diff --git a/xen.spec b/xen.spec
index 8f60756..7b4907a 100644
--- a/xen.spec
+++ b/xen.spec
@@ -51,7 +51,7 @@
 Summary: Xen is a virtual machine monitor
 Name:    xen
 Version: 4.6.4
-Release: 3%{?dist}
+Release: 4%{?dist}
 Group:   Development/Libraries
 License: GPLv2+ and LGPLv2+ and BSD
 URL:     http://xen.org/
@@ -181,6 +181,7 @@ Patch212: qemu.git-702dbcc274e2ca43be20ba64c758c0ca57dab91d.patch
 Patch213: qemu.git-971f406b77a6eb84e0ad27dcc416b663765aee30.patch
 Patch214: qemu.git-898ae90a44551d25b8e956fd87372d303c82fe68.patch
 Patch215: xsa199-trad.patch
+Patch216: xsa200-4.6.patch
 
 
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root
@@ -434,6 +435,7 @@ manage Xen virtual machines.
 %patch206 -p1
 %patch207 -p1
 %patch208 -p1
+%patch216 -p1
 
 # qemu-xen-traditional patches
 pushd tools/qemu-xen-traditional
@@ -1000,6 +1002,10 @@ rm -rf %{buildroot}
 %endif
 
 %changelog
+* Tue Dec 13 2016 Michael Young <m.a.young@durham.ac.uk> - 4.6.4-4
+- x86 CMPXCHG8B emulation fails to ignore operand size override [XSA-200,
+	CVE-2016-9932] (#1404262)
+
 * Thu Dec 08 2016 Michael Young <m.a.young@durham.ac.uk> - 4.6.4-3
 - ARM guests may induce host asynchronous abort [XSA-201, CVE-2016-9815,
 	CVE-2016-9816, CVE-2016-9817, CVE-2016-9818] (#1399747)
diff --git a/xsa200-4.6.patch b/xsa200-4.6.patch
new file mode 100644
index 0000000..5aa979b
--- /dev/null
+++ b/xsa200-4.6.patch
@@ -0,0 +1,55 @@
+From: Jan Beulich <jbeulich@suse.com>
+Subject: x86emul: CMPXCHG8B ignores operand size prefix
+
+Otherwise besides mis-handling the instruction, the comparison failure
+case would result in uninitialized stack data being handed back to the
+guest in rDX:rAX (32 bits leaked for 32-bit guests, 96 bits for 64-bit
+ones).
+
+This is XSA-200.
+
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+
+--- a/tools/tests/x86_emulator/test_x86_emulator.c
++++ b/tools/tests/x86_emulator/test_x86_emulator.c
+@@ -429,6 +429,24 @@ int main(int argc, char **argv)
+         goto fail;
+     printf("okay\n");
+ 
++    printf("%-40s", "Testing cmpxchg8b (%edi) [opsize]...");
++    instr[0] = 0x66; instr[1] = 0x0f; instr[2] = 0xc7; instr[3] = 0x0f;
++    res[0]      = 0x12345678;
++    res[1]      = 0x87654321;
++    regs.eflags = 0x200;
++    regs.eip    = (unsigned long)&instr[0];
++    regs.edi    = (unsigned long)res;
++    rc = x86_emulate(&ctxt, &emulops);
++    if ( (rc != X86EMUL_OKAY) ||
++         (res[0] != 0x12345678) ||
++         (res[1] != 0x87654321) ||
++         (regs.eax != 0x12345678) ||
++         (regs.edx != 0x87654321) ||
++         ((regs.eflags&0x240) != 0x200) ||
++         (regs.eip != (unsigned long)&instr[4]) )
++        goto fail;
++    printf("okay\n");
++
+     printf("%-40s", "Testing movsxbd (%%eax),%%ecx...");
+     instr[0] = 0x0f; instr[1] = 0xbe; instr[2] = 0x08;
+     regs.eflags = 0x200;
+--- a/xen/arch/x86/x86_emulate/x86_emulate.c
++++ b/xen/arch/x86/x86_emulate/x86_emulate.c
+@@ -4739,8 +4739,12 @@ x86_emulate(
+         generate_exception_if((modrm_reg & 7) != 1, EXC_UD, -1);
+         generate_exception_if(ea.type != OP_MEM, EXC_UD, -1);
+         if ( op_bytes == 8 )
++        {
+             vcpu_must_have_cx16();
+-        op_bytes *= 2;
++            op_bytes = 16;
++        }
++        else
++            op_bytes = 8;
+ 
+         /* Get actual old value. */
+         if ( (rc = ops->read(ea.mem.seg, ea.mem.off, old, op_bytes,