diff --git a/tools/tests/cpu-policy/test-cpu-policy.c b/tools/tests/cpu-policy/test-cpu-policy.c
index beced5e9a6..fd96c0b896 100644
--- a/tools/tests/cpu-policy/test-cpu-policy.c
+++ b/tools/tests/cpu-policy/test-cpu-policy.c
@@ -65,6 +65,77 @@ static void test_cpuid_serialise_success(void)
             .name = "empty policy",
             .nr_leaves = 4,
         },
+
+        /* Leaf 4 serialisation stops at the first subleaf with type 0. */
+        {
+            .name = "empty leaf 4",
+            .p = {
+                .basic.max_leaf = 4,
+            },
+            .nr_leaves = 4 + 4,
+        },
+        {
+            .name = "partial leaf 4",
+            .p = {
+                .basic.max_leaf = 4,
+                .cache.subleaf[0].type = 1,
+            },
+            .nr_leaves = 4 + 4 + 1,
+        },
+
+        /* Leaf 7 serialisation stops at max_subleaf. */
+        {
+            .name = "empty leaf 7",
+            .p = {
+                .basic.max_leaf = 7,
+            },
+            .nr_leaves = 4 + 7,
+        },
+        {
+            .name = "partial leaf 7",
+            .p = {
+                .basic.max_leaf = 7,
+                .feat.max_subleaf = 1,
+            },
+            .nr_leaves = 4 + 7 + 1,
+        },
+
+        /* Leaf 0xb serialisation stops at the first subleaf with type 0. */
+        {
+            .name = "empty leaf 0xb",
+            .p = {
+                .basic.max_leaf = 0xb,
+            },
+            .nr_leaves = 4 + 0xb,
+        },
+        {
+            .name = "partial leaf 0xb",
+            .p = {
+                .basic.max_leaf = 0xb,
+                .topo.subleaf[0].type = 1,
+            },
+            .nr_leaves = 4 + 0xb + 1,
+        },
+
+        /*
+         * Leaf 0xd serialisation automatically has two leaves, and stops the
+         * highest bit set in {xcr0,xss}_{high,low}.
+         */
+        {
+            .name = "empty leaf 0xd",
+            .p = {
+                .basic.max_leaf = 0xd,
+            },
+            .nr_leaves = 4 + 0xd + 1,
+        },
+        {
+            .name = "partial 0xd",
+            .p = {
+                .basic.max_leaf = 0xd,
+                .xstate.xcr0_low = 7,
+            },
+            .nr_leaves = 4 + 0xd + 1 + 1,
+        },
     };
 
     printf("Testing CPUID serialise success:\n");
diff --git a/xen/lib/x86/cpuid.c b/xen/lib/x86/cpuid.c
index 74c5b18ac7..a82cdb27aa 100644
--- a/xen/lib/x86/cpuid.c
+++ b/xen/lib/x86/cpuid.c
@@ -241,7 +241,12 @@ int x86_cpuid_copy_to_buffer(const struct cpuid_policy *p,
         {
         case 0x4:
             for ( subleaf = 0; subleaf < ARRAY_SIZE(p->cache.raw); ++subleaf )
+            {
                 COPY_LEAF(leaf, subleaf, &p->cache.raw[subleaf]);
+
+                if ( p->cache.subleaf[subleaf].type == 0 )
+                    break;
+            }
             break;
 
         case 0x7:
@@ -253,13 +258,27 @@ int x86_cpuid_copy_to_buffer(const struct cpuid_policy *p,
 
         case 0xb:
             for ( subleaf = 0; subleaf < ARRAY_SIZE(p->topo.raw); ++subleaf )
+            {
                 COPY_LEAF(leaf, subleaf, &p->topo.raw[subleaf]);
+
+                if ( p->topo.subleaf[subleaf].type == 0 )
+                    break;
+            }
             break;
 
         case 0xd:
-            for ( subleaf = 0; subleaf < ARRAY_SIZE(p->xstate.raw); ++subleaf )
+        {
+            uint64_t xstates = cpuid_policy_xstates(p);
+
+            COPY_LEAF(leaf, 0, &p->xstate.raw[0]);
+            COPY_LEAF(leaf, 1, &p->xstate.raw[1]);
+
+            for ( xstates >>= 2, subleaf = 2;
+                  xstates && subleaf < ARRAY_SIZE(p->xstate.raw);
+                  xstates >>= 1, ++subleaf )
                 COPY_LEAF(leaf, subleaf, &p->xstate.raw[subleaf]);
             break;
+        }
 
         default:
             COPY_LEAF(leaf, XEN_CPUID_NO_SUBLEAF, &p->basic.raw[leaf]);