diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index 2e4c4cc4b4..df7d0b5ad0 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -393,7 +393,7 @@ int probe_access_full(CPUArchState *env, vaddr addr, int size,
  */
 int probe_access_full_mmu(CPUArchState *env, vaddr addr, int size,
                           MMUAccessType access_type, int mmu_idx,
-                          void **phost, CPUTLBEntryFull **pfull);
+                          void **phost, CPUTLBEntryFull *pfull);
 
 #endif /* !CONFIG_USER_ONLY */
 #endif /* CONFIG_TCG */
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index 585f4171cc..81135524eb 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -1439,25 +1439,28 @@ int probe_access_full(CPUArchState *env, vaddr addr, int size,
 
 int probe_access_full_mmu(CPUArchState *env, vaddr addr, int size,
                           MMUAccessType access_type, int mmu_idx,
-                          void **phost, CPUTLBEntryFull **pfull)
+                          void **phost, CPUTLBEntryFull *pfull)
 {
     void *discard_phost;
-    CPUTLBEntryFull *discard_tlb;
+    CPUTLBEntryFull *full;
 
     /* privately handle users that don't need full results */
     phost = phost ? phost : &discard_phost;
-    pfull = pfull ? pfull : &discard_tlb;
 
     int flags = probe_access_internal(env_cpu(env), addr, size, access_type,
-                                      mmu_idx, true, phost, pfull, 0, false);
+                                      mmu_idx, true, phost, &full, 0, false);
 
     /* Handle clean RAM pages.  */
     if (unlikely(flags & TLB_NOTDIRTY)) {
         int dirtysize = size == 0 ? 1 : size;
-        notdirty_write(env_cpu(env), addr, dirtysize, *pfull, 0);
+        notdirty_write(env_cpu(env), addr, dirtysize, full, 0);
         flags &= ~TLB_NOTDIRTY;
     }
 
+    if (pfull) {
+        *pfull = *full;
+    }
+
     return flags;
 }
 
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 9849949508..3ae5f524de 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -592,7 +592,7 @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
         ptw->out_space = s2.f.attrs.space;
     } else {
 #ifdef CONFIG_TCG
-        CPUTLBEntryFull *full;
+        CPUTLBEntryFull full;
         int flags;
 
         env->tlb_fi = fi;
@@ -604,10 +604,10 @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
         if (unlikely(flags & TLB_INVALID_MASK)) {
             goto fail;
         }
-        ptw->out_phys = full->phys_addr | (addr & ~TARGET_PAGE_MASK);
-        ptw->out_rw = full->prot & PAGE_WRITE;
-        pte_attrs = full->extra.arm.pte_attrs;
-        ptw->out_space = full->attrs.space;
+        ptw->out_phys = full.phys_addr | (addr & ~TARGET_PAGE_MASK);
+        ptw->out_rw = full.prot & PAGE_WRITE;
+        pte_attrs = full.extra.arm.pte_attrs;
+        ptw->out_space = full.attrs.space;
 #else
         g_assert_not_reached();
 #endif
diff --git a/target/i386/tcg/sysemu/excp_helper.c b/target/i386/tcg/sysemu/excp_helper.c
index 02d3486421..168ff8e5f3 100644
--- a/target/i386/tcg/sysemu/excp_helper.c
+++ b/target/i386/tcg/sysemu/excp_helper.c
@@ -436,7 +436,7 @@ do_check_protect_pse36:
      * addresses) using the address with the A20 bit set.
      */
     if (in->ptw_idx == MMU_NESTED_IDX) {
-        CPUTLBEntryFull *full;
+        CPUTLBEntryFull full;
         int flags, nested_page_size;
 
         flags = probe_access_full_mmu(env, paddr, 0, access_type,
@@ -451,7 +451,7 @@ do_check_protect_pse36:
         }
 
         /* Merge stage1 & stage2 protection bits. */
-        prot &= full->prot;
+        prot &= full.prot;
 
         /* Re-verify resulting protection. */
         if ((prot & (1 << access_type)) == 0) {
@@ -459,8 +459,8 @@ do_check_protect_pse36:
         }
 
         /* Merge stage1 & stage2 addresses to final physical address. */
-        nested_page_size = 1 << full->lg_page_size;
-        paddr = (full->phys_addr & ~(nested_page_size - 1))
+        nested_page_size = 1 << full.lg_page_size;
+        paddr = (full.phys_addr & ~(nested_page_size - 1))
               | (paddr & (nested_page_size - 1));
 
         /*
