Mark Russinovich has kindly explained that this occurs because VirtualBox locks a large amount of memory, which requests the OS to keep it in the working set.
However, if you just try VirtualLock
ing a bunch of RAM, you won't see this. All that RAM will be happily accounted for, like it should be. So it's something else about the way VirtualBox allocates this memory. Incidentally, it also affects ProcessHacker.
The weird thing about this is that ProcessHacker enumerates all the allocated memory ranges correctly, and simply adding them up will give the correct value, however the counter reported by the OS is wrong. By a few GB. Not good!
I'm calling this a quirk of Windows RAM reporting. I'd call this a bug, but it's probably been around for at least a decade, so by now I guess one can call this expected behaviour... one that isn't properly worked around in Process Explorer nor Process Hacker.