Index: src/VBox/Main/src-client/ConsoleImpl.cpp
===================================================================
--- src/VBox/Main/src-client/ConsoleImpl.cpp	(revision 97548)
+++ src/VBox/Main/src-client/ConsoleImpl.cpp	(revision 97549)
@@ -2327,7 +2327,7 @@
     if (!ptrVM.isOk())
         return ptrVM.rc();
 
-    /* release the lock before a VMR3* call (EMT will call us back)! */
+    /* release the lock before a VMR3* call (EMT might wait for it, @bugref{7648})! */
     alock.release();
 
     int vrc = VMR3Reset(ptrVM.rawUVM());
@@ -2433,13 +2433,15 @@
         vrc = VMR3ReqCallU(pUVM, 0, &pReq, 0 /* no wait! */, VMREQFLAGS_VBOX_STATUS,
                            (PFNRT)unplugCpu, 3,
                            this, pUVM, (VMCPUID)aCpu);
-        if (vrc == VERR_TIMEOUT || RT_SUCCESS(vrc))
-        {
+    
+        /* release the lock before a VMR3* call (EMT might wait for it, @bugref{7648})! */
+        alock.release();
+
+        if (vrc == VERR_TIMEOUT)
             vrc = VMR3ReqWait(pReq, RT_INDEFINITE_WAIT);
-            AssertRC(vrc);
-            if (RT_SUCCESS(vrc))
-                vrc = pReq->iStatus;
-        }
+        AssertRC(vrc);
+        if (RT_SUCCESS(vrc))
+            vrc = pReq->iStatus;
         VMR3ReqFree(pReq);
 
         if (RT_SUCCESS(vrc))
@@ -2540,23 +2542,16 @@
                            (PFNRT)plugCpu, 3,
                            this, pUVM, aCpu);
 
-    /* release the lock before a VMR3* call (EMT will call us back)! */
+    /* release the lock before a VMR3* call (EMT might wait for it, @bugref{7648})! */
     alock.release();
 
-    if (vrc == VERR_TIMEOUT || RT_SUCCESS(vrc))
-    {
+    if (vrc == VERR_TIMEOUT)
         vrc = VMR3ReqWait(pReq, RT_INDEFINITE_WAIT);
-        AssertRC(vrc);
-        if (RT_SUCCESS(vrc))
-            vrc = pReq->iStatus;
-    }
+    AssertRC(vrc);
+    if (RT_SUCCESS(vrc))
+        vrc = pReq->iStatus;
     VMR3ReqFree(pReq);
 
-    rc = RT_SUCCESS(vrc) ? S_OK :
-        setError(VBOX_E_VM_ERROR,
-                 tr("Could not add CPU to the machine (%Rrc)"),
-                 vrc);
-
     if (RT_SUCCESS(vrc))
     {
         /* Notify the guest if possible. */
@@ -2566,6 +2561,10 @@
             vrc = pDevPort->pfnCpuHotPlug(pDevPort, idCpuCore, idCpuPackage);
         /** @todo warning if the guest doesn't support it */
     }
+    else
+        rc = setError(VBOX_E_VM_ERROR,
+                      tr("Could not add CPU to the machine (%Rrc)"),
+                      vrc);
 
     LogFlowThisFunc(("mMachineState=%d, rc=%Rhrc\n", mMachineState, rc));
     LogFlowThisFuncLeave();
@@ -3706,16 +3705,14 @@
                            (PFNRT)changeRemovableMedium, 8,
                            this, pUVM, pszDevice, uInstance, enmBus, fUseHostIOCache, aMediumAttachment, fForce);
 
-    /* release the lock before waiting for a result (EMT will call us back!) */
+    /* release the lock before waiting for a result (EMT might wait for it, @bugref{7648})! */
     alock.release();
 
-    if (vrc == VERR_TIMEOUT || RT_SUCCESS(vrc))
-    {
+    if (vrc == VERR_TIMEOUT)
         vrc = VMR3ReqWait(pReq, RT_INDEFINITE_WAIT);
-        AssertRC(vrc);
-        if (RT_SUCCESS(vrc))
-            vrc = pReq->iStatus;
-    }
+    AssertRC(vrc);
+    if (RT_SUCCESS(vrc))
+        vrc = pReq->iStatus;
     VMR3ReqFree(pReq);
 
     if (fResume)
@@ -3899,16 +3896,14 @@
                            (PFNRT)attachStorageDevice, 8,
                            this, pUVM, pszDevice, uInstance, enmBus, fUseHostIOCache, aMediumAttachment, fSilent);
 
-    /* release the lock before waiting for a result (EMT will call us back!) */
+    /* release the lock before waiting for a result (EMT might wait for it, @bugref{7648})! */
     alock.release();
 
-    if (vrc == VERR_TIMEOUT || RT_SUCCESS(vrc))
-    {
+    if (vrc == VERR_TIMEOUT)
         vrc = VMR3ReqWait(pReq, RT_INDEFINITE_WAIT);
-        AssertRC(vrc);
-        if (RT_SUCCESS(vrc))
-            vrc = pReq->iStatus;
-    }
+    AssertRC(vrc);
+    if (RT_SUCCESS(vrc))
+        vrc = pReq->iStatus;
     VMR3ReqFree(pReq);
 
     if (fResume)
@@ -4082,16 +4077,14 @@
                            (PFNRT)detachStorageDevice, 7,
                            this, pUVM, pszDevice, uInstance, enmBus, aMediumAttachment, fSilent);
 
-    /* release the lock before waiting for a result (EMT will call us back!) */
+    /* release the lock before waiting for a result (EMT might wait for it, @bugref{7648})! */
     alock.release();
 
-    if (vrc == VERR_TIMEOUT || RT_SUCCESS(vrc))
-    {
+    if (vrc == VERR_TIMEOUT)
         vrc = VMR3ReqWait(pReq, RT_INDEFINITE_WAIT);
-        AssertRC(vrc);
-        if (RT_SUCCESS(vrc))
-            vrc = pReq->iStatus;
-    }
+    AssertRC(vrc);
+    if (RT_SUCCESS(vrc))
+        vrc = pReq->iStatus;
     VMR3ReqFree(pReq);
 
     if (fResume)
@@ -4841,19 +4834,10 @@
      * here to make requests from under the lock in order to serialize them.
      */
     PVMREQ pReq;
-    int vrc = VMR3ReqCallU(pUVM, 0 /*idDstCpu*/, &pReq, 0 /* no wait! */, VMREQFLAGS_VBOX_STATUS,
-                           (PFNRT)changeNetworkAttachment, 6,
-                           this, pUVM, pszDevice, uInstance, uLun, aNetworkAdapter);
+    int vrc = VMR3ReqCallWaitU(pUVM, 0 /*idDstCpu*/,
+                               (PFNRT)changeNetworkAttachment, 6,
+                               this, pUVM, pszDevice, uInstance, uLun, aNetworkAdapter);
 
-    if (vrc == VERR_TIMEOUT || RT_SUCCESS(vrc))
-    {
-        vrc = VMR3ReqWait(pReq, RT_INDEFINITE_WAIT);
-        AssertRC(vrc);
-        if (RT_SUCCESS(vrc))
-            vrc = pReq->iStatus;
-    }
-    VMR3ReqFree(pReq);
-
     if (fResume)
         resumeAfterConfigChange(pUVM);
 
@@ -6134,7 +6118,7 @@
     if (!ptrVM.isOk())
         return ptrVM.rc();
 
-    /* release the lock before a VMR3* call (EMT will call us back)! */
+    /* release the lock before a VMR3* call (EMT might wait for it, @bugref{7648})! */
     alock.release();
 
     LogFlowThisFunc(("Sending PAUSE request...\n"));
@@ -6193,7 +6177,7 @@
     if (!ptrVM.isOk())
         return ptrVM.rc();
 
-    /* release the lock before a VMR3* call (EMT will call us back)! */
+    /* release the lock before a VMR3* call (EMT might wait for it, @bugref{7648})! */
     alock.release();
 
     LogFlowThisFunc(("Sending RESUME request...\n"));
@@ -6272,7 +6256,7 @@
         if (!ptrVM.isOk())
             return ptrVM.rc();
 
-        /* release the lock before a VMR3* call (EMT will call us back)! */
+        /* release the lock before a VMR3* call (EMT might wait for it, @bugref{7648})! */
         alock.release();
         VMSUSPENDREASON enmReason = VMSUSPENDREASON_USER;
         if (aReason == Reason_HostSuspend)
@@ -7497,7 +7481,7 @@
     {
         LogFlowThisFunc(("Shutdown HGCM...\n"));
 
-        /* Leave the lock since EMT will call us back as addVMCaller() */
+        /* Leave the lock since EMT might wait for it and will call us back as addVMCaller() */
         alock.release();
 
         m_pVMMDev->hgcmShutdown();
@@ -8836,7 +8820,7 @@
         rc = setError(E_FAIL,
             tr("General failure attaching to host interface"));
     }
-    LogFlowThisFunc(("rc=%d\n", rc));
+    LogFlowThisFunc(("rc=%Rhrc\n", rc));
     return rc;
 }
 
@@ -9998,6 +9982,9 @@
                  * don't release the lock since reconfigureMediumAttachment
                  * isn't going to need the Console lock.
                  */
+
+                /* TODO: do alock.release here as EMT might wait on it! See other places
+                 * where we do VMR3ReqCall requests. See @bugref{7648}. */
                 vrc = VMR3ReqCallWaitU(ptrVM.rawUVM(), VMCPUID_ANY,
                                        (PFNRT)reconfigureMediumAttachment, 13,
                                        that, ptrVM.rawUVM(), pcszDevice, lInstance, enmBus, fUseHostIOCache,
