diff -r e1c198471d4d xen/arch/x86/mm/shadow/multi.c
--- a/xen/arch/x86/mm/shadow/multi.c	Fri Jun 20 15:11:33 2008 +0100
+++ b/xen/arch/x86/mm/shadow/multi.c	Fri Jun 20 15:12:27 2008 +0100
@@ -3288,6 +3288,13 @@ static int sh_page_fault(struct vcpu *v,
         return 0;
     }
 
+#if (SHADOW_OPTIMIZATIONS & SHOPT_OUT_OF_SYNC)
+    /* Always unsync when writing to L1 page tables. */
+    if ( sh_mfn_is_a_page_table(gmfn)
+         && ft == ft_demand_write )
+        sh_unsync(v, gmfn, va);
+#endif /* OOS */
+
     /* Calculate the shadow entry and write it */
     l1e_propagate_from_guest(v, gw.l1e, gmfn, &sl1e, ft, p2mt);
     r = shadow_set_l1e(v, ptr_sl1e, sl1e, sl1mfn);