diff --git a/usr.sbin/bhyve/bhyverun.h b/usr.sbin/bhyve/bhyverun.h
--- a/usr.sbin/bhyve/bhyverun.h
+++ b/usr.sbin/bhyve/bhyverun.h
@@ -45,7 +45,6 @@
 uintptr_t paddr_host2guest(struct vmctx *ctx, void *addr);
 #endif
 
-void fbsdrun_set_capabilities(struct vmctx *ctx, int cpu);
 int  fbsdrun_virtio_msix(void);
 
 int vmexit_task_switch(struct vmctx *, struct vm_exit *, int *vcpu);
diff --git a/usr.sbin/bhyve/bhyverun.c b/usr.sbin/bhyve/bhyverun.c
--- a/usr.sbin/bhyve/bhyverun.c
+++ b/usr.sbin/bhyve/bhyverun.c
@@ -552,12 +552,6 @@
 {
 	int error;
 
-	/*
-	 * The 'newcpu' must be activated in the context of 'fromcpu'. If
-	 * vm_activate_cpu() is delayed until newcpu's pthread starts running
-	 * then vmm.ko is out-of-sync with bhyve and this can create a race
-	 * with vm_suspend().
-	 */
 	error = vm_activate_cpu(ctx, newcpu);
 	if (error != 0)
 		err(EX_OSERR, "could not activate CPU %d", newcpu);
@@ -1044,7 +1038,7 @@
 		return (1);
 }
 
-void
+static void
 fbsdrun_set_capabilities(struct vmctx *ctx, int cpu)
 {
 	int err, tmp;
@@ -1086,6 +1080,9 @@
 	}
 
 	vm_set_capability(ctx, cpu, VM_CAP_ENABLE_INVPCID, 1);
+
+	err = vm_set_capability(ctx, cpu, VM_CAP_IPI_EXIT, 1);
+	assert(err == 0);
 }
 
 static struct vmctx *
@@ -1157,16 +1154,21 @@
 	int error;
 	uint64_t rip;
 
+	if (vcpu != BSP) {
+		fbsdrun_set_capabilities(ctx, vcpu);
+
+		/*
+		 * Enable the 'unrestricted guest' mode for APs.
+		 *
+		 * APs startup in power-on 16-bit mode.
+		 */
+		error = vm_set_capability(ctx, vcpu, VM_CAP_UNRESTRICTED_GUEST, 1);
+		assert(error == 0);
+	}
+
 	error = vm_get_register(ctx, vcpu, VM_REG_GUEST_RIP, &rip);
 	assert(error == 0);
 
-	fbsdrun_set_capabilities(ctx, vcpu);
-	error = vm_set_capability(ctx, vcpu, VM_CAP_UNRESTRICTED_GUEST, 1);
-	assert(error == 0);
-
-	error = vm_set_capability(ctx, vcpu, VM_CAP_IPI_EXIT, 1);
-	assert(error == 0);
-
 	fbsdrun_addcpu(ctx, vcpu, rip, suspend);
 }
 
diff --git a/usr.sbin/bhyve/spinup_ap.c b/usr.sbin/bhyve/spinup_ap.c
--- a/usr.sbin/bhyve/spinup_ap.c
+++ b/usr.sbin/bhyve/spinup_ap.c
@@ -87,20 +87,6 @@
 	error = vcpu_reset(ctx, newcpu);
 	assert(error == 0);
 
-	fbsdrun_set_capabilities(ctx, newcpu);
-
-	/*
-	 * Enable the 'unrestricted guest' mode for 'newcpu'.
-	 *
-	 * Set up the processor state in power-on 16-bit mode, with the CS:IP
-	 * init'd to the specified low-mem 4K page.
-	 */
-	error = vm_set_capability(ctx, newcpu, VM_CAP_UNRESTRICTED_GUEST, 1);
-	assert(error == 0);
-
-	error = vm_set_capability(ctx, newcpu, VM_CAP_IPI_EXIT, 1);
-	assert(error == 0);
-
 	spinup_ap_realmode(ctx, newcpu, &rip);
 
 	vm_resume_cpu(ctx, newcpu);