diff --git a/xen/arch/x86/domctl.c b/xen/arch/x86/domctl.c
index d964d814c5..90fe100316 100644
--- a/xen/arch/x86/domctl.c
+++ b/xen/arch/x86/domctl.c
@@ -1020,7 +1020,8 @@ long arch_do_domctl(
         struct xen_domctl_vcpu_msrs *vmsrs = &domctl->u.vcpu_msrs;
         struct xen_domctl_vcpu_msr msr;
         struct vcpu *v;
-        uint32_t nr_msrs = 0;
+        uint32_t nr_msrs = 0, edx, dummy;
+        bool_t has_ibrsb;
 
         ret = -ESRCH;
         if ( (vmsrs->vcpu >= d->max_vcpus) ||
@@ -1036,6 +1037,10 @@ long arch_do_domctl(
         if ( boot_cpu_has(X86_FEATURE_DBEXT) )
             nr_msrs += 4;
 
+        domain_cpuid(d, 7, 0, &dummy, &dummy, &dummy, &edx);
+        has_ibrsb = !!(edx & cpufeat_mask(X86_FEATURE_IBRSB));
+        nr_msrs += has_ibrsb;
+
         if ( domctl->cmd == XEN_DOMCTL_get_vcpu_msrs )
         {
             ret = 0; copyback = 1;
@@ -1045,8 +1050,6 @@ long arch_do_domctl(
                 vmsrs->msr_count = nr_msrs;
             else
             {
-                uint32_t edx, dummy;
-
                 i = 0;
 
                 vcpu_pause(v);
@@ -1084,9 +1087,7 @@ long arch_do_domctl(
                     }
                 }
 
-                domain_cpuid(d, 7, 0, &dummy, &dummy, &dummy, &edx);
-                if ( (edx & cpufeat_mask(X86_FEATURE_IBRSB)) &&
-                     v->arch.spec_ctrl )
+                if ( has_ibrsb && v->arch.spec_ctrl )
                 {
                     if ( i < vmsrs->msr_count && !ret )
                     {