diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c
index 29e72dea30..622b9505dc 100644
--- a/xen/arch/x86/mm.c
+++ b/xen/arch/x86/mm.c
@@ -266,8 +266,15 @@ void share_xen_page_with_privileged_guests(
 /* Only PDPTs above 4GB boundary need to be shadowed in low memory. */
 #define l3tab_needs_shadow(mfn) (mfn >= 0x100000)
 #else
-/* In debug builds we aggressively shadow PDPTs to exercise code paths. */
-#define l3tab_needs_shadow(mfn) ((mfn << PAGE_SHIFT) != __pa(idle_pg_table))
+/*
+ * In debug builds we aggressively shadow PDPTs to exercise code paths.
+ * We cannot safely shadow the idle page table, nor shadow-mode page tables
+ * (detected by lack of an owning domain). Always shadow PDPTs above 4GB.
+ */
+#define l3tab_needs_shadow(mfn)                         \
+    ((((mfn << PAGE_SHIFT) != __pa(idle_pg_table)) &&   \
+      (page_get_owner(mfn_to_page(mfn)) != NULL)) ||    \
+     (mfn >= 0x100000))
 #endif
 
 static l1_pgentry_t *fix_pae_highmem_pl1e;