diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index c1496ad5be..ace83671b5 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -1280,7 +1280,7 @@ static int hvf_sysreg_read(CPUState *cpu, uint32_t reg, uint64_t *val)
     case SYSREG_ICC_SRE_EL1:
     case SYSREG_ICC_CTLR_EL1:
         /* Call the TCG sysreg handler. This is only safe for GICv3 regs. */
-        if (hvf_sysreg_read_cp(cpu, reg, &val)) {
+        if (hvf_sysreg_read_cp(cpu, reg, val)) {
             return 0;
         }
         break;