diff --git a/accel/hvf/hvf-accel-ops.c b/accel/hvf/hvf-accel-ops.c
index b74a5779c3..4992b25149 100644
--- a/accel/hvf/hvf-accel-ops.c
+++ b/accel/hvf/hvf-accel-ops.c
@@ -135,6 +135,8 @@ static int hvf_init_vcpu(CPUState *cpu)
     sigaction(SIG_IPI, &sigact, NULL);
 
 #ifdef __aarch64__
+    pthread_sigmask(SIG_BLOCK, NULL, &cpu->accel->unblock_ipi_mask);
+    sigdelset(&cpu->accel->unblock_ipi_mask, SIG_IPI);
     cpu->accel->guest_debug_enabled = false;
 
     r = hv_vcpu_create(&cpu->accel->fd,
diff --git a/include/system/hvf_int.h b/include/system/hvf_int.h
index 2621164cb2..98bdc2d25d 100644
--- a/include/system/hvf_int.h
+++ b/include/system/hvf_int.h
@@ -47,6 +47,7 @@ struct AccelCPUState {
 #ifdef __aarch64__
     hv_vcpu_exit_t *exit;
     bool vtimer_masked;
+    sigset_t unblock_ipi_mask;
     bool guest_debug_enabled;
 #endif
 };
diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index 678afe5c8e..3d7a3a7822 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -301,6 +301,8 @@ void hvf_arm_init_debug(void)
 #define TMR_CTL_IMASK   (1 << 1)
 #define TMR_CTL_ISTATUS (1 << 2)
 
+static void hvf_wfi(CPUState *cpu);
+
 static uint32_t chosen_ipa_bit_size;
 
 typedef struct HVFVTimer {
@@ -2027,17 +2029,89 @@ static uint64_t hvf_vtimer_val_raw(void)
     return mach_absolute_time() - hvf_state->vtimer_offset;
 }
 
-static int hvf_wfi(CPUState *cpu)
+static uint64_t hvf_vtimer_val(void)
 {
+    if (!runstate_is_running()) {
+        /* VM is paused, the vtimer value is in vtimer.vtimer_val */
+        return vtimer.vtimer_val;
+    }
+
+    return hvf_vtimer_val_raw();
+}
+
+static void hvf_wfi(CPUState *cpu)
+{
+    ARMCPU *arm_cpu = ARM_CPU(cpu);
+    struct timespec ts;
+    hv_return_t r;
+    uint64_t ctl;
+    uint64_t cval;
+    int64_t ticks_to_sleep;
+    uint64_t seconds;
+    uint64_t nanos;
+    uint32_t cntfrq;
+    sigset_t mask, oldmask;
+
+    // NO CAP - Windows boot needs full timer durations
+    // const uint64_t MAX_SLEEP_NS = ...;  // REMOVE THIS
+
     if (cpu_has_work(cpu)) {
-        /*
-         * Don't bother to go into our "low power state" if
-         * we would just wake up immediately.
-         */
-        return 0;
+        return;
     }
 
-    return EXCP_HLT;
+    r = hv_vcpu_get_sys_reg(cpu->accel->fd, HV_SYS_REG_CNTV_CTL_EL0, &ctl);
+    assert_hvf_ok(r);
+
+    if (!(ctl & 1) || (ctl & 2)) {
+        /* Timer disabled or masked. Use original pselect approach. */
+        bql_unlock();
+        pselect(0, NULL, NULL, NULL, NULL, &cpu->accel->unblock_ipi_mask);
+        bql_lock();
+        return;
+    }
+
+    r = hv_vcpu_get_sys_reg(cpu->accel->fd, HV_SYS_REG_CNTV_CVAL_EL0, &cval);
+    assert_hvf_ok(r);
+
+    ticks_to_sleep = cval - hvf_vtimer_val();
+    if (ticks_to_sleep < 0) {
+        return;
+    }
+
+    cntfrq = gt_cntfrq_period_ns(arm_cpu);
+    seconds = muldiv64(ticks_to_sleep, cntfrq, NANOSECONDS_PER_SECOND);
+    ticks_to_sleep -= muldiv64(seconds, NANOSECONDS_PER_SECOND, cntfrq);
+    nanos = ticks_to_sleep * cntfrq;
+
+    // Original 2ms threshold - KEEP THIS
+    if (!seconds && nanos < 2000000) {
+        return;
+    }
+
+    ts = (struct timespec) { seconds, nanos };
+
+    // --- RACE CONDITION FIX ---
+    // Block SIG_IPI before checking thread_kicked
+    sigemptyset(&mask);
+    sigaddset(&mask, SIG_IPI);
+    pthread_sigmask(SIG_BLOCK, &mask, &oldmask);
+    
+    // Check if kicked while busy
+    if (qatomic_read(&cpu->thread_kicked)) {
+        pthread_sigmask(SIG_SETMASK, &oldmask, NULL);
+        return;
+    }
+    
+    // Clear kick flag while blocked
+    qatomic_set(&cpu->thread_kicked, false);
+    
+    // Sleep with BQL unlocked, using pre-computed mask
+    bql_unlock();
+    pselect(0, NULL, NULL, NULL, &ts, &cpu->accel->unblock_ipi_mask);
+    bql_lock();
+    
+    // Restore signal mask
+    pthread_sigmask(SIG_SETMASK, &oldmask, NULL);
 }
 
 /* Must be called by the owning thread */
@@ -2227,7 +2301,7 @@ static int hvf_handle_exception(CPUState *cpu, hv_vcpu_exit_exception_t *excp)
     case EC_WFX_TRAP:
         advance_pc = true;
         if (!(syndrome & WFX_IS_WFE)) {
-            ret = hvf_wfi(cpu);
+            hvf_wfi(cpu);
         }
         break;
     case EC_AA64_HVC: