+        push        xAX
+        push        xCX
+        sub         xSP, 20h
+
+        mov         xCX, [xSP + xCB*3 + 20h]
+        call        Bs3SelFlatCodeToProtFar16 ; well behaved assembly function, only clobbers ecx
+        mov         [xSP + xCB*3 + 20h + 4], eax
+
+        add         xSP, 20h
+        pop         xCX
+        pop         xAX
+        ret         4
+ %else
+        xchg        eax, [xSP + xCB]
+        push        xAX
+        call        Bs3SelFlatCodeToProtFar16 ; well behaved assembly function, only clobbers eax
+        add         xSP, 4
+        xchg        [xSP + xCB], eax
+        ret
+ %endif
+BS3_PROC_END_CMN   Bs3SwitchHlpConvFlatRetToRetfProtMode
+
+%endif ; 32 || 64
+
diff --git a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-SwitchHlpConvRealModeRetfPopBpDecBpAndReturn.asm b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-SwitchHlpConvRealModeRetfPopBpDecBpAndReturn.asm
index b07f9dff51c..97f6d5ffb8e 100644
--- a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-SwitchHlpConvRealModeRetfPopBpDecBpAndReturn.asm
+++ b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-SwitchHlpConvRealModeRetfPopBpDecBpAndReturn.asm
@@ -50,7 +50,7 @@ BS3_PROC_BEGIN_CMN Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn, BS3_PBC_NEAR
         mov         ax, [bp + 2 + 2]
         push        ax
         BS3_EXTERN_CMN Bs3SelRealModeCodeToProtMode
-        call        Bs3SelRealModeCodeToProtMode ; This doesn't trash any registers (except AX).
+        call        Bs3SelRealModeCodeToProtMode    ; This doesn't trash any registers (except AX).
         add         sp, 2
         mov         [bp + 2 + 2], ax
 
@@ -60,28 +60,40 @@ BS3_PROC_BEGIN_CMN Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn, BS3_PBC_NEAR
         dec         bp
         retf
 
-%else
+%elif TMPL_BITS == 32
         push    xAX
         push    xDX
 
-        movzx   eax, word [xSP + 4*2 + 2 + 2]   ; return segment
-        movzx   edx, word [xSP + 4*2 + 2]       ; return offset
+        movzx   eax, word [xSP + xCB*2 + 2 + 2]     ; return segment
+        movzx   edx, word [xSP + xCB*2 + 2]         ; return offset
         shl     eax, 4
         add     eax, edx
-        mov     [xSP + 4*3 + 2], eax
+        mov     [xSP + xCB*2 + 2], eax
 
         pop     xDX
         pop     xAX
- %if TMPL_BITS == 32
         pop     bp
         dec     bp
         ret
- %else
-        mov     bp, [rsp]
-        add     rsp, 2h
+%else
+        sub     rsp, 2h
+
+        push    xAX
+        push    xDX
+
+        movzx   eax, word [xSP + xCB*2 + 4 + 2]     ; return segment
+        movzx   edx, word [xSP + xCB*2 + 4]         ; return offset
+        shl     eax, 4
+        add     eax, edx
+
+        mov     bp, [xSP + xCB*2 + 2]
         dec     bp
-        o32 ret
- %endif
+
+        mov     [xSP + xCB*2], rax
+
+        pop     xDX
+        pop     xAX
+        ret
 %endif
 BS3_PROC_END_CMN   Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn
 
diff --git a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-TestSendCmdWithU32.asm b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-TestSendCmdWithU32.asm
index e858db1207a..d086958284a 100644
--- a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-TestSendCmdWithU32.asm
+++ b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-TestSendCmdWithU32.asm
@@ -67,9 +67,6 @@ BS3_PROC_BEGIN_CMN bs3TestSendCmdWithU32, BS3_PBC_HYBRID
         out     dx, eax
 %endif
 
-%if TMPL_BITS == 16
-        pop     sAX
-%endif
 .no_vmmdev:
         pop     xSI
         pop     xDX
diff --git a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-first-common.mac b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-first-common.mac
index 7425da992cf..de94c220cb5 100644
--- a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-first-common.mac
+++ b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-first-common.mac
@@ -97,12 +97,18 @@ BS3_GLOBAL_DATA Bs3Data16Thru64Text32And64_TotalSize, 4
     dd  BS3_DATA_NM(Bs3Data64_EndOfSegment) wrt BS3KIT_GRPNM_DATA16
 BS3_GLOBAL_DATA Bs3TotalImageSize, 4
     dd  BS3_DATA_NM(Bs3Data64_EndOfSegment) wrt CGROUP16
+
 BS3_GLOBAL_DATA Bs3Text16_Size, 2
     dw  BS3_DATA_NM(Bs3Text16_EndOfSegment) wrt CGROUP16
+BS3_GLOBAL_DATA Bs3RmText16_Size, 2
+    dw  BS3_DATA_NM(Bs3RmText16_EndOfSegment) wrt BS3GROUPRMTEXT16
 BS3_GLOBAL_DATA Bs3X0Text16_Size, 2
     dw  BS3_DATA_NM(Bs3X0Text16_EndOfSegment) wrt BS3GROUPX0TEXT16
 BS3_GLOBAL_DATA Bs3X1Text16_Size, 2
     dw  BS3_DATA_NM(Bs3X1Text16_EndOfSegment) wrt BS3GROUPX1TEXT16
+
+BS3_GLOBAL_DATA Bs3RmText16_FlatAddr, 4
+    dd  BS3_DATA_NM(Bs3RmText16_StartOfSegment) wrt BS3FLAT
 BS3_GLOBAL_DATA Bs3X0Text16_FlatAddr, 4
     dd  BS3_DATA_NM(Bs3X0Text16_StartOfSegment) wrt BS3FLAT
 BS3_GLOBAL_DATA Bs3X1Text16_FlatAddr, 4
diff --git a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-EnteredMode.asm b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-EnteredMode.asm
index 907df884603..5f3abe01cc2 100644
--- a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-EnteredMode.asm
+++ b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-EnteredMode.asm
@@ -188,8 +188,8 @@ BS3_PROC_BEGIN_MODE Bs3EnteredMode, BS3_PBC_NEAR ; won't need this outside the s
         ;
 %if BS3_MODE_IS_RM_SYS(TMPL_MODE)
         extern         _Bs3TrapSystemCallHandler_rm
-        mov     word [ss: BS3_TRAP_SYSCALL*4], _Bs3TrapSystemCallHandler_rm wrt BS3TEXT16
-        mov     word [ss: BS3_TRAP_SYSCALL*4 + 2], BS3TEXT16
+        mov     word [ss: BS3_TRAP_SYSCALL*4], _Bs3TrapSystemCallHandler_rm wrt CGROUP16
+        mov     word [ss: BS3_TRAP_SYSCALL*4 + 2], CGROUP16
 
 %elif BS3_MODE_IS_16BIT_SYS(TMPL_MODE)
         BS3_EXTERN_CMN Bs3Trap16SetGate
@@ -197,7 +197,7 @@ BS3_PROC_BEGIN_MODE Bs3EnteredMode, BS3_PBC_NEAR ; won't need this outside the s
         BS3_BEGIN_TEXT16
         TMPL_BEGIN_TEXT
         push    0                       ; cParams
-        push    TMPL_NM(Bs3TrapSystemCallHandler) wrt BS3TEXT16
+        push    TMPL_NM(Bs3TrapSystemCallHandler) wrt CGROUP16
         push    BS3_SEL_R0_CS16
         push    3                       ; DPL
         push    X86_SEL_TYPE_SYS_286_INT_GATE
diff --git a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToLM16.asm b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToLM16.asm
index e95a5d8c832..5988f53a536 100644
--- a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToLM16.asm
+++ b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToLM16.asm
@@ -40,6 +40,9 @@
 ;
 ; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
 ;
+%if TMPL_BITS == 16
+BS3_GLOBAL_NAME_EX TMPL_NM(Bs3SwitchToLM16_Safe), function , 0
+%endif
 BS3_PROC_BEGIN_MODE Bs3SwitchToLM16, BS3_PBC_NEAR
 %ifdef TMPL_LM16
         extern  BS3_CMN_NM(Bs3SwitchToRing0)
@@ -105,5 +108,19 @@ BS3_PROC_BEGIN_MODE Bs3SwitchToLM16, BS3_PBC_FAR
         retf
  %endif
 BS3_PROC_END_MODE   Bs3SwitchToLM16
+
+%else
+;;
+; Safe far return to non-BS3TEXT16 code.
+BS3_EXTERN_CMN Bs3SwitchHlpConvFlatRetToRetfProtMode
+BS3_BEGIN_TEXT16
+BS3_SET_BITS TMPL_BITS
+BS3_PROC_BEGIN_MODE Bs3SwitchToLM16_Safe, BS3_PBC_NEAR
+        call        Bs3SwitchHlpConvFlatRetToRetfProtMode ; Special internal function.  Uses nothing, but modifies the stack.
+        call        TMPL_NM(Bs3SwitchToLM16)
+        BS3_SET_BITS 16
+        retf
+BS3_PROC_END_MODE   Bs3SwitchToLM16_Safe
+
 %endif
 
diff --git a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToLM32.asm b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToLM32.asm
index b593b6ef64a..12695efcdbd 100644
--- a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToLM32.asm
+++ b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToLM32.asm
@@ -43,6 +43,7 @@
 ;
 ; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
 ;
+BS3_GLOBAL_NAME_EX TMPL_NM(Bs3SwitchToLM32_Safe), function, 0
 BS3_PROC_BEGIN_MODE Bs3SwitchToLM32, BS3_PBC_NEAR
 %ifdef TMPL_LM32
         ret
@@ -167,11 +168,11 @@ BS3_PROC_BEGIN_MODE Bs3SwitchToLM32, BS3_PBC_FAR
 
         ; Jmp to common code for the tedious conversion.
  %if BS3_MODE_IS_RM_OR_V86(TMPL_MODE)
-        BS3_EXTERN_CMN Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn
-        jmp         Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn
+        extern      _Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn_c32
+        jmp         _Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn_c32
  %else
-        BS3_EXTERN_CMN Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn
-        jmp         Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn
+        extern      _Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn_c32
+        jmp         _Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn_c32
  %endif
         BS3_SET_BITS 16
 BS3_PROC_END_MODE   Bs3SwitchToLM32
diff --git a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToLM64.asm b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToLM64.asm
index 5d93108054c..ee10e37a259 100644
--- a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToLM64.asm
+++ b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToLM64.asm
@@ -40,6 +40,7 @@
 ;
 ; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
 ;
+BS3_GLOBAL_NAME_EX TMPL_NM(Bs3SwitchToLM16_Safe), function, 0
 BS3_PROC_BEGIN_MODE Bs3SwitchToLM64, BS3_PBC_NEAR
 %ifdef TMPL_LM64
         ret
@@ -91,11 +92,11 @@ BS3_PROC_BEGIN_MODE Bs3SwitchToLM64, BS3_PBC_FAR
 
         ; Jmp to common code for the tedious conversion.
  %if BS3_MODE_IS_RM_OR_V86(TMPL_MODE)
-        BS3_EXTERN_CMN Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn
-        jmp         Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn
+        extern      _Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn_c64
+        jmp         _Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn_c64
  %else
-        BS3_EXTERN_CMN Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn
-        jmp         Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn
+        extern      _Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn_c64
+        jmp         _Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn_c64
  %endif
         BS3_SET_BITS 16
 BS3_PROC_END_MODE   Bs3SwitchToLM64
diff --git a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAE16.asm b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAE16.asm
index 236671af7ca..379833afae2 100644
--- a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAE16.asm
+++ b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAE16.asm
@@ -46,6 +46,9 @@ extern  NAME(Bs3EnteredMode_pae16)
 ;
 ; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
 ;
+%if TMPL_BITS == 16
+BS3_GLOBAL_NAME_EX TMPL_NM(Bs3SwitchToPAE16_Safe), function , 0
+%endif
 BS3_PROC_BEGIN_MODE Bs3SwitchToPAE16, BS3_PBC_NEAR
 %ifdef TMPL_PAE16
         extern  BS3_CMN_NM(Bs3SwitchToRing0)
@@ -188,5 +191,18 @@ BS3_PROC_BEGIN_MODE Bs3SwitchToPAE16, BS3_PBC_FAR
         retf
  %endif
 BS3_PROC_END_MODE   Bs3SwitchToPAE16
+
+%else
+;;
+; Safe far return to non-BS3TEXT16 code.
+BS3_EXTERN_CMN Bs3SwitchHlpConvFlatRetToRetfProtMode
+BS3_BEGIN_TEXT16
+BS3_SET_BITS TMPL_BITS
+BS3_PROC_BEGIN_MODE Bs3SwitchToPAE16_Safe, BS3_PBC_NEAR
+        call        Bs3SwitchHlpConvFlatRetToRetfProtMode ; Special internal function.  Uses nothing, but modifies the stack.
+        call        TMPL_NM(Bs3SwitchToPAE16)
+        BS3_SET_BITS 16
+        retf
+BS3_PROC_END_MODE   Bs3SwitchToPAE16_Safe
 %endif
 
diff --git a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAE16_32.asm b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAE16_32.asm
index 4d36670b454..1f84f6830c2 100644
--- a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAE16_32.asm
+++ b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAE16_32.asm
@@ -39,6 +39,7 @@
 ;
 ; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
 ;
+BS3_GLOBAL_NAME_EX TMPL_NM(Bs3SwitchToPAE16_32_Safe), function, 0
 BS3_PROC_BEGIN_MODE Bs3SwitchToPAE16_32, BS3_PBC_NEAR
 %ifdef TMPL_PAE16_32
         ret
@@ -91,11 +92,11 @@ BS3_PROC_BEGIN_MODE Bs3SwitchToPAE16_32, BS3_PBC_FAR
 
         ; Jmp to common code for the tedious conversion.
  %if BS3_MODE_IS_RM_OR_V86(TMPL_MODE)
-        BS3_EXTERN_CMN Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn
-        jmp         Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn
+        extern      _Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn_c32
+        jmp         _Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn_c32
  %else
-        BS3_EXTERN_CMN Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn
-        jmp         Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn
+        extern      _Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn_c32
+        jmp         _Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn_c32
  %endif
         BS3_SET_BITS 16
 BS3_PROC_END_MODE   Bs3SwitchToPAE16_32
diff --git a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAE16_V86.asm b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAE16_V86.asm
index e16808c7f33..4e09e86d314 100644
--- a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAE16_V86.asm
+++ b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAE16_V86.asm
@@ -39,6 +39,9 @@
 ;
 ; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
 ;
+%if TMPL_BITS == 16
+BS3_GLOBAL_NAME_EX TMPL_NM(Bs3SwitchToPAE16_V86_Safe), function , 0
+%endif
 BS3_PROC_BEGIN_MODE Bs3SwitchToPAE16_V86, BS3_PBC_NEAR
 %ifdef TMPL_PAE16_V86
         ret
@@ -94,5 +97,18 @@ BS3_PROC_BEGIN_MODE Bs3SwitchToPAE16_V86, BS3_PBC_FAR
         retf
  %endif
 BS3_PROC_END_MODE   Bs3SwitchToPAE16_V86
+
+%else
+;;
+; Safe far return to non-BS3TEXT16 code.
+BS3_EXTERN_CMN Bs3SwitchHlpConvFlatRetToRetfProtMode
+BS3_BEGIN_TEXT16
+BS3_SET_BITS TMPL_BITS
+BS3_PROC_BEGIN_MODE Bs3SwitchToPAE16_V86_Safe, BS3_PBC_NEAR
+        call        Bs3SwitchHlpConvFlatRetToRetfProtMode ; Special internal function.  Uses nothing, but modifies the stack.
+        call        TMPL_NM(Bs3SwitchToPAE16_V86)
+        BS3_SET_BITS 16
+        retf
+BS3_PROC_END_MODE   Bs3SwitchToPAE16_V86_Safe
 %endif
 
diff --git a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAE32.asm b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAE32.asm
index 36374c531eb..d1da2eb8e5d 100644
--- a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAE32.asm
+++ b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAE32.asm
@@ -41,6 +41,7 @@
 ;
 ; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
 ;
+BS3_GLOBAL_NAME_EX TMPL_NM(Bs3SwitchToPAE32_Safe), function, 0
 BS3_PROC_BEGIN_MODE Bs3SwitchToPAE32, BS3_PBC_NEAR
 %ifdef TMPL_PAE32
         ret
@@ -173,11 +174,11 @@ BS3_PROC_BEGIN_MODE Bs3SwitchToPAE32, BS3_PBC_FAR
 
         ; Jmp to common code for the tedious conversion.
  %if BS3_MODE_IS_RM_OR_V86(TMPL_MODE)
-        BS3_EXTERN_CMN Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn
-        jmp         Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn
+        extern      _Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn_c32
+        jmp         _Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn_c32
  %else
-        BS3_EXTERN_CMN Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn
-        jmp         Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn
+        extern      _Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn_c32
+        jmp         _Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn_c32
  %endif
         BS3_SET_BITS 16
 BS3_PROC_END_MODE   Bs3SwitchToPAE32
diff --git a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAE32_16.asm b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAE32_16.asm
index 8e348d6a156..a5a32947ffe 100644
--- a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAE32_16.asm
+++ b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAE32_16.asm
@@ -39,6 +39,9 @@
 ;
 ; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
 ;
+%if TMPL_BITS == 16
+BS3_GLOBAL_NAME_EX TMPL_NM(Bs3SwitchToPAE32_16_Safe), function , 0
+%endif
 BS3_PROC_BEGIN_MODE Bs3SwitchToPAE32_16, BS3_PBC_NEAR
 %if TMPL_MODE == BS3_MODE_PAE32_16
         ret
@@ -79,6 +82,7 @@ BS3_BEGIN_TEXT16
 %endif
 BS3_PROC_END_MODE   Bs3SwitchToPAE32_16
 
+
 %if TMPL_BITS == 16
 ;;
 ; Custom far stub.
@@ -101,5 +105,18 @@ BS3_PROC_BEGIN_MODE Bs3SwitchToPAE32_16, BS3_PBC_FAR
         retf
  %endif
 BS3_PROC_END_MODE   Bs3SwitchToPAE32_16
+
+%else
+;;
+; Safe far return to non-BS3TEXT16 code.
+BS3_EXTERN_CMN Bs3SwitchHlpConvFlatRetToRetfProtMode
+BS3_BEGIN_TEXT16
+BS3_SET_BITS TMPL_BITS
+BS3_PROC_BEGIN_MODE Bs3SwitchToPAE32_16_Safe, BS3_PBC_NEAR
+        call        Bs3SwitchHlpConvFlatRetToRetfProtMode ; Special internal function.  Uses nothing, but modifies the stack.
+        call        TMPL_NM(Bs3SwitchToPAE32_16)
+        BS3_SET_BITS 16
+        retf
+BS3_PROC_END_MODE   Bs3SwitchToPAE32_16_Safe
 %endif
 
diff --git a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAEV86.asm b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAEV86.asm
index d0feebab4b1..505850cbaa6 100644
--- a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAEV86.asm
+++ b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAEV86.asm
@@ -39,6 +39,9 @@
 ;
 ; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
 ;
+%if TMPL_BITS == 16
+BS3_GLOBAL_NAME_EX TMPL_NM(Bs3SwitchToPAEV86_Safe), function , 0
+%endif
 BS3_PROC_BEGIN_MODE Bs3SwitchToPAEV86, BS3_PBC_NEAR
 %if TMPL_MODE == BS3_MODE_PAEV86
         ret
@@ -88,5 +91,18 @@ BS3_PROC_BEGIN_MODE Bs3SwitchToPAEV86, BS3_PBC_FAR
         retf
  %endif
 BS3_PROC_END_MODE   Bs3SwitchToPAEV86
+
+%else
+;;
+; Safe far return to non-BS3TEXT16 code.
+BS3_EXTERN_CMN Bs3SwitchHlpConvFlatRetToRetfProtMode
+BS3_BEGIN_TEXT16
+BS3_SET_BITS TMPL_BITS
+BS3_PROC_BEGIN_MODE Bs3SwitchToPAEV86_Safe, BS3_PBC_NEAR
+        call        Bs3SwitchHlpConvFlatRetToRetfProtMode ; Special internal function.  Uses nothing, but modifies the stack.
+        call        TMPL_NM(Bs3SwitchToPAEV86)
+        BS3_SET_BITS 16
+        retf
+BS3_PROC_END_MODE   Bs3SwitchToPAEV86_Safe
 %endif
 
diff --git a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPE16.asm b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPE16.asm
index 1d7c376b3cf..92058e70a62 100644
--- a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPE16.asm
+++ b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPE16.asm
@@ -39,6 +39,9 @@
 ;
 ; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
 ;
+%if TMPL_BITS == 16
+BS3_GLOBAL_NAME_EX TMPL_NM(Bs3SwitchToPE16_Safe), function , 0
+%endif
 BS3_PROC_BEGIN_MODE Bs3SwitchToPE16, BS3_PBC_NEAR
 %ifdef TMPL_PE16
         extern  BS3_CMN_NM(Bs3SwitchToRing0)
@@ -147,5 +150,18 @@ BS3_PROC_BEGIN_MODE Bs3SwitchToPE16, BS3_PBC_FAR
         retf
  %endif
 BS3_PROC_END_MODE   Bs3SwitchToPE16
+
+%else
+;;
+; Safe far return to non-BS3TEXT16 code.
+BS3_EXTERN_CMN Bs3SwitchHlpConvFlatRetToRetfProtMode
+BS3_BEGIN_TEXT16
+BS3_SET_BITS TMPL_BITS
+BS3_PROC_BEGIN_MODE Bs3SwitchToPE16_Safe, BS3_PBC_NEAR
+        call        Bs3SwitchHlpConvFlatRetToRetfProtMode ; Special internal function.  Uses nothing, but modifies the stack.
+        call        TMPL_NM(Bs3SwitchToPE16)
+        BS3_SET_BITS 16
+        retf
+BS3_PROC_END_MODE   Bs3SwitchToPE16_Safe
 %endif
 
diff --git a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPE16_32.asm b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPE16_32.asm
index 8e3437d9e04..96b429223d3 100644
--- a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPE16_32.asm
+++ b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPE16_32.asm
@@ -39,6 +39,7 @@
 ;
 ; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
 ;
+BS3_GLOBAL_NAME_EX TMPL_NM(Bs3SwitchToPE16_32_Safe), function, 0
 BS3_PROC_BEGIN_MODE Bs3SwitchToPE16_32, BS3_PBC_NEAR
 %ifdef TMPL_PE16_32
         ret
@@ -91,11 +92,11 @@ BS3_PROC_BEGIN_MODE Bs3SwitchToPE16_32, BS3_PBC_FAR
 
         ; Jmp to common code for the tedious conversion.
  %if BS3_MODE_IS_RM_OR_V86(TMPL_MODE)
-        BS3_EXTERN_CMN Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn
-        jmp         Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn
+        extern      _Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn_c32
+        jmp         _Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn_c32
  %else
-        BS3_EXTERN_CMN Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn
-        jmp         Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn
+        extern      _Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn_c32
+        jmp         _Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn_c32
  %endif
         BS3_SET_BITS 16
 BS3_PROC_END_MODE   Bs3SwitchToPE16_32
diff --git a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPE16_V86.asm b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPE16_V86.asm
index 3d045c9881f..9425dc4ccb0 100644
--- a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPE16_V86.asm
+++ b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPE16_V86.asm
@@ -39,6 +39,9 @@
 ;
 ; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
 ;
+%if TMPL_BITS == 16
+BS3_GLOBAL_NAME_EX TMPL_NM(Bs3SwitchToPE16_V86_Safe), function , 0
+%endif
 BS3_PROC_BEGIN_MODE Bs3SwitchToPE16_V86, BS3_PBC_NEAR
 %ifdef TMPL_PE16_V86
         ret
@@ -94,5 +97,18 @@ BS3_PROC_BEGIN_MODE Bs3SwitchToPE16_V86, BS3_PBC_FAR
         retf
  %endif
 BS3_PROC_END_MODE   Bs3SwitchToPE16_V86
+
+%else
+;;
+; Safe far return to non-BS3TEXT16 code.
+BS3_EXTERN_CMN Bs3SwitchHlpConvFlatRetToRetfProtMode
+BS3_BEGIN_TEXT16
+BS3_SET_BITS TMPL_BITS
+BS3_PROC_BEGIN_MODE Bs3SwitchToPE16_V86_Safe, BS3_PBC_NEAR
+        call        Bs3SwitchHlpConvFlatRetToRetfProtMode ; Special internal function.  Uses nothing, but modifies the stack.
+        call        TMPL_NM(Bs3SwitchToPE16_V86)
+        BS3_SET_BITS 16
+        retf
+BS3_PROC_END_MODE   Bs3SwitchToPE16_V86_Safe
 %endif
 
diff --git a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPE32.asm b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPE32.asm
index 0fa192b437d..184e96c4ee8 100644
--- a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPE32.asm
+++ b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPE32.asm
@@ -40,6 +40,7 @@
 ;
 ; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
 ;
+BS3_GLOBAL_NAME_EX TMPL_NM(Bs3SwitchToPE32_Safe), function, 0
 BS3_PROC_BEGIN_MODE Bs3SwitchToPE32, BS3_PBC_NEAR
 %ifdef TMPL_PE32
         ret
@@ -151,11 +152,11 @@ BS3_PROC_BEGIN_MODE Bs3SwitchToPE32, BS3_PBC_FAR
 
         ; Jmp to common code for the tedious conversion.
  %if BS3_MODE_IS_RM_OR_V86(TMPL_MODE)
-        BS3_EXTERN_CMN Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn
-        jmp         Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn
+        extern      _Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn_c32
+        jmp         _Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn_c32
  %else
-        BS3_EXTERN_CMN Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn
-        jmp         Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn
+        extern      _Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn_c32
+        jmp         _Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn_c32
  %endif
         BS3_SET_BITS 16
 BS3_PROC_END_MODE   Bs3SwitchToPE32
diff --git a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPE32_16.asm b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPE32_16.asm
index b49e93fd052..e63463c9c4f 100644
--- a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPE32_16.asm
+++ b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPE32_16.asm
@@ -39,6 +39,9 @@
 ;
 ; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
 ;
+%if TMPL_BITS == 16
+BS3_GLOBAL_NAME_EX TMPL_NM(Bs3SwitchToPE32_16_Safe), function , 0
+%endif
 BS3_PROC_BEGIN_MODE Bs3SwitchToPE32_16, BS3_PBC_NEAR
 %if TMPL_MODE == BS3_MODE_PE32_16
         ret
@@ -102,5 +105,18 @@ BS3_PROC_BEGIN_MODE Bs3SwitchToPE32_16, BS3_PBC_FAR
         retf
  %endif
 BS3_PROC_END_MODE   Bs3SwitchToPE32_16
+
+%else
+;;
+; Safe far return to non-BS3TEXT16 code.
+BS3_EXTERN_CMN Bs3SwitchHlpConvFlatRetToRetfProtMode
+BS3_BEGIN_TEXT16
+BS3_SET_BITS TMPL_BITS
+BS3_PROC_BEGIN_MODE Bs3SwitchToPE32_16_Safe, BS3_PBC_NEAR
+        call        Bs3SwitchHlpConvFlatRetToRetfProtMode ; Special internal function.  Uses nothing, but modifies the stack.
+        call        TMPL_NM(Bs3SwitchToPE32_16)
+        BS3_SET_BITS 16
+        retf
+BS3_PROC_END_MODE   Bs3SwitchToPE32_16_Safe
 %endif
 
diff --git a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPEV86.asm b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPEV86.asm
index 0463945181b..ac4e1a02a2f 100644
--- a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPEV86.asm
+++ b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPEV86.asm
@@ -39,6 +39,9 @@
 ;
 ; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
 ;
+%if TMPL_BITS == 16
+BS3_GLOBAL_NAME_EX TMPL_NM(Bs3SwitchToPEV86_Safe), function , 0
+%endif
 BS3_PROC_BEGIN_MODE Bs3SwitchToPEV86, BS3_PBC_NEAR
 %if TMPL_MODE == BS3_MODE_PEV86
         ret
@@ -88,5 +91,18 @@ BS3_PROC_BEGIN_MODE Bs3SwitchToPEV86, BS3_PBC_FAR
         retf
  %endif
 BS3_PROC_END_MODE   Bs3SwitchToPEV86
+
+%else
+;;
+; Safe far return to non-BS3TEXT16 code.
+BS3_EXTERN_CMN Bs3SwitchHlpConvFlatRetToRetfProtMode
+BS3_BEGIN_TEXT16
+BS3_SET_BITS TMPL_BITS
+BS3_PROC_BEGIN_MODE Bs3SwitchToPEV86_Safe, BS3_PBC_NEAR
+        call        Bs3SwitchHlpConvFlatRetToRetfProtMode ; Special internal function.  Uses nothing, but modifies the stack.
+        call        TMPL_NM(Bs3SwitchToPEV86)
+        BS3_SET_BITS 16
+        retf
+BS3_PROC_END_MODE   Bs3SwitchToPEV86_Safe
 %endif
 
diff --git a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPP16.asm b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPP16.asm
index 692215d3a80..a4c47a8f733 100644
--- a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPP16.asm
+++ b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPP16.asm
@@ -46,6 +46,9 @@ extern  NAME(Bs3EnteredMode_pp16)
 ;
 ; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
 ;
+%if TMPL_BITS == 16
+BS3_GLOBAL_NAME_EX TMPL_NM(Bs3SwitchToPP16_Safe), function , 0
+%endif
 BS3_PROC_BEGIN_MODE Bs3SwitchToPP16, BS3_PBC_NEAR
 %ifdef TMPL_PP16
         extern  BS3_CMN_NM(Bs3SwitchToRing0)
@@ -204,5 +207,18 @@ BS3_PROC_BEGIN_MODE Bs3SwitchToPP16, BS3_PBC_FAR
         retf
  %endif
 BS3_PROC_END_MODE   Bs3SwitchToPP16
+
+%else
+;;
+; Safe far return to non-BS3TEXT16 code.
+BS3_EXTERN_CMN Bs3SwitchHlpConvFlatRetToRetfProtMode
+BS3_BEGIN_TEXT16
+BS3_SET_BITS TMPL_BITS
+BS3_PROC_BEGIN_MODE Bs3SwitchToPP16_Safe, BS3_PBC_NEAR
+        call        Bs3SwitchHlpConvFlatRetToRetfProtMode ; Special internal function.  Uses nothing, but modifies the stack.
+        call        TMPL_NM(Bs3SwitchToPP16)
+        BS3_SET_BITS 16
+        retf
+BS3_PROC_END_MODE   Bs3SwitchToPP16_Safe
 %endif
 
diff --git a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPP16_32.asm b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPP16_32.asm
index 4a4e2152ce7..0d453012eb2 100644
--- a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPP16_32.asm
+++ b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPP16_32.asm
@@ -39,6 +39,7 @@
 ;
 ; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
 ;
+BS3_GLOBAL_NAME_EX TMPL_NM(Bs3SwitchToPP16_32_Safe), function, 0
 BS3_PROC_BEGIN_MODE Bs3SwitchToPP16_32, BS3_PBC_NEAR
 %ifdef TMPL_PP16_32
         ret
@@ -91,11 +92,11 @@ BS3_PROC_BEGIN_MODE Bs3SwitchToPP16_32, BS3_PBC_FAR
 
         ; Jmp to common code for the tedious conversion.
  %if BS3_MODE_IS_RM_OR_V86(TMPL_MODE)
-        BS3_EXTERN_CMN Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn
-        jmp         Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn
+        extern      _Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn_c32
+        jmp         _Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn_c32
  %else
-        BS3_EXTERN_CMN Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn
-        jmp         Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn
+        extern      _Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn_c32
+        jmp         _Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn_c32
  %endif
         BS3_SET_BITS 16
 BS3_PROC_END_MODE   Bs3SwitchToPP16_32
diff --git a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPP16_V86.asm b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPP16_V86.asm
index 095d6a4b0f7..47ece3c1da9 100644
--- a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPP16_V86.asm
+++ b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPP16_V86.asm
@@ -39,6 +39,9 @@
 ;
 ; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
 ;
+%if TMPL_BITS == 16
+BS3_GLOBAL_NAME_EX TMPL_NM(Bs3SwitchToPP16_V86_Safe), function , 0
+%endif
 BS3_PROC_BEGIN_MODE Bs3SwitchToPP16_V86, BS3_PBC_NEAR
 %ifdef TMPL_PP16_V86
         ret
@@ -94,5 +97,18 @@ BS3_PROC_BEGIN_MODE Bs3SwitchToPP16_V86, BS3_PBC_FAR
         retf
  %endif
 BS3_PROC_END_MODE   Bs3SwitchToPP16_V86
+
+%else
+;;
+; Safe far return to non-BS3TEXT16 code.
+BS3_EXTERN_CMN Bs3SwitchHlpConvFlatRetToRetfProtMode
+BS3_BEGIN_TEXT16
+BS3_SET_BITS TMPL_BITS
+BS3_PROC_BEGIN_MODE Bs3SwitchToPP16_V86_Safe, BS3_PBC_NEAR
+        call        Bs3SwitchHlpConvFlatRetToRetfProtMode ; Special internal function.  Uses nothing, but modifies the stack.
+        call        TMPL_NM(Bs3SwitchToPP16_V86)
+        BS3_SET_BITS 16
+        retf
+BS3_PROC_END_MODE   Bs3SwitchToPP16_V86_Safe
 %endif
 
diff --git a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPP32.asm b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPP32.asm
index 235718cb5d6..c0afed8afa3 100644
--- a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPP32.asm
+++ b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPP32.asm
@@ -41,6 +41,7 @@
 ;
 ; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
 ;
+BS3_GLOBAL_NAME_EX TMPL_NM(Bs3SwitchToPP32_Safe), function, 0
 BS3_PROC_BEGIN_MODE Bs3SwitchToPP32, BS3_PBC_NEAR
 %ifdef TMPL_PP32
         ret
@@ -181,11 +182,11 @@ BS3_PROC_BEGIN_MODE Bs3SwitchToPP32, BS3_PBC_FAR
 
         ; Jmp to common code for the tedious conversion.
  %if BS3_MODE_IS_RM_OR_V86(TMPL_MODE)
-        BS3_EXTERN_CMN Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn
-        jmp         Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn
+        extern      _Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn_c32
+        jmp         _Bs3SwitchHlpConvRealModeRetfPopBpDecBpAndReturn_c32
  %else
-        BS3_EXTERN_CMN Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn
-        jmp         Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn
+        extern      _Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn_c32
+        jmp         _Bs3SwitchHlpConvProtModeRetfPopBpDecBpAndReturn_c32
  %endif
         BS3_SET_BITS 16
 BS3_PROC_END_MODE   Bs3SwitchToPP32
diff --git a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPP32_16.asm b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPP32_16.asm
index 20726287cb2..b8951800015 100644
--- a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPP32_16.asm
+++ b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPP32_16.asm
@@ -39,6 +39,9 @@
 ;
 ; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
 ;
+%if TMPL_BITS == 16
+BS3_GLOBAL_NAME_EX TMPL_NM(Bs3SwitchToPP32_16_Safe), function , 0
+%endif
 BS3_PROC_BEGIN_MODE Bs3SwitchToPP32_16, BS3_PBC_NEAR
 %if TMPL_MODE == BS3_MODE_PP32_16
         ret
@@ -102,5 +105,18 @@ BS3_PROC_BEGIN_MODE Bs3SwitchToPP32_16, BS3_PBC_FAR
         retf
  %endif
 BS3_PROC_END_MODE   Bs3SwitchToPP32_16
+
+%else
+;;
+; Safe far return to non-BS3TEXT16 code.
+BS3_EXTERN_CMN Bs3SwitchHlpConvFlatRetToRetfProtMode
+BS3_BEGIN_TEXT16
+BS3_SET_BITS TMPL_BITS
+BS3_PROC_BEGIN_MODE Bs3SwitchToPP32_16_Safe, BS3_PBC_NEAR
+        call        Bs3SwitchHlpConvFlatRetToRetfProtMode ; Special internal function.  Uses nothing, but modifies the stack.
+        call        TMPL_NM(Bs3SwitchToPP32_16)
+        BS3_SET_BITS 16
+        retf
+BS3_PROC_END_MODE   Bs3SwitchToPP32_16_Safe
 %endif
 
diff --git a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPPV86.asm b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPPV86.asm
index 34e3832fec3..d28af73c2e2 100644
--- a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPPV86.asm
+++ b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPPV86.asm
@@ -39,6 +39,9 @@
 ;
 ; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
 ;
+%if TMPL_BITS == 16
+BS3_GLOBAL_NAME_EX TMPL_NM(Bs3SwitchToPPV86_Safe), function , 0
+%endif
 BS3_PROC_BEGIN_MODE Bs3SwitchToPPV86, BS3_PBC_NEAR
 %if TMPL_MODE == BS3_MODE_PPV86
         ret
@@ -88,5 +91,18 @@ BS3_PROC_BEGIN_MODE Bs3SwitchToPPV86, BS3_PBC_FAR
         retf
  %endif
 BS3_PROC_END_MODE   Bs3SwitchToPPV86
+
+%else
+;;
+; Safe far return to non-BS3TEXT16 code.
+BS3_EXTERN_CMN Bs3SwitchHlpConvFlatRetToRetfProtMode
+BS3_BEGIN_TEXT16
+BS3_SET_BITS TMPL_BITS
+BS3_PROC_BEGIN_MODE Bs3SwitchToPPV86_Safe, BS3_PBC_NEAR
+        call        Bs3SwitchHlpConvFlatRetToRetfProtMode ; Special internal function.  Uses nothing, but modifies the stack.
+        call        TMPL_NM(Bs3SwitchToPPV86)
+        BS3_SET_BITS 16
+        retf
+BS3_PROC_END_MODE   Bs3SwitchToPPV86_Safe
 %endif
 
diff --git a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToRM.asm b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToRM.asm
index c7cdd80e0e4..4112557bc8e 100644
--- a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToRM.asm
+++ b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToRM.asm
@@ -54,7 +54,7 @@ TMPL_BEGIN_TEXT
 ; @cproto   BS3_DECL(void) Bs3SwitchToRM(void);
 ;
 ; @uses     GPRs and EFLAGS are unchanged (except high 32-bit register (AMD64) parts).
-;           CS is loaded with BS3TEXT16.
+;           CS is loaded with CGROUP16.
 ;           SS:[RE]SP is converted to real mode address.
 ;           DS and ES are loaded with BS3DATA16_GROUP.
 ;           FS and GS are loaded with zero if present.
@@ -64,6 +64,9 @@ TMPL_BEGIN_TEXT
 ;
 ; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
 ;
+%if TMPL_BITS == 16
+BS3_GLOBAL_NAME_EX TMPL_NM(Bs3SwitchToRM_Safe), function , 0
+%endif
 BS3_PROC_BEGIN_MODE Bs3SwitchToRM, BS3_PBC_NEAR
 %ifdef TMPL_RM
         push    ax
@@ -264,7 +267,7 @@ BS3_BEGIN_TEXT16
         mov     eax, cr0
         and     eax, X86_CR0_NO_PE_NO_PG
         mov     cr0, eax
-        jmp     BS3TEXT16:.reload_cs
+        jmp     CGROUP16:.reload_cs
 .reload_cs:
 
         ;
@@ -360,5 +363,37 @@ BS3_PROC_BEGIN_MODE Bs3SwitchToRM, BS3_PBC_FAR
         retf
  %endif
 BS3_PROC_END_MODE   Bs3SwitchToRM
+
+%else
+;;
+; Safe far return to non-BS3TEXT16 code.
+BS3_EXTERN_CMN Bs3SelFlatCodeToRealMode
+BS3_BEGIN_TEXT16
+BS3_SET_BITS TMPL_BITS
+BS3_PROC_BEGIN_MODE Bs3SwitchToRM_Safe, BS3_PBC_NEAR
+ %if TMPL_BITS == 64
+        push        xAX
+        push        xCX
+        sub         xSP, 20h
+
+        mov         xCX, [xSP + xCB*2 + 20h]
+        call        Bs3SelFlatCodeToRealMode ; well behaved assembly function, only clobbers ecx
+        mov         [xSP + xCB*2 + 20h + 4], eax
+
+        add         xSP, 20h
+        pop         xCX
+        pop         xAX
+        add         xSP, 4
+ %else
+        xchg        eax, [xSP]
+        push        xAX
+        call        Bs3SelFlatCodeToRealMode ; well behaved assembly function, only clobbers eax
+        add         xSP, 4
+        xchg        [xSP], eax
+ %endif
+        call        TMPL_NM(Bs3SwitchToRM)
+        BS3_SET_BITS 16
+        retf
+BS3_PROC_END_MODE   Bs3SwitchToRM_Safe
 %endif
 
diff --git a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-TestDoModes.c b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-TestDoModes.c
index b88f2879f01..1348526b0a0 100644
--- a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-TestDoModes.c
+++ b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-TestDoModes.c
@@ -30,8 +30,16 @@
 /*********************************************************************************************************************************
 *   Header Files                                                                                                                 *
 *********************************************************************************************************************************/
-#include "bs3kit-template-header.h"
-#include "bs3-cmn-test.h"
+#if defined(__WATCOMC__) && TMPL_MODE == BS3_MODE_RM
+/* In real mode we move this blob of code to the RMTEXT16 segment to save space. */
+# define BS3_USE_RM_TEXT_SEG 1
+# include "bs3kit-template-header.h"
+# include "bs3-cmn-test.h"
+# pragma code_seg("BS3RMTEXT16", "BS3CLASS16RMCODE")
+#else
+# include "bs3kit-template-header.h"
+# include "bs3-cmn-test.h"
+#endif
 
 
 /*********************************************************************************************************************************
@@ -62,28 +70,29 @@
 /*********************************************************************************************************************************
 *   Assembly Symbols                                                                                                             *
 *********************************************************************************************************************************/
-BS3_DECL_FAR(uint8_t) TMPL_FAR_NM(Bs3TestCallDoerInRM)(uint32_t uCallbackFarPtr);
-BS3_DECL_FAR(uint8_t) TMPL_FAR_NM(Bs3TestCallDoerInPE16)(uint32_t uCallbackFarPtr);
-BS3_DECL_FAR(uint8_t) TMPL_FAR_NM(Bs3TestCallDoerInPE16_32)(uint32_t uFlatAddrCallback);
-BS3_DECL_FAR(uint8_t) TMPL_FAR_NM(Bs3TestCallDoerInPE16_V86)(uint32_t uCallbackFarPtr);
-BS3_DECL_FAR(uint8_t) TMPL_FAR_NM(Bs3TestCallDoerInPE32)(uint32_t uFlatAddrCallback);
-BS3_DECL_FAR(uint8_t) TMPL_FAR_NM(Bs3TestCallDoerInPE32_16)(uint32_t uCallbackFarPtr);
-BS3_DECL_FAR(uint8_t) TMPL_FAR_NM(Bs3TestCallDoerInPEV86)(uint32_t uCallbackFarPtr);
-BS3_DECL_FAR(uint8_t) TMPL_FAR_NM(Bs3TestCallDoerInPP16)(uint32_t uCallbackFarPtr);
-BS3_DECL_FAR(uint8_t) TMPL_FAR_NM(Bs3TestCallDoerInPP16_32)(uint32_t uFlatAddrCallback);
-BS3_DECL_FAR(uint8_t) TMPL_FAR_NM(Bs3TestCallDoerInPP16_V86)(uint32_t uCallbackFarPtr);
-BS3_DECL_FAR(uint8_t) TMPL_FAR_NM(Bs3TestCallDoerInPP32)(uint32_t uFlatAddrCallback);
-BS3_DECL_FAR(uint8_t) TMPL_FAR_NM(Bs3TestCallDoerInPP32_16)(uint32_t uCallbackFarPtr);
-BS3_DECL_FAR(uint8_t) TMPL_FAR_NM(Bs3TestCallDoerInPPV86)(uint32_t uCallbackFarPtr);
-BS3_DECL_FAR(uint8_t) TMPL_FAR_NM(Bs3TestCallDoerInPAE16)(uint32_t uCallbackFarPtr);
-BS3_DECL_FAR(uint8_t) TMPL_FAR_NM(Bs3TestCallDoerInPAE16_32)(uint32_t uFlatAddrCallback);
-BS3_DECL_FAR(uint8_t) TMPL_FAR_NM(Bs3TestCallDoerInPAE16_V86)(uint32_t uCallbackFarPtr);
-BS3_DECL_FAR(uint8_t) TMPL_FAR_NM(Bs3TestCallDoerInPAE32)(uint32_t uFlatAddrCallback);
-BS3_DECL_FAR(uint8_t) TMPL_FAR_NM(Bs3TestCallDoerInPAE32_16)(uint32_t uCallbackFarPtr);
-BS3_DECL_FAR(uint8_t) TMPL_FAR_NM(Bs3TestCallDoerInPAEV86)(uint32_t uCallbackFarPtr);
-BS3_DECL_FAR(uint8_t) TMPL_FAR_NM(Bs3TestCallDoerInLM16)(uint32_t uCallbackFarPtr);
-BS3_DECL_FAR(uint8_t) TMPL_FAR_NM(Bs3TestCallDoerInLM32)(uint32_t uFlatAddrCallback);
-BS3_DECL_FAR(uint8_t) TMPL_FAR_NM(Bs3TestCallDoerInLM64)(uint32_t uFlatAddrCallback);
+/* These are in the same code segment as this code, so no FAR necessary. */
+BS3_DECL_NEAR(uint8_t) TMPL_NM(Bs3TestCallDoerInRM)(uint32_t uCallbackFarPtr);
+BS3_DECL_NEAR(uint8_t) TMPL_NM(Bs3TestCallDoerInPE16)(uint32_t uCallbackFarPtr);
+BS3_DECL_NEAR(uint8_t) TMPL_NM(Bs3TestCallDoerInPE16_32)(uint32_t uFlatAddrCallback);
+BS3_DECL_NEAR(uint8_t) TMPL_NM(Bs3TestCallDoerInPE16_V86)(uint32_t uCallbackFarPtr);
+BS3_DECL_NEAR(uint8_t) TMPL_NM(Bs3TestCallDoerInPE32)(uint32_t uFlatAddrCallback);
+BS3_DECL_NEAR(uint8_t) TMPL_NM(Bs3TestCallDoerInPE32_16)(uint32_t uCallbackFarPtr);
+BS3_DECL_NEAR(uint8_t) TMPL_NM(Bs3TestCallDoerInPEV86)(uint32_t uCallbackFarPtr);
+BS3_DECL_NEAR(uint8_t) TMPL_NM(Bs3TestCallDoerInPP16)(uint32_t uCallbackFarPtr);
+BS3_DECL_NEAR(uint8_t) TMPL_NM(Bs3TestCallDoerInPP16_32)(uint32_t uFlatAddrCallback);
+BS3_DECL_NEAR(uint8_t) TMPL_NM(Bs3TestCallDoerInPP16_V86)(uint32_t uCallbackFarPtr);
+BS3_DECL_NEAR(uint8_t) TMPL_NM(Bs3TestCallDoerInPP32)(uint32_t uFlatAddrCallback);
+BS3_DECL_NEAR(uint8_t) TMPL_NM(Bs3TestCallDoerInPP32_16)(uint32_t uCallbackFarPtr);
+BS3_DECL_NEAR(uint8_t) TMPL_NM(Bs3TestCallDoerInPPV86)(uint32_t uCallbackFarPtr);
+BS3_DECL_NEAR(uint8_t) TMPL_NM(Bs3TestCallDoerInPAE16)(uint32_t uCallbackFarPtr);
+BS3_DECL_NEAR(uint8_t) TMPL_NM(Bs3TestCallDoerInPAE16_32)(uint32_t uFlatAddrCallback);
+BS3_DECL_NEAR(uint8_t) TMPL_NM(Bs3TestCallDoerInPAE16_V86)(uint32_t uCallbackFarPtr);
+BS3_DECL_NEAR(uint8_t) TMPL_NM(Bs3TestCallDoerInPAE32)(uint32_t uFlatAddrCallback);
+BS3_DECL_NEAR(uint8_t) TMPL_NM(Bs3TestCallDoerInPAE32_16)(uint32_t uCallbackFarPtr);
+BS3_DECL_NEAR(uint8_t) TMPL_NM(Bs3TestCallDoerInPAEV86)(uint32_t uCallbackFarPtr);
+BS3_DECL_NEAR(uint8_t) TMPL_NM(Bs3TestCallDoerInLM16)(uint32_t uCallbackFarPtr);
+BS3_DECL_NEAR(uint8_t) TMPL_NM(Bs3TestCallDoerInLM32)(uint32_t uFlatAddrCallback);
+BS3_DECL_NEAR(uint8_t) TMPL_NM(Bs3TestCallDoerInLM64)(uint32_t uFlatAddrCallback);
 
 
 
@@ -217,7 +226,7 @@ BS3_MODE_DEF(void, Bs3TestDoModes,(PCBS3TESTMODEENTRY paEntries, size_t cEntries
         if (paEntries[i].pfnDoRM)
         {
             PRE_DO_CALL(g_szBs3ModeName_rm);
-            bErrNo = TMPL_FAR_NM(Bs3TestCallDoerInRM)(CONV_TO_RM_FAR16(paEntries[i].pfnDoRM));
+            bErrNo = TMPL_NM(Bs3TestCallDoerInRM)(CONV_TO_RM_FAR16(paEntries[i].pfnDoRM));
             CHECK_RESULT(g_szBs3ModeName_rm);
         }
 
@@ -234,7 +243,7 @@ BS3_MODE_DEF(void, Bs3TestDoModes,(PCBS3TESTMODEENTRY paEntries, size_t cEntries
         if (paEntries[i].pfnDoPE16)
         {
             PRE_DO_CALL(g_szBs3ModeName_pe16);
-            bErrNo = TMPL_FAR_NM(Bs3TestCallDoerInPE16)(CONV_TO_PROT_FAR16(paEntries[i].pfnDoPE16));
+            bErrNo = TMPL_NM(Bs3TestCallDoerInPE16)(CONV_TO_PROT_FAR16(paEntries[i].pfnDoPE16));
             CHECK_RESULT(g_szBs3ModeName_pe16);
         }
         if (bCpuType < BS3CPU_80386)
@@ -247,35 +256,35 @@ BS3_MODE_DEF(void, Bs3TestDoModes,(PCBS3TESTMODEENTRY paEntries, size_t cEntries
         if (paEntries[i].pfnDoPE16_32)
         {
             PRE_DO_CALL(g_szBs3ModeName_pe16_32);
-            bErrNo = TMPL_FAR_NM(Bs3TestCallDoerInPE16_32)(CONV_TO_FLAT(paEntries[i].pfnDoPE16_32));
+            bErrNo = TMPL_NM(Bs3TestCallDoerInPE16_32)(CONV_TO_FLAT(paEntries[i].pfnDoPE16_32));
             CHECK_RESULT(g_szBs3ModeName_pe16_32);
         }
 
         if (paEntries[i].pfnDoPE16_V86 && fDoWeirdV86Modes)
         {
             PRE_DO_CALL(g_szBs3ModeName_pe16_v86);
-            bErrNo = TMPL_FAR_NM(Bs3TestCallDoerInPE16_V86)(CONV_TO_RM_FAR16(paEntries[i].pfnDoPE16_V86));
+            bErrNo = TMPL_NM(Bs3TestCallDoerInPE16_V86)(CONV_TO_RM_FAR16(paEntries[i].pfnDoPE16_V86));
             CHECK_RESULT(g_szBs3ModeName_pe16_v86);
         }
 
         if (paEntries[i].pfnDoPE32)
         {
             PRE_DO_CALL(g_szBs3ModeName_pe32);
-            bErrNo = TMPL_FAR_NM(Bs3TestCallDoerInPE32)(CONV_TO_FLAT(paEntries[i].pfnDoPE32));
+            bErrNo = TMPL_NM(Bs3TestCallDoerInPE32)(CONV_TO_FLAT(paEntries[i].pfnDoPE32));
             CHECK_RESULT(g_szBs3ModeName_pe32);
         }
 
         if (paEntries[i].pfnDoPE32_16)
         {
             PRE_DO_CALL(g_szBs3ModeName_pe32_16);
-            bErrNo = TMPL_FAR_NM(Bs3TestCallDoerInPE32_16)(CONV_TO_PROT_FAR16(paEntries[i].pfnDoPE32_16));
+            bErrNo = TMPL_NM(Bs3TestCallDoerInPE32_16)(CONV_TO_PROT_FAR16(paEntries[i].pfnDoPE32_16));
             CHECK_RESULT(g_szBs3ModeName_pe32_16);
         }
 
         if (paEntries[i].pfnDoPEV86 && fDoV86Modes)
         {
             PRE_DO_CALL(g_szBs3ModeName_pev86);
-            bErrNo = TMPL_FAR_NM(Bs3TestCallDoerInPEV86)(CONV_TO_RM_FAR16(paEntries[i].pfnDoPEV86));
+            bErrNo = TMPL_NM(Bs3TestCallDoerInPEV86)(CONV_TO_RM_FAR16(paEntries[i].pfnDoPEV86));
             CHECK_RESULT(g_szBs3ModeName_pev86);
         }
 
@@ -285,42 +294,42 @@ BS3_MODE_DEF(void, Bs3TestDoModes,(PCBS3TESTMODEENTRY paEntries, size_t cEntries
         if (paEntries[i].pfnDoPP16)
         {
             PRE_DO_CALL(g_szBs3ModeName_pp16);
-            bErrNo = TMPL_FAR_NM(Bs3TestCallDoerInPP16)(CONV_TO_PROT_FAR16(paEntries[i].pfnDoPP16));
+            bErrNo = TMPL_NM(Bs3TestCallDoerInPP16)(CONV_TO_PROT_FAR16(paEntries[i].pfnDoPP16));
             CHECK_RESULT(g_szBs3ModeName_pp16);
         }
 
         if (paEntries[i].pfnDoPP16_32)
         {
             PRE_DO_CALL(g_szBs3ModeName_pp16_32);
-            bErrNo = TMPL_FAR_NM(Bs3TestCallDoerInPP16_32)(CONV_TO_FLAT(paEntries[i].pfnDoPP16_32));
+            bErrNo = TMPL_NM(Bs3TestCallDoerInPP16_32)(CONV_TO_FLAT(paEntries[i].pfnDoPP16_32));
             CHECK_RESULT(g_szBs3ModeName_pp16_32);
         }
 
         if (paEntries[i].pfnDoPP16_V86 && fDoWeirdV86Modes)
         {
             PRE_DO_CALL(g_szBs3ModeName_pp16_v86);
-            bErrNo = TMPL_FAR_NM(Bs3TestCallDoerInPP16_V86)(CONV_TO_RM_FAR16(paEntries[i].pfnDoPP16_V86));
+            bErrNo = TMPL_NM(Bs3TestCallDoerInPP16_V86)(CONV_TO_RM_FAR16(paEntries[i].pfnDoPP16_V86));
             CHECK_RESULT(g_szBs3ModeName_pp16_v86);
         }
 
         if (paEntries[i].pfnDoPP32)
         {
             PRE_DO_CALL(g_szBs3ModeName_pp32);
-            bErrNo = TMPL_FAR_NM(Bs3TestCallDoerInPP32)(CONV_TO_FLAT(paEntries[i].pfnDoPP32));
+            bErrNo = TMPL_NM(Bs3TestCallDoerInPP32)(CONV_TO_FLAT(paEntries[i].pfnDoPP32));
             CHECK_RESULT(g_szBs3ModeName_pp32);
         }
 
         if (paEntries[i].pfnDoPP32_16)
         {
             PRE_DO_CALL(g_szBs3ModeName_pp32_16);
-            bErrNo = TMPL_FAR_NM(Bs3TestCallDoerInPP32_16)(CONV_TO_PROT_FAR16(paEntries[i].pfnDoPP32_16));
+            bErrNo = TMPL_NM(Bs3TestCallDoerInPP32_16)(CONV_TO_PROT_FAR16(paEntries[i].pfnDoPP32_16));
             CHECK_RESULT(g_szBs3ModeName_pp32_16);
         }
 
         if (paEntries[i].pfnDoPPV86 && fDoV86Modes)
         {
             PRE_DO_CALL(g_szBs3ModeName_ppv86);
-            bErrNo = TMPL_FAR_NM(Bs3TestCallDoerInPPV86)(CONV_TO_RM_FAR16(paEntries[i].pfnDoPPV86));
+            bErrNo = TMPL_NM(Bs3TestCallDoerInPPV86)(CONV_TO_RM_FAR16(paEntries[i].pfnDoPPV86));
             CHECK_RESULT(g_szBs3ModeName_ppv86);
         }
 
@@ -337,42 +346,42 @@ BS3_MODE_DEF(void, Bs3TestDoModes,(PCBS3TESTMODEENTRY paEntries, size_t cEntries
         if (paEntries[i].pfnDoPAE16)
         {
             PRE_DO_CALL(g_szBs3ModeName_pae16);
-            bErrNo = TMPL_FAR_NM(Bs3TestCallDoerInPAE16)(CONV_TO_PROT_FAR16(paEntries[i].pfnDoPAE16));
+            bErrNo = TMPL_NM(Bs3TestCallDoerInPAE16)(CONV_TO_PROT_FAR16(paEntries[i].pfnDoPAE16));
             CHECK_RESULT(g_szBs3ModeName_pae16);
         }
 
         if (paEntries[i].pfnDoPAE16_32)
         {
             PRE_DO_CALL(g_szBs3ModeName_pae16_32);
-            bErrNo = TMPL_FAR_NM(Bs3TestCallDoerInPAE16_32)(CONV_TO_FLAT(paEntries[i].pfnDoPAE16_32));
+            bErrNo = TMPL_NM(Bs3TestCallDoerInPAE16_32)(CONV_TO_FLAT(paEntries[i].pfnDoPAE16_32));
             CHECK_RESULT(g_szBs3ModeName_pae16_32);
         }
 
         if (paEntries[i].pfnDoPAE16_V86 && fDoWeirdV86Modes)
         {
             PRE_DO_CALL(g_szBs3ModeName_pae16_v86);
-            bErrNo = TMPL_FAR_NM(Bs3TestCallDoerInPAE16_V86)(CONV_TO_RM_FAR16(paEntries[i].pfnDoPAE16_V86));
+            bErrNo = TMPL_NM(Bs3TestCallDoerInPAE16_V86)(CONV_TO_RM_FAR16(paEntries[i].pfnDoPAE16_V86));
             CHECK_RESULT(g_szBs3ModeName_pae16_v86);
         }
 
         if (paEntries[i].pfnDoPAE32)
         {
             PRE_DO_CALL(g_szBs3ModeName_pae32);
-            bErrNo = TMPL_FAR_NM(Bs3TestCallDoerInPAE32)(CONV_TO_FLAT(paEntries[i].pfnDoPAE32));
+            bErrNo = TMPL_NM(Bs3TestCallDoerInPAE32)(CONV_TO_FLAT(paEntries[i].pfnDoPAE32));
             CHECK_RESULT(g_szBs3ModeName_pae32);
         }
 
         if (paEntries[i].pfnDoPAE32_16)
         {
             PRE_DO_CALL(g_szBs3ModeName_pae32_16);
-            bErrNo = TMPL_FAR_NM(Bs3TestCallDoerInPAE32_16)(CONV_TO_PROT_FAR16(paEntries[i].pfnDoPAE32_16));
+            bErrNo = TMPL_NM(Bs3TestCallDoerInPAE32_16)(CONV_TO_PROT_FAR16(paEntries[i].pfnDoPAE32_16));
             CHECK_RESULT(g_szBs3ModeName_pae32_16);
         }
 
         if (paEntries[i].pfnDoPAEV86 && fDoV86Modes)
         {
             PRE_DO_CALL(g_szBs3ModeName_paev86);
-            bErrNo = TMPL_FAR_NM(Bs3TestCallDoerInPAEV86)(CONV_TO_RM_FAR16(paEntries[i].pfnDoPAEV86));
+            bErrNo = TMPL_NM(Bs3TestCallDoerInPAEV86)(CONV_TO_RM_FAR16(paEntries[i].pfnDoPAEV86));
             CHECK_RESULT(g_szBs3ModeName_paev86);
         }
 
@@ -389,21 +398,21 @@ BS3_MODE_DEF(void, Bs3TestDoModes,(PCBS3TESTMODEENTRY paEntries, size_t cEntries
         if (paEntries[i].pfnDoLM16)
         {
             PRE_DO_CALL(g_szBs3ModeName_lm16);
-            bErrNo = TMPL_FAR_NM(Bs3TestCallDoerInLM16)(CONV_TO_PROT_FAR16(paEntries[i].pfnDoLM16));
+            bErrNo = TMPL_NM(Bs3TestCallDoerInLM16)(CONV_TO_PROT_FAR16(paEntries[i].pfnDoLM16));
             CHECK_RESULT(g_szBs3ModeName_lm16);
         }
 
         if (paEntries[i].pfnDoLM32)
         {
             PRE_DO_CALL(g_szBs3ModeName_lm32);
-            bErrNo = TMPL_FAR_NM(Bs3TestCallDoerInLM32)(CONV_TO_FLAT(paEntries[i].pfnDoLM32));
+            bErrNo = TMPL_NM(Bs3TestCallDoerInLM32)(CONV_TO_FLAT(paEntries[i].pfnDoLM32));
             CHECK_RESULT(g_szBs3ModeName_lm32);
         }
 
         if (paEntries[i].pfnDoLM64)
         {
             PRE_DO_CALL(g_szBs3ModeName_lm64);
-            bErrNo = TMPL_FAR_NM(Bs3TestCallDoerInLM64)(CONV_TO_FLAT(paEntries[i].pfnDoLM64));
+            bErrNo = TMPL_NM(Bs3TestCallDoerInLM64)(CONV_TO_FLAT(paEntries[i].pfnDoLM64));
             CHECK_RESULT(g_szBs3ModeName_lm64);
         }
 
diff --git a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-TestDoModesHlp.asm b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-TestDoModesHlp.asm
index 5add02fc7a3..820a32deb3d 100644
--- a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-TestDoModesHlp.asm
+++ b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-TestDoModesHlp.asm
@@ -24,12 +24,70 @@
 ; terms and conditions of either the GPL or the CDDL or both.
 ;
 
+;*********************************************************************************************************************************
+;*  Header Files                                                                                                                 *
+;*********************************************************************************************************************************
 %include "bs3kit-template-header.mac"
 
 
 ;*********************************************************************************************************************************
+;*  Defined Constants And Macros                                                                                                 *
+;*********************************************************************************************************************************
+;
+; We put most of this mess in the RMTEXT16 segment when in real mode.
+;
+%if TMPL_MODE == BS3_MODE_RM
+ %define MY_BEGIN_TEXT   BS3_BEGIN_RMTEXT16
+ %define MY_BEGIN_TEXT16 BS3_BEGIN_RMTEXT16
+%else
+ %define MY_BEGIN_TEXT   TMPL_BEGIN_TEXT
+ %define MY_BEGIN_TEXT16 BS3_BEGIN_TEXT16
+%endif
+
+
+;*********************************************************************************************************************************
 ;*  External Symbols                                                                                                             *
 ;*********************************************************************************************************************************
+%if TMPL_MODE == BS3_MODE_RM
+BS3_BEGIN_TEXT16_FARSTUBS
+extern TMPL_FAR_NM(Bs3SwitchToRM)
+extern TMPL_FAR_NM(Bs3SwitchToPE16)
+extern TMPL_FAR_NM(Bs3SwitchToPE16_32)
+extern TMPL_FAR_NM(Bs3SwitchToPE16_V86)
+extern TMPL_FAR_NM(Bs3SwitchToPE32)
+extern TMPL_FAR_NM(Bs3SwitchToPE32_16)
+extern TMPL_FAR_NM(Bs3SwitchToPEV86)
+extern TMPL_FAR_NM(Bs3SwitchToPP16)
+extern TMPL_FAR_NM(Bs3SwitchToPP16_32)
+extern TMPL_FAR_NM(Bs3SwitchToPP16_V86)
+extern TMPL_FAR_NM(Bs3SwitchToPP32)
+extern TMPL_FAR_NM(Bs3SwitchToPP32_16)
+extern TMPL_FAR_NM(Bs3SwitchToPPV86)
+extern TMPL_FAR_NM(Bs3SwitchToPAE16)
+extern TMPL_FAR_NM(Bs3SwitchToPAE16_32)
+extern TMPL_FAR_NM(Bs3SwitchToPAE16_V86)
+extern TMPL_FAR_NM(Bs3SwitchToPAE32)
+extern TMPL_FAR_NM(Bs3SwitchToPAE32_16)
+extern TMPL_FAR_NM(Bs3SwitchToPAEV86)
+extern TMPL_FAR_NM(Bs3SwitchToLM16)
+extern TMPL_FAR_NM(Bs3SwitchToLM32)
+extern TMPL_FAR_NM(Bs3SwitchToLM64)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_rm_far)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pe16_far)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pe16_v86_far)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pe32_16_far)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pev86_far)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pp16_far)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pp16_v86_far)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pp32_16_far)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_ppv86_far)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pae16_far)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pae16_v86_far)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pae32_16_far)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_paev86_far)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_lm16_far)
+%else
+BS3_BEGIN_TEXT16
 extern TMPL_NM(Bs3SwitchToRM)
 extern TMPL_NM(Bs3SwitchToPE16)
 extern TMPL_NM(Bs3SwitchToPE16_32)
@@ -52,30 +110,35 @@ extern TMPL_NM(Bs3SwitchToPAEV86)
 extern TMPL_NM(Bs3SwitchToLM16)
 extern TMPL_NM(Bs3SwitchToLM32)
 extern TMPL_NM(Bs3SwitchToLM64)
-extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_rm)
-extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pe16)
-extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pe16_32)
-extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pe16_v86)
-extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pe32)
-extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pe32_16)
-extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pev86)
-extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pp16)
-extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pp16_32)
-extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pp16_v86)
-extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pp32)
-extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pp32_16)
-extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_ppv86)
-extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pae16)
-extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pae16_32)
-extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pae16_v86)
-extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pae32)
-extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pae32_16)
-extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_paev86)
-extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_lm16)
-extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_lm32)
-extern RT_CONCAT3(Bs3SwitchTo,TMPL_MODE_UNAME,_lm64)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_rm)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pe16)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pe16_v86)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pe32_16)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pev86)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pp16)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pp16_v86)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pp32_16)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_ppv86)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pae16)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pae16_v86)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pae32_16)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_paev86)
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_lm16)
+%endif
+BS3_BEGIN_TEXT16
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pe16_32):wrt BS3FLAT
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pe32):wrt BS3FLAT
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pp16_32):wrt BS3FLAT
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pp32):wrt BS3FLAT
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pae16_32):wrt BS3FLAT
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pae32):wrt BS3FLAT
+extern RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_lm32):wrt BS3FLAT
+extern RT_CONCAT3(Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_lm64):wrt BS3FLAT
+
 
 
+MY_BEGIN_TEXT
+
 ;;
 ; Shared prologue code.
 ; @param    xAX     Where to jump to for the main event.
@@ -153,11 +216,7 @@ BS3_GLOBAL_NAME_EX TMPL_NM(bs3TestCallDoerEpilogue), , 0
         pop     xBX
         xPOPF
         pop     xBP
-%if TMPL_BITS == 16
-        retf
-%else
         ret
-%endif
 
 ;
 ; For checking that the mode switching macros doesn't screw up GPRs.
@@ -216,10 +275,10 @@ BS3_GLOBAL_NAME_EX TMPL_NM(bs3TestCallDoerEpilogue), , 0
 ;;
 ; @cproto   BS3_DECL(uint8_t) Bs3TestCallDoerInRM(uint16_t offBs3Text16);
 ; @uses     rax
-BS3_PROC_BEGIN_MODE Bs3TestCallDoerInRM, BS3_PBC_FAR
+BS3_PROC_BEGIN_MODE Bs3TestCallDoerInRM, BS3_PBC_NEAR
         BS3_LEA_MOV_WRT_RIP(xAX, .doit)
         jmp     TMPL_NM(bs3TestCallDoerPrologue)
-BS3_BEGIN_TEXT16
+MY_BEGIN_TEXT16
 BS3_SET_BITS TMPL_BITS
 .doit:
         mov     ax, [xBP + xCB + cbCurRetAddr]      ; Load far function pointer.
@@ -227,7 +286,11 @@ BS3_SET_BITS TMPL_BITS
 
         ; Mode switch, make the call, switch back.
         STRICT_SAVE_REGS
+%if TMPL_MODE == BS3_MODE_RM
+        call far TMPL_FAR_NM(Bs3SwitchToRM)
+%else
         call    TMPL_NM(Bs3SwitchToRM)
+%endif
         BS3_SET_BITS 16
         STRICT_CHECK_REGS
 
@@ -242,11 +305,15 @@ BS3_SET_BITS TMPL_BITS
 .return:
 
         STRICT_SAVE_REGS
-        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_rm)
+%if TMPL_MODE == BS3_MODE_RM
+        call far RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_rm_far)
+%else
+        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_rm)
+%endif
         BS3_SET_BITS TMPL_BITS
         STRICT_CHECK_REGS
         jmp     TMPL_NM(bs3TestCallDoerEpilogue)
-TMPL_BEGIN_TEXT
+MY_BEGIN_TEXT
 BS3_PROC_END_MODE   Bs3TestCallDoerInRM
 
 
@@ -257,10 +324,10 @@ BS3_PROC_END_MODE   Bs3TestCallDoerInRM
 ;;
 ; @cproto   BS3_DECL(uint8_t) Bs3TestCallDoerInPE16(uint16_t offBs3Text16);
 ; @uses     rax
-BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPE16, BS3_PBC_FAR
+BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPE16, BS3_PBC_NEAR
         BS3_LEA_MOV_WRT_RIP(xAX, .doit)
         jmp     TMPL_NM(bs3TestCallDoerPrologue)
-BS3_BEGIN_TEXT16
+MY_BEGIN_TEXT16
 BS3_SET_BITS TMPL_BITS
 .doit:
         mov     ax, [xBP + xCB + cbCurRetAddr]      ; Load far function pointer.
@@ -268,7 +335,11 @@ BS3_SET_BITS TMPL_BITS
 
         ; Mode switch, make the call, switch back.
         STRICT_SAVE_REGS
+%if TMPL_MODE == BS3_MODE_RM
+        call far TMPL_FAR_NM(Bs3SwitchToPE16)
+%else
         call    TMPL_NM(Bs3SwitchToPE16)
+%endif
         BS3_SET_BITS 16
         STRICT_CHECK_REGS
 
@@ -281,16 +352,20 @@ BS3_SET_BITS TMPL_BITS
 .return:
 
         STRICT_SAVE_REGS
-        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pe16)
+%if TMPL_MODE == BS3_MODE_RM
+        call far RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pe16_far)
+%else
+        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pe16)
+%endif
         BS3_SET_BITS TMPL_BITS
         jmp     TMPL_NM(bs3TestCallDoerEpilogue)
-TMPL_BEGIN_TEXT
+MY_BEGIN_TEXT
 BS3_PROC_END_MODE   Bs3TestCallDoerInPE16
 
 ;;
 ; @cproto   BS3_DECL(uint8_t) Bs3TestCallDoerInPE16_32(uint16_t offBs3Text16);
 ; @uses     rax
-BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPE16_32, BS3_PBC_FAR
+BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPE16_32, BS3_PBC_NEAR
         BS3_LEA_MOV_WRT_RIP(xAX, .doit)
         jmp     TMPL_NM(bs3TestCallDoerPrologue)
 .doit:
@@ -298,7 +373,11 @@ BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPE16_32, BS3_PBC_FAR
 
         ; Mode switch, make the call, switch back.
         STRICT_SAVE_REGS
+%if TMPL_MODE == BS3_MODE_RM
+        call far TMPL_FAR_NM(Bs3SwitchToPE16_32)
+%else
         call    TMPL_NM(Bs3SwitchToPE16_32)
+%endif
         BS3_SET_BITS 32
         STRICT_CHECK_REGS
 
@@ -306,7 +385,7 @@ BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPE16_32, BS3_PBC_FAR
         call    eax
 
         STRICT_SAVE_REGS
-        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pe16_32)
+        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pe16_32)
         BS3_SET_BITS TMPL_BITS
         STRICT_CHECK_REGS
         jmp     TMPL_NM(bs3TestCallDoerEpilogue)
@@ -315,7 +394,7 @@ BS3_PROC_END_MODE   Bs3TestCallDoerInPE16_32
 ;;
 ; @cproto   BS3_DECL(uint8_t) Bs3TestCallDoerInPE16_V86(uint16_t offBs3Text16);
 ; @uses     rax
-BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPE16_V86, BS3_PBC_FAR
+BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPE16_V86, BS3_PBC_NEAR
         BS3_LEA_MOV_WRT_RIP(xAX, .doit)
         jmp     TMPL_NM(bs3TestCallDoerPrologue)
 .doit:
@@ -324,7 +403,11 @@ BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPE16_V86, BS3_PBC_FAR
 
         ; Mode switch, make the call, switch back.
         STRICT_SAVE_REGS
+%if TMPL_MODE == BS3_MODE_RM
+        call far TMPL_FAR_NM(Bs3SwitchToPE16_V86)
+%else
         call    TMPL_NM(Bs3SwitchToPE16_V86)
+%endif
         BS3_SET_BITS 16
         STRICT_CHECK_REGS
 
@@ -337,7 +420,11 @@ BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPE16_V86, BS3_PBC_FAR
 .return:
 
         STRICT_SAVE_REGS
-        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pe16_v86)
+%if TMPL_MODE == BS3_MODE_RM
+        call far RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pe16_v86_far)
+%else
+        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pe16_v86)
+%endif
         BS3_SET_BITS TMPL_BITS
         STRICT_CHECK_REGS
         jmp     TMPL_NM(bs3TestCallDoerEpilogue)
@@ -346,7 +433,7 @@ BS3_PROC_END_MODE   Bs3TestCallDoerInPE16_V86
 ;;
 ; @cproto   BS3_DECL(uint8_t) Bs3TestCallDoerInPE32(uint16_t offBs3Text16);
 ; @uses     rax
-BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPE32, BS3_PBC_FAR
+BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPE32, BS3_PBC_NEAR
         BS3_LEA_MOV_WRT_RIP(xAX, .doit)
         jmp     TMPL_NM(bs3TestCallDoerPrologue)
 .doit:
@@ -354,7 +441,11 @@ BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPE32, BS3_PBC_FAR
 
         ; Mode switch, make the call, switch back.
         STRICT_SAVE_REGS
+%if TMPL_MODE == BS3_MODE_RM
+        call far TMPL_FAR_NM(Bs3SwitchToPE32)
+%else
         call    TMPL_NM(Bs3SwitchToPE32)
+%endif
         BS3_SET_BITS 32
         STRICT_CHECK_REGS
 
@@ -362,7 +453,7 @@ BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPE32, BS3_PBC_FAR
         call    eax
 
         STRICT_SAVE_REGS
-        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pe32)
+        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pe32)
         BS3_SET_BITS TMPL_BITS
         STRICT_CHECK_REGS
         jmp     TMPL_NM(bs3TestCallDoerEpilogue)
@@ -371,10 +462,10 @@ BS3_PROC_END_MODE   Bs3TestCallDoerInPE32
 ;;
 ; @cproto   BS3_DECL(uint8_t) Bs3TestCallDoerInPE32_16(uint16_t offBs3Text16);
 ; @uses     rax
-BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPE32_16, BS3_PBC_FAR
+BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPE32_16, BS3_PBC_NEAR
         BS3_LEA_MOV_WRT_RIP(xAX, .doit)
         jmp     TMPL_NM(bs3TestCallDoerPrologue)
-BS3_BEGIN_TEXT16
+MY_BEGIN_TEXT16
 BS3_SET_BITS TMPL_BITS
 .doit:
         mov     ax, [xBP + xCB + cbCurRetAddr]      ; Load far function pointer.
@@ -382,7 +473,11 @@ BS3_SET_BITS TMPL_BITS
 
         ; Mode switch, make the call, switch back.
         STRICT_SAVE_REGS
+%if TMPL_MODE == BS3_MODE_RM
+        call far TMPL_FAR_NM(Bs3SwitchToPE32_16)
+%else
         call    TMPL_NM(Bs3SwitchToPE32_16)
+%endif
         BS3_SET_BITS 16
         STRICT_CHECK_REGS
 
@@ -395,20 +490,24 @@ BS3_SET_BITS TMPL_BITS
 .return:
 
         STRICT_SAVE_REGS
-        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pe32_16)
+%if TMPL_MODE == BS3_MODE_RM
+        call far RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pe32_16_far)
+%else
+        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pe32_16)
+%endif
         BS3_SET_BITS TMPL_BITS
         STRICT_CHECK_REGS
         jmp     TMPL_NM(bs3TestCallDoerEpilogue)
-TMPL_BEGIN_TEXT
+MY_BEGIN_TEXT
 BS3_PROC_END_MODE   Bs3TestCallDoerInPE32_16
 
 ;;
 ; @cproto   BS3_DECL(uint8_t) Bs3TestCallDoerInPEV86(uint16_t offBs3Text16);
 ; @uses     rax
-BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPEV86, BS3_PBC_FAR
+BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPEV86, BS3_PBC_NEAR
         BS3_LEA_MOV_WRT_RIP(xAX, .doit)
         jmp     TMPL_NM(bs3TestCallDoerPrologue)
-BS3_BEGIN_TEXT16
+MY_BEGIN_TEXT16
 BS3_SET_BITS TMPL_BITS
 .doit:
         mov     ax, [xBP + xCB + cbCurRetAddr]      ; Load far function pointer.
@@ -416,7 +515,11 @@ BS3_SET_BITS TMPL_BITS
 
         ; Mode switch, make the call, switch back.
         STRICT_SAVE_REGS
+%if TMPL_MODE == BS3_MODE_RM
+        call far TMPL_FAR_NM(Bs3SwitchToPEV86)
+%else
         call    TMPL_NM(Bs3SwitchToPEV86)
+%endif
         BS3_SET_BITS 16
         STRICT_CHECK_REGS
 
@@ -429,11 +532,15 @@ BS3_SET_BITS TMPL_BITS
 .return:
 
         STRICT_SAVE_REGS
-        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pev86)
+%if TMPL_MODE == BS3_MODE_RM
+        call far RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pev86_far)
+%else
+        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pev86)
+%endif
         BS3_SET_BITS TMPL_BITS
         STRICT_CHECK_REGS
         jmp     TMPL_NM(bs3TestCallDoerEpilogue)
-TMPL_BEGIN_TEXT
+MY_BEGIN_TEXT
 BS3_PROC_END_MODE   Bs3TestCallDoerInPEV86
 
 
@@ -445,10 +552,10 @@ BS3_PROC_END_MODE   Bs3TestCallDoerInPEV86
 ;;
 ; @cproto   BS3_DECL(uint8_t) Bs3TestCallDoerInPP16(uint16_t offBs3Text16);
 ; @uses     rax
-BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPP16, BS3_PBC_FAR
+BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPP16, BS3_PBC_NEAR
         BS3_LEA_MOV_WRT_RIP(xAX, .doit)
         jmp     TMPL_NM(bs3TestCallDoerPrologue)
-BS3_BEGIN_TEXT16
+MY_BEGIN_TEXT16
 BS3_SET_BITS TMPL_BITS
 .doit:
         mov     ax, [xBP + xCB + cbCurRetAddr]      ; Load far function pointer.
@@ -456,7 +563,11 @@ BS3_SET_BITS TMPL_BITS
 
         ; Mode switch, make the call, switch back.
         STRICT_SAVE_REGS
+%if TMPL_MODE == BS3_MODE_RM
+        call far TMPL_FAR_NM(Bs3SwitchToPP16)
+%else
         call    TMPL_NM(Bs3SwitchToPP16)
+%endif
         BS3_SET_BITS 16
         STRICT_CHECK_REGS
 
@@ -469,17 +580,21 @@ BS3_SET_BITS TMPL_BITS
 .return:
 
         STRICT_SAVE_REGS
-        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pp16)
+%if TMPL_MODE == BS3_MODE_RM
+        call far RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pp16_far)
+%else
+        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pp16)
+%endif
         BS3_SET_BITS TMPL_BITS
         STRICT_CHECK_REGS
         jmp     TMPL_NM(bs3TestCallDoerEpilogue)
-TMPL_BEGIN_TEXT
+MY_BEGIN_TEXT
 BS3_PROC_END_MODE   Bs3TestCallDoerInPP16
 
 ;;
 ; @cproto   BS3_DECL(uint8_t) Bs3TestCallDoerInPP16_32(uint16_t offBs3Text16);
 ; @uses     rax
-BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPP16_32, BS3_PBC_FAR
+BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPP16_32, BS3_PBC_NEAR
         BS3_LEA_MOV_WRT_RIP(xAX, .doit)
         jmp     TMPL_NM(bs3TestCallDoerPrologue)
 .doit:
@@ -487,7 +602,11 @@ BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPP16_32, BS3_PBC_FAR
 
         ; Mode switch, make the call, switch back.
         STRICT_SAVE_REGS
+%if TMPL_MODE == BS3_MODE_RM
+        call far TMPL_FAR_NM(Bs3SwitchToPP16_32)
+%else
         call    TMPL_NM(Bs3SwitchToPP16_32)
+%endif
         BS3_SET_BITS 32
         STRICT_CHECK_REGS
 
@@ -495,7 +614,7 @@ BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPP16_32, BS3_PBC_FAR
         call    eax
 
         STRICT_SAVE_REGS
-        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pp16_32)
+        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pp16_32)
         BS3_SET_BITS TMPL_BITS
         STRICT_CHECK_REGS
         jmp     TMPL_NM(bs3TestCallDoerEpilogue)
@@ -504,7 +623,7 @@ BS3_PROC_END_MODE   Bs3TestCallDoerInPP16_32
 ;;
 ; @cproto   BS3_DECL(uint8_t) Bs3TestCallDoerInPP16_V86(uint16_t offBs3Text16);
 ; @uses     rax
-BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPP16_V86, BS3_PBC_FAR
+BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPP16_V86, BS3_PBC_NEAR
         BS3_LEA_MOV_WRT_RIP(xAX, .doit)
         jmp     TMPL_NM(bs3TestCallDoerPrologue)
 .doit:
@@ -513,7 +632,11 @@ BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPP16_V86, BS3_PBC_FAR
 
         ; Mode switch, make the call, switch back.
         STRICT_SAVE_REGS
+%if TMPL_MODE == BS3_MODE_RM
+        call far TMPL_FAR_NM(Bs3SwitchToPP16_V86)
+%else
         call    TMPL_NM(Bs3SwitchToPP16_V86)
+%endif
         BS3_SET_BITS 16
         STRICT_CHECK_REGS
 
@@ -526,7 +649,11 @@ BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPP16_V86, BS3_PBC_FAR
 .return:
 
         STRICT_SAVE_REGS
-        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pp16_v86)
+%if TMPL_MODE == BS3_MODE_RM
+        call far RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pp16_v86_far)
+%else
+        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pp16_v86)
+%endif
         BS3_SET_BITS TMPL_BITS
         STRICT_CHECK_REGS
         jmp     TMPL_NM(bs3TestCallDoerEpilogue)
@@ -535,7 +662,7 @@ BS3_PROC_END_MODE   Bs3TestCallDoerInPP16_V86
 ;;
 ; @cproto   BS3_DECL(uint8_t) Bs3TestCallDoerInPP32(uint16_t offBs3Text16);
 ; @uses     rax
-BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPP32, BS3_PBC_FAR
+BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPP32, BS3_PBC_NEAR
         BS3_LEA_MOV_WRT_RIP(xAX, .doit)
         jmp     TMPL_NM(bs3TestCallDoerPrologue)
 .doit:
@@ -543,7 +670,11 @@ BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPP32, BS3_PBC_FAR
 
         ; Mode switch, make the call, switch back.
         STRICT_SAVE_REGS
+%if TMPL_MODE == BS3_MODE_RM
+        call far TMPL_FAR_NM(Bs3SwitchToPP32)
+%else
         call    TMPL_NM(Bs3SwitchToPP32)
+%endif
         BS3_SET_BITS 32
         STRICT_CHECK_REGS
 
@@ -551,7 +682,7 @@ BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPP32, BS3_PBC_FAR
         call    eax
 
         STRICT_SAVE_REGS
-        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pp32)
+        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pp32)
         BS3_SET_BITS TMPL_BITS
         STRICT_CHECK_REGS
         jmp     TMPL_NM(bs3TestCallDoerEpilogue)
@@ -560,10 +691,10 @@ BS3_PROC_END_MODE   Bs3TestCallDoerInPP32
 ;;
 ; @cproto   BS3_DECL(uint8_t) Bs3TestCallDoerInPP32_16(uint16_t offBs3Text16);
 ; @uses     rax
-BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPP32_16, BS3_PBC_FAR
+BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPP32_16, BS3_PBC_NEAR
         BS3_LEA_MOV_WRT_RIP(xAX, .doit)
         jmp     TMPL_NM(bs3TestCallDoerPrologue)
-BS3_BEGIN_TEXT16
+MY_BEGIN_TEXT16
 BS3_SET_BITS TMPL_BITS
 .doit:
         mov     ax, [xBP + xCB + cbCurRetAddr]      ; Load far function pointer.
@@ -571,7 +702,11 @@ BS3_SET_BITS TMPL_BITS
 
         ; Mode switch, make the call, switch back.
         STRICT_SAVE_REGS
+%if TMPL_MODE == BS3_MODE_RM
+        call far TMPL_FAR_NM(Bs3SwitchToPP32_16)
+%else
         call    TMPL_NM(Bs3SwitchToPP32_16)
+%endif
         BS3_SET_BITS 16
         STRICT_CHECK_REGS
 
@@ -584,20 +719,24 @@ BS3_SET_BITS TMPL_BITS
 .return:
 
         STRICT_SAVE_REGS
-        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pp32_16)
+%if TMPL_MODE == BS3_MODE_RM
+        call far RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pp32_16_far)
+%else
+        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pp32_16)
+%endif
         BS3_SET_BITS TMPL_BITS
         STRICT_CHECK_REGS
         jmp     TMPL_NM(bs3TestCallDoerEpilogue)
-TMPL_BEGIN_TEXT
+MY_BEGIN_TEXT
 BS3_PROC_END_MODE   Bs3TestCallDoerInPP32_16
 
 ;;
 ; @cproto   BS3_DECL(uint8_t) Bs3TestCallDoerInPPV86(uint16_t offBs3Text16);
 ; @uses     rax
-BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPPV86, BS3_PBC_FAR
+BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPPV86, BS3_PBC_NEAR
         BS3_LEA_MOV_WRT_RIP(xAX, .doit)
         jmp     TMPL_NM(bs3TestCallDoerPrologue)
-BS3_BEGIN_TEXT16
+MY_BEGIN_TEXT16
 BS3_SET_BITS TMPL_BITS
 .doit:
         mov     ax, [xBP + xCB + cbCurRetAddr]      ; Load far function pointer.
@@ -605,7 +744,11 @@ BS3_SET_BITS TMPL_BITS
 
         ; Mode switch, make the call, switch back.
         STRICT_SAVE_REGS
+%if TMPL_MODE == BS3_MODE_RM
+        call far TMPL_FAR_NM(Bs3SwitchToPPV86)
+%else
         call    TMPL_NM(Bs3SwitchToPPV86)
+%endif
         BS3_SET_BITS 16
         STRICT_CHECK_REGS
 
@@ -618,11 +761,15 @@ BS3_SET_BITS TMPL_BITS
 .return:
 
         STRICT_SAVE_REGS
-        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_ppv86)
+%if TMPL_MODE == BS3_MODE_RM
+        call far RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_ppv86_far)
+%else
+        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_ppv86)
+%endif
         BS3_SET_BITS TMPL_BITS
         STRICT_CHECK_REGS
         jmp     TMPL_NM(bs3TestCallDoerEpilogue)
-TMPL_BEGIN_TEXT
+MY_BEGIN_TEXT
 BS3_PROC_END_MODE   Bs3TestCallDoerInPPV86
 
 
@@ -634,10 +781,10 @@ BS3_PROC_END_MODE   Bs3TestCallDoerInPPV86
 ;;
 ; @cproto   BS3_DECL(uint8_t) Bs3TestCallDoerInPAE16(uint16_t offBs3Text16);
 ; @uses     rax
-BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPAE16, BS3_PBC_FAR
+BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPAE16, BS3_PBC_NEAR
         BS3_LEA_MOV_WRT_RIP(xAX, .doit)
         jmp     TMPL_NM(bs3TestCallDoerPrologue)
-BS3_BEGIN_TEXT16
+MY_BEGIN_TEXT16
 BS3_SET_BITS TMPL_BITS
 .doit:
         mov     ax, [xBP + xCB + cbCurRetAddr]      ; Load far function pointer.
@@ -645,7 +792,11 @@ BS3_SET_BITS TMPL_BITS
 
         ; Mode switch, make the call, switch back.
         STRICT_SAVE_REGS
+%if TMPL_MODE == BS3_MODE_RM
+        call far TMPL_FAR_NM(Bs3SwitchToPAE16)
+%else
         call    TMPL_NM(Bs3SwitchToPAE16)
+%endif
         BS3_SET_BITS 16
         STRICT_CHECK_REGS
 
@@ -658,17 +809,21 @@ BS3_SET_BITS TMPL_BITS
 .return:
 
         STRICT_SAVE_REGS
-        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pae16)
+%if TMPL_MODE == BS3_MODE_RM
+        call far RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pae16_far)
+%else
+        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pae16)
+%endif
         BS3_SET_BITS TMPL_BITS
         STRICT_CHECK_REGS
         jmp     TMPL_NM(bs3TestCallDoerEpilogue)
-TMPL_BEGIN_TEXT
+MY_BEGIN_TEXT
 BS3_PROC_END_MODE   Bs3TestCallDoerInPAE16
 
 ;;
 ; @cproto   BS3_DECL(uint8_t) Bs3TestCallDoerInPAE16_32(uint16_t offBs3Text16);
 ; @uses     rax
-BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPAE16_32, BS3_PBC_FAR
+BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPAE16_32, BS3_PBC_NEAR
         BS3_LEA_MOV_WRT_RIP(xAX, .doit)
         jmp     TMPL_NM(bs3TestCallDoerPrologue)
 .doit:
@@ -676,7 +831,11 @@ BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPAE16_32, BS3_PBC_FAR
 
         ; Mode switch, make the call, switch back.
         STRICT_SAVE_REGS
+%if TMPL_MODE == BS3_MODE_RM
+        call far TMPL_FAR_NM(Bs3SwitchToPAE16_32)
+%else
         call    TMPL_NM(Bs3SwitchToPAE16_32)
+%endif
         BS3_SET_BITS 32
         STRICT_CHECK_REGS
 
@@ -684,7 +843,7 @@ BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPAE16_32, BS3_PBC_FAR
         call    eax
 
         STRICT_SAVE_REGS
-        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pae16_32)
+        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pae16_32)
         BS3_SET_BITS TMPL_BITS
         STRICT_CHECK_REGS
         jmp     TMPL_NM(bs3TestCallDoerEpilogue)
@@ -693,7 +852,7 @@ BS3_PROC_END_MODE   Bs3TestCallDoerInPAE16_32
 ;;
 ; @cproto   BS3_DECL(uint8_t) Bs3TestCallDoerInPAE16_V86(uint16_t offBs3Text16);
 ; @uses     rax
-BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPAE16_V86, BS3_PBC_FAR
+BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPAE16_V86, BS3_PBC_NEAR
         BS3_LEA_MOV_WRT_RIP(xAX, .doit)
         jmp     TMPL_NM(bs3TestCallDoerPrologue)
 .doit:
@@ -702,7 +861,11 @@ BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPAE16_V86, BS3_PBC_FAR
 
         ; Mode switch, make the call, switch back.
         STRICT_SAVE_REGS
+%if TMPL_MODE == BS3_MODE_RM
+        call far TMPL_FAR_NM(Bs3SwitchToPAE16_V86)
+%else
         call    TMPL_NM(Bs3SwitchToPAE16_V86)
+%endif
         BS3_SET_BITS 16
         STRICT_CHECK_REGS
 
@@ -715,7 +878,11 @@ BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPAE16_V86, BS3_PBC_FAR
 .return:
 
         STRICT_SAVE_REGS
-        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pae16_v86)
+%if TMPL_MODE == BS3_MODE_RM
+        call far RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pae16_v86_far)
+%else
+        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pae16_v86)
+%endif
         BS3_SET_BITS TMPL_BITS
         STRICT_CHECK_REGS
         jmp     TMPL_NM(bs3TestCallDoerEpilogue)
@@ -724,7 +891,7 @@ BS3_PROC_END_MODE   Bs3TestCallDoerInPAE16_V86
 ;;
 ; @cproto   BS3_DECL(uint8_t) Bs3TestCallDoerInPAE32(uint16_t offBs3Text16);
 ; @uses     rax
-BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPAE32, BS3_PBC_FAR
+BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPAE32, BS3_PBC_NEAR
         BS3_LEA_MOV_WRT_RIP(xAX, .doit)
         jmp     TMPL_NM(bs3TestCallDoerPrologue)
 .doit:
@@ -732,7 +899,11 @@ BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPAE32, BS3_PBC_FAR
 
         ; Mode switch, make the call, switch back.
         STRICT_SAVE_REGS
+%if TMPL_MODE == BS3_MODE_RM
+        call far TMPL_FAR_NM(Bs3SwitchToPAE32)
+%else
         call    TMPL_NM(Bs3SwitchToPAE32)
+%endif
         BS3_SET_BITS 32
         STRICT_CHECK_REGS
 
@@ -740,7 +911,7 @@ BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPAE32, BS3_PBC_FAR
         call    eax
 
         STRICT_SAVE_REGS
-        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pae32)
+        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pae32)
         BS3_SET_BITS TMPL_BITS
         STRICT_CHECK_REGS
         jmp     TMPL_NM(bs3TestCallDoerEpilogue)
@@ -749,10 +920,10 @@ BS3_PROC_END_MODE   Bs3TestCallDoerInPAE32
 ;;
 ; @cproto   BS3_DECL(uint8_t) Bs3TestCallDoerInPAE32_16(uint16_t offBs3Text16);
 ; @uses     rax
-BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPAE32_16, BS3_PBC_FAR
+BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPAE32_16, BS3_PBC_NEAR
         BS3_LEA_MOV_WRT_RIP(xAX, .doit)
         jmp     TMPL_NM(bs3TestCallDoerPrologue)
-BS3_BEGIN_TEXT16
+MY_BEGIN_TEXT16
 BS3_SET_BITS TMPL_BITS
 .doit:
         mov     ax, [xBP + xCB + cbCurRetAddr]      ; Load far function pointer.
@@ -760,7 +931,11 @@ BS3_SET_BITS TMPL_BITS
 
         ; Mode switch, make the call, switch back.
         STRICT_SAVE_REGS
+%if TMPL_MODE == BS3_MODE_RM
+        call far TMPL_FAR_NM(Bs3SwitchToPAE32_16)
+%else
         call    TMPL_NM(Bs3SwitchToPAE32_16)
+%endif
         BS3_SET_BITS 16
         STRICT_CHECK_REGS
 
@@ -773,20 +948,24 @@ BS3_SET_BITS TMPL_BITS
 .return:
 
         STRICT_SAVE_REGS
-        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pae32_16)
+%if TMPL_MODE == BS3_MODE_RM
+        call far RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_pae32_16_far)
+%else
+        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_pae32_16)
+%endif
         BS3_SET_BITS TMPL_BITS
         STRICT_CHECK_REGS
         jmp     TMPL_NM(bs3TestCallDoerEpilogue)
-TMPL_BEGIN_TEXT
+MY_BEGIN_TEXT
 BS3_PROC_END_MODE   Bs3TestCallDoerInPAE32_16
 
 ;;
 ; @cproto   BS3_DECL(uint8_t) Bs3TestCallDoerInPAEV86(uint16_t offBs3Text16);
 ; @uses     rax
-BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPAEV86, BS3_PBC_FAR
+BS3_PROC_BEGIN_MODE Bs3TestCallDoerInPAEV86, BS3_PBC_NEAR
         BS3_LEA_MOV_WRT_RIP(xAX, .doit)
         jmp     TMPL_NM(bs3TestCallDoerPrologue)
-BS3_BEGIN_TEXT16
+MY_BEGIN_TEXT16
 BS3_SET_BITS TMPL_BITS
 .doit:
         mov     ax, [xBP + xCB + cbCurRetAddr]      ; Load far function pointer.
@@ -794,7 +973,11 @@ BS3_SET_BITS TMPL_BITS
 
         ; Mode switch, make the call, switch back.
         STRICT_SAVE_REGS
+%if TMPL_MODE == BS3_MODE_RM
+        call far TMPL_FAR_NM(Bs3SwitchToPAEV86)
+%else
         call    TMPL_NM(Bs3SwitchToPAEV86)
+%endif
         BS3_SET_BITS 16
         STRICT_CHECK_REGS
 
@@ -807,11 +990,15 @@ BS3_SET_BITS TMPL_BITS
 .return:
 
         STRICT_SAVE_REGS
-        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_paev86)
+%if TMPL_MODE == BS3_MODE_RM
+        call far RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_paev86_far)
+%else
+        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_paev86)
+%endif
         BS3_SET_BITS TMPL_BITS
         STRICT_CHECK_REGS
         jmp     TMPL_NM(bs3TestCallDoerEpilogue)
-TMPL_BEGIN_TEXT
+MY_BEGIN_TEXT
 BS3_PROC_END_MODE   Bs3TestCallDoerInPAEV86
 
 
@@ -823,10 +1010,10 @@ BS3_PROC_END_MODE   Bs3TestCallDoerInPAEV86
 ;;
 ; @cproto   BS3_DECL(uint8_t) Bs3TestCallDoerInLM16(uint16_t offBs3Text16);
 ; @uses     rax
-BS3_PROC_BEGIN_MODE Bs3TestCallDoerInLM16, BS3_PBC_FAR
+BS3_PROC_BEGIN_MODE Bs3TestCallDoerInLM16, BS3_PBC_NEAR
         BS3_LEA_MOV_WRT_RIP(xAX, .doit)
         jmp     TMPL_NM(bs3TestCallDoerPrologue)
-BS3_BEGIN_TEXT16
+MY_BEGIN_TEXT16
 BS3_SET_BITS TMPL_BITS
 .doit:
         mov     ax, [xBP + xCB + cbCurRetAddr]      ; Load far function pointer.
@@ -834,7 +1021,11 @@ BS3_SET_BITS TMPL_BITS
 
         ; Mode switch, make the call, switch back.
         STRICT_SAVE_REGS
+%if TMPL_MODE == BS3_MODE_RM
+        call far TMPL_FAR_NM(Bs3SwitchToLM16)
+%else
         call    TMPL_NM(Bs3SwitchToLM16)
+%endif
         BS3_SET_BITS 16
         STRICT_CHECK_REGS
 
@@ -847,17 +1038,21 @@ BS3_SET_BITS TMPL_BITS
 .return:
 
         STRICT_SAVE_REGS
-        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_lm16)
+%if TMPL_MODE == BS3_MODE_RM
+        call far RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_lm16_far)
+%else
+        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_lm16)
+%endif
         BS3_SET_BITS TMPL_BITS
         STRICT_CHECK_REGS
         jmp     TMPL_NM(bs3TestCallDoerEpilogue)
-TMPL_BEGIN_TEXT
+MY_BEGIN_TEXT
 BS3_PROC_END_MODE   Bs3TestCallDoerInLM16
 
 ;;
 ; @cproto   BS3_DECL(uint8_t) Bs3TestCallDoerInLM32(uint16_t offBs3Text16);
 ; @uses     rax
-BS3_PROC_BEGIN_MODE Bs3TestCallDoerInLM32, BS3_PBC_FAR
+BS3_PROC_BEGIN_MODE Bs3TestCallDoerInLM32, BS3_PBC_NEAR
         BS3_LEA_MOV_WRT_RIP(xAX, .doit)
         jmp     TMPL_NM(bs3TestCallDoerPrologue)
 .doit:
@@ -865,7 +1060,11 @@ BS3_PROC_BEGIN_MODE Bs3TestCallDoerInLM32, BS3_PBC_FAR
 
         ; Mode switch, make the call, switch back.
         STRICT_SAVE_REGS
+%if TMPL_MODE == BS3_MODE_RM
+        call far TMPL_FAR_NM(Bs3SwitchToLM32)
+%else
         call    TMPL_NM(Bs3SwitchToLM32)
+%endif
         BS3_SET_BITS 32
         STRICT_CHECK_REGS
 
@@ -874,7 +1073,7 @@ BS3_PROC_BEGIN_MODE Bs3TestCallDoerInLM32, BS3_PBC_FAR
         call    eax
 
         STRICT_SAVE_REGS
-        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_lm32)
+        call    RT_CONCAT3(_Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_lm32)
         BS3_SET_BITS TMPL_BITS
         STRICT_CHECK_REGS
         jmp     TMPL_NM(bs3TestCallDoerEpilogue)
@@ -883,7 +1082,7 @@ BS3_PROC_END_MODE   Bs3TestCallDoerInLM32
 ;;
 ; @cproto   BS3_DECL(uint8_t) Bs3TestCallDoerInLM64(uint16_t offBs3Text16);
 ; @uses     rax
-BS3_PROC_BEGIN_MODE Bs3TestCallDoerInLM64, BS3_PBC_FAR
+BS3_PROC_BEGIN_MODE Bs3TestCallDoerInLM64, BS3_PBC_NEAR
         BS3_LEA_MOV_WRT_RIP(xAX, .doit)
         jmp     TMPL_NM(bs3TestCallDoerPrologue)
 .doit:
@@ -891,7 +1090,11 @@ BS3_PROC_BEGIN_MODE Bs3TestCallDoerInLM64, BS3_PBC_FAR
 
         ; Mode switch, make the call, switch back.
         STRICT_SAVE_REGS
+%if TMPL_MODE == BS3_MODE_RM
+        call far TMPL_FAR_NM(Bs3SwitchToLM64)
+%else
         call    TMPL_NM(Bs3SwitchToLM64)
+%endif
         BS3_SET_BITS 64
         STRICT_CHECK_REGS
 
@@ -901,9 +1104,31 @@ BS3_PROC_BEGIN_MODE Bs3TestCallDoerInLM64, BS3_PBC_FAR
         BS3_CALL rax, 1
 
         STRICT_SAVE_REGS
-        call    RT_CONCAT3(Bs3SwitchTo,TMPL_MODE_UNAME,_lm64)
+        call    RT_CONCAT3(Bs3SwitchTo,TMPL_MODE_UNAME,_Safe_lm64)
         BS3_SET_BITS TMPL_BITS
         STRICT_CHECK_REGS
         jmp     TMPL_NM(bs3TestCallDoerEpilogue)
 BS3_PROC_END_MODE   Bs3TestCallDoerInLM64
 
+
+;
+; Finally near stub for the API call (16-bit only).
+;
+%if TMPL_BITS == 16
+BS3_BEGIN_TEXT16_NEARSTUBS
+BS3_PROC_BEGIN_MODE Bs3TestDoModes, BS3_PBC_NEAR
+        pop     ax
+ %if TMPL_MODE == BS3_MODE_RM
+        push    cs
+        push    ax
+        extern TMPL_FAR_NM(Bs3TestDoModes):wrt BS3GROUPRMTEXT16
+        jmp far TMPL_FAR_NM(Bs3TestDoModes)
+ %else
+        push    cs
+        push    ax
+        extern TMPL_FAR_NM(Bs3TestDoModes):wrt CGROUP16
+        jmp     TMPL_NM(Bs3TestDoModes)
+ %endif
+BS3_PROC_END_MODE   Bs3TestDoModes
+
+%endif
diff --git a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-TrapSystemCallHandler.asm b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-TrapSystemCallHandler.asm
index f8db2b33c00..77efb16aaf3 100644
--- a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-TrapSystemCallHandler.asm
+++ b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-TrapSystemCallHandler.asm
@@ -66,7 +66,7 @@ TMPL_BEGIN_TEXT
 ;       registers as we wish this code to work on real 80286 (maybe even 8086)
 ;       CPUs too!
 ;
-BS3_PROC_BEGIN_MODE Bs3TrapSystemCallHandler, BS3_PBC_NEAR ; Near because we'll probably only ever need this from BS3TEXT16.
+BS3_PROC_BEGIN_MODE Bs3TrapSystemCallHandler, BS3_PBC_NEAR ; Near because we'll probably only ever need this from CGROUP16.
         ;
         ; This prologue is kind of complicated because of 80286 and older CPUs
         ; as well as different requirements for 64-bit and the other modes.
@@ -167,14 +167,14 @@ BS3_PROC_BEGIN_MODE Bs3TrapSystemCallHandler, BS3_PBC_NEAR ; Near because we'll
 %endif
 .aoffSyscallHandlers:
 %ifdef TMPL_16BIT
-        dw      .invalid_syscall wrt BS3TEXT16
-        dw      .print_chr       wrt BS3TEXT16
-        dw      .print_str       wrt BS3TEXT16
-        dw      .to_ringX        wrt BS3TEXT16
-        dw      .to_ringX        wrt BS3TEXT16
-        dw      .to_ringX        wrt BS3TEXT16
-        dw      .to_ringX        wrt BS3TEXT16
-        dw      .restore_ctx     wrt BS3TEXT16
+        dw      .invalid_syscall wrt CGROUP16
+        dw      .print_chr       wrt CGROUP16
+        dw      .print_str       wrt CGROUP16
+        dw      .to_ringX        wrt CGROUP16
+        dw      .to_ringX        wrt CGROUP16
+        dw      .to_ringX        wrt CGROUP16
+        dw      .to_ringX        wrt CGROUP16
+        dw      .restore_ctx     wrt CGROUP16
 %else
         dd      .invalid_syscall wrt FLAT
         dd      .print_chr       wrt FLAT
diff --git a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-rm-InitGdt.c b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-rm-InitGdt.c
index 25f183b1ef6..96e8bd3b427 100644
--- a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-rm-InitGdt.c
+++ b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-rm-InitGdt.c
@@ -43,10 +43,21 @@
 
 BS3_DECL_FAR(void) Bs3InitGdt_rm_far(void)
 {
+#if 1
+    Bs3Gdte_R0_CS16.Gen.u16LimitLow     = Bs3Text16_Size - 1;
+    Bs3Gdte_R1_CS16.Gen.u16LimitLow     = Bs3Text16_Size - 1;
+    Bs3Gdte_R2_CS16.Gen.u16LimitLow     = Bs3Text16_Size - 1;
+    Bs3Gdte_R3_CS16.Gen.u16LimitLow     = Bs3Text16_Size - 1;
+#endif
+    Bs3Gdte_RMTEXT16_CS.Gen.u16LimitLow = Bs3RmText16_Size - 1;
     Bs3Gdte_X0TEXT16_CS.Gen.u16LimitLow = Bs3X0Text16_Size - 1;
-    Bs3Gdte_X1TEXT16_CS.Gen.u16LimitLow = Bs3X0Text16_Size - 1;
+    Bs3Gdte_X1TEXT16_CS.Gen.u16LimitLow = Bs3X1Text16_Size - 1;
+
+    Bs3Gdte_RMTEXT16_CS.Gen.u16BaseLow  = (uint16_t)Bs3RmText16_FlatAddr;
     Bs3Gdte_X0TEXT16_CS.Gen.u16BaseLow  = (uint16_t)Bs3X0Text16_FlatAddr;
     Bs3Gdte_X1TEXT16_CS.Gen.u16BaseLow  = (uint16_t)Bs3X1Text16_FlatAddr;
+
+    Bs3Gdte_RMTEXT16_CS.Gen.u8BaseHigh1 = (uint8_t)(Bs3RmText16_FlatAddr >> 16);
     Bs3Gdte_X0TEXT16_CS.Gen.u8BaseHigh1 = (uint8_t)(Bs3X0Text16_FlatAddr >> 16);
     Bs3Gdte_X1TEXT16_CS.Gen.u8BaseHigh1 = (uint8_t)(Bs3X1Text16_FlatAddr >> 16);
 }
diff --git a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-system-data.asm b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-system-data.asm
index 27e6b02941b..bb0d4a74211 100644
--- a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-system-data.asm
+++ b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-system-data.asm
@@ -176,9 +176,11 @@ BS3GdtAssertOffset 0b0h
         dw  00000h, 00000h, 00000h, 00000h      ; Entry 0c8h - currently unused
         dw  00000h, 00000h, 00000h, 00000h      ; Entry 0d0h - currently unused
         dw  00000h, 00000h, 00000h, 00000h      ; Entry 0d8h - currently unused
-        dw  00000h, 00000h, 00000h, 00000h      ; Entry 0e0h - currently unused
 
         ; Misc selectors.
+BS3_GLOBAL_DATA Bs3Gdte_RMTEXT16_CS, 8          ; Entry 0e0h
+        dw  0fffeh, 00000h                      ; 16-bit conforming code (read+exec) segment, accessed. Will be finalized at startup.
+        dw  09f00h, 00000h
 BS3_GLOBAL_DATA Bs3Gdte_X0TEXT16_CS, 8          ; Entry 0e8h
         dw  0fffeh, 00000h                      ; 16-bit conforming code (read+exec) segment, accessed. Will be finalized at startup.
         dw  09f00h, 00000h
diff --git a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3kit-mangling-data.h b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3kit-mangling-data.h
index 4ec5077193b..18eedf25bd0 100644
--- a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3kit-mangling-data.h
+++ b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3kit-mangling-data.h
@@ -49,6 +49,9 @@
 # define Bs3Gdte_Tss64Spare0                    BS3_DATA_NM(Bs3Gdte_Tss64Spare0)
 # define Bs3Gdte_Tss64Spare1                    BS3_DATA_NM(Bs3Gdte_Tss64Spare1)
 # define Bs3Gdte_Tss64Iobp                      BS3_DATA_NM(Bs3Gdte_Tss64Iobp)
+# define Bs3Gdte_RMTEXT16_CS                    BS3_DATA_NM(Bs3Gdte_RMTEXT16_CS)
+# define Bs3Gdte_X0TEXT16_CS                    BS3_DATA_NM(Bs3Gdte_X0TEXT16_CS)
+# define Bs3Gdte_X1TEXT16_CS                    BS3_DATA_NM(Bs3Gdte_X1TEXT16_CS)
 # define Bs3Gdte_R0_MMIO16                      BS3_DATA_NM(Bs3Gdte_R0_MMIO16)
 
 # define Bs3Gdte_R0_First                       BS3_DATA_NM(Bs3Gdte_R0_First)
@@ -219,21 +222,43 @@
 # define Bs3Text16_StartOfSegment               BS3_DATA_NM(Bs3Text16_StartOfSegment)
 # define Bs3Text16_EndOfSegment                 BS3_DATA_NM(Bs3Text16_EndOfSegment)
 # define Bs3Text16_Size                         BS3_DATA_NM(Bs3Text16_Size)
+
 # define Bs3System16_StartOfSegment             BS3_DATA_NM(Bs3System16_StartOfSegment)
 # define Bs3System16_EndOfSegment               BS3_DATA_NM(Bs3System16_EndOfSegment)
+
 # define Bs3Data16_StartOfSegment               BS3_DATA_NM(Bs3Data16_StartOfSegment)
 # define Bs3Data16_EndOfSegment                 BS3_DATA_NM(Bs3Data16_EndOfSegment)
+
+# define Bs3RmText16_StartOfSegment             BS3_DATA_NM(Bs3RmText16_StartOfSegment)
+# define Bs3RmText16_EndOfSegment               BS3_DATA_NM(Bs3RmText16_EndOfSegment)
+# define Bs3RmText16_Size                       BS3_DATA_NM(Bs3RmText16_Size)
+# define Bs3RmText16_FlatAddr                   BS3_DATA_NM(Bs3RmText16_FlatAddr)
+
+# define Bs3X0Text16_StartOfSegment             BS3_DATA_NM(Bs3X0Text16_StartOfSegment)
+# define Bs3X0Text16_EndOfSegment               BS3_DATA_NM(Bs3X0Text16_EndOfSegment)
+# define Bs3X0Text16_Size                       BS3_DATA_NM(Bs3X0Text16_Size)
+# define Bs3X0Text16_FlatAddr                   BS3_DATA_NM(Bs3X0Text16_FlatAddr)
+
+# define Bs3X1Text16_StartOfSegment             BS3_DATA_NM(Bs3X1Text16_StartOfSegment)
+# define Bs3X1Text16_EndOfSegment               BS3_DATA_NM(Bs3X1Text16_EndOfSegment)
+# define Bs3X1Text16_Size                       BS3_DATA_NM(Bs3X1Text16_Size)
+# define Bs3X1Text16_FlatAddr                   BS3_DATA_NM(Bs3X1Text16_FlatAddr)
+
 # define Bs3Text32_StartOfSegment               BS3_DATA_NM(Bs3Text32_StartOfSegment)
 # define Bs3Text32_EndOfSegment                 BS3_DATA_NM(Bs3Text32_EndOfSegment)
+
 # define Bs3Data32_StartOfSegment               BS3_DATA_NM(Bs3Data32_StartOfSegment)
 # define Bs3Data32_EndOfSegment                 BS3_DATA_NM(Bs3Data32_EndOfSegment)
+
 # define Bs3Text64_StartOfSegment               BS3_DATA_NM(Bs3Text64_StartOfSegment)
 # define Bs3Text64_EndOfSegment                 BS3_DATA_NM(Bs3Text64_EndOfSegment)
+
 # define Bs3Data64_StartOfSegment               BS3_DATA_NM(Bs3Data64_StartOfSegment)
 # define Bs3Data64_EndOfSegment                 BS3_DATA_NM(Bs3Data64_EndOfSegment)
 
 # define Bs3Data16Thru64Text32And64_TotalSize   BS3_DATA_NM(Bs3Data16Thru64Text32And64_TotalSize)
 # define Bs3TotalImageSize                      BS3_DATA_NM(Bs3TotalImageSize)
+
 # define g_achBs3HexDigits                      BS3_DATA_NM(g_achBs3HexDigits)
 # define g_achBs3HexDigitsUpper                 BS3_DATA_NM(g_achBs3HexDigitsUpper)
 # define g_bBs3CurrentMode                      BS3_DATA_NM(g_bBs3CurrentMode)
diff --git a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3kit.h b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3kit.h
index 3bf263f2ace..5a0b947d2ac 100644
--- a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3kit.h
+++ b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3kit.h
@@ -227,8 +227,9 @@ RT_C_DECLS_BEGIN
 #define BS3_SEL_TSS64_SPARE1        0x0090 /**< The 64-bit TSS selector. */
 #define BS3_SEL_TSS64_IOBP          0x00a0 /**< The 64-bit TSS selector. */
 
+#define BS3_SEL_RMTEXT16_CS         0x00e0 /**< Conforming code selector for accessing the BS3RMTEXT16 segment. Runtime config. */
 #define BS3_SEL_X0TEXT16_CS         0x00e8 /**< Conforming code selector for accessing the BS3X0TEXT16 segment. Runtime config. */
-#define BS3_SEL_X1TEXT16_CS         0x00f0 /**< Conforming code selector for accessing the BS3X0TEXT16 segment. Runtime config. */
+#define BS3_SEL_X1TEXT16_CS         0x00f0 /**< Conforming code selector for accessing the BS3X1TEXT16 segment. Runtime config. */
 #define BS3_SEL_VMMDEV_MMIO16       0x00f8 /**< Selector for accessing the VMMDev MMIO segment at 0100000h from 16-bit code. */
 
 #define BS3_SEL_RING_SHIFT          8      /**< For the formula: BS3_SEL_R0_XXX + ((cs & 3) << BS3_SEL_RING_SHIFT) */
@@ -704,6 +705,7 @@ extern X86DESC BS3_FAR_DATA Bs3Gdte_Tss64;                  /**< @see BS3_SEL_TS
 extern X86DESC BS3_FAR_DATA Bs3Gdte_Tss64Spare0;            /**< @see BS3_SEL_TSS64_SPARE0 */
 extern X86DESC BS3_FAR_DATA Bs3Gdte_Tss64Spare1;            /**< @see BS3_SEL_TSS64_SPARE1 */
 extern X86DESC BS3_FAR_DATA Bs3Gdte_Tss64Iobp;              /**< @see BS3_SEL_TSS64_IOBP */
+extern X86DESC BS3_FAR_DATA Bs3Gdte_RMTEXT16_CS;            /**< @see BS3_SEL_RMTEXT16_CS */
 extern X86DESC BS3_FAR_DATA Bs3Gdte_X0TEXT16_CS;            /**< @see BS3_SEL_X0TEXT16_CS */
 extern X86DESC BS3_FAR_DATA Bs3Gdte_X1TEXT16_CS;            /**< @see BS3_SEL_X1TEXT16_CS */
 extern X86DESC BS3_FAR_DATA Bs3Gdte_R0_MMIO16;              /**< @see BS3_SEL_VMMDEV_MMIO16 */
@@ -929,6 +931,10 @@ extern uint8_t  BS3_FAR_DATA Bs3Data16_EndOfSegment;
 extern uint8_t  BS3_FAR_DATA Bs3RmText16_StartOfSegment;
 /** End of the BS3RMTEXT16 segment.   */
 extern uint8_t  BS3_FAR_DATA Bs3RmText16_EndOfSegment;
+/** The size of the BS3RMTEXT16 segment.   */
+extern uint16_t BS3_FAR_DATA Bs3RmText16_Size;
+/** The flat start address of the BS3X0TEXT16 segment.   */
+extern uint32_t BS3_FAR_DATA Bs3RmText16_FlatAddr;
 
 /** Start of the BS3X0TEXT16 segment.   */
 extern uint8_t  BS3_FAR_DATA Bs3X0Text16_StartOfSegment;
@@ -936,7 +942,7 @@ extern uint8_t  BS3_FAR_DATA Bs3X0Text16_StartOfSegment;
 extern uint8_t  BS3_FAR_DATA Bs3X0Text16_EndOfSegment;
 /** The size of the BS3X0TEXT16 segment.   */
 extern uint16_t BS3_FAR_DATA Bs3X0Text16_Size;
-/** The flat start address of the BS3X1TEXT16 segment.   */
+/** The flat start address of the BS3X0TEXT16 segment.   */
 extern uint32_t BS3_FAR_DATA Bs3X0Text16_FlatAddr;
 
 /** Start of the BS3X1TEXT16 segment.   */
diff --git a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3kit.mac b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3kit.mac
index 9fc2a933334..cf568afe498 100644
--- a/src/VBox/ValidationKit/bootsectors/bs3kit/bs3kit.mac
+++ b/src/VBox/ValidationKit/bootsectors/bs3kit/bs3kit.mac
@@ -1476,8 +1476,9 @@ endstruc
 %define BS3_SEL_TSS64_SPARE1        0090h ;;< The 64-bit TSS selector.
 %define BS3_SEL_TSS64_IOBP          00a0h ;;< The 64-bit TSS selector.
 
+%define BS3_SEL_RMTEXT16_CS         00e0h ;;< Conforming code selector for accessing the BS3RMTEXT16 segment. Runtime config.
 %define BS3_SEL_X0TEXT16_CS         00e8h ;;< Conforming code selector for accessing the BS3X0TEXT16 segment. Runtime config.
-%define BS3_SEL_X1TEXT16_CS         00f0h ;;< Conforming code selector for accessing the BS3X0TEXT16 segment. Runtime config.
+%define BS3_SEL_X1TEXT16_CS         00f0h ;;< Conforming code selector for accessing the BS3X1TEXT16 segment. Runtime config.
 %define BS3_SEL_VMMDEV_MMIO16       00f8h ;;< Selector for accessing the VMMDev MMIO segment at 0100000h from 16-bit code.
 
 %define BS3_SEL_RING_SHIFT          8     ;;< For the formula: BS3_SEL_R0_XXX + ((cs & 3) << BS3_SEL_RING_SHIFT)