Index: /trunk/src/VBox/Devices/Network/slirp/if.c
===================================================================
--- /trunk/src/VBox/Devices/Network/slirp/if.c	(revision 13895)
+++ /trunk/src/VBox/Devices/Network/slirp/if.c	(revision 13896)
@@ -191,5 +191,5 @@
         ifq = if_batchq.ifq_prev;
         while(1){
-            if (ifq == &if_batchq) {
+            if (ifq == &if_batchq || ifq == NULL) {
                 VBOX_SLIRP_UNLOCK(pData->if_batchq_mutex);
                 break;
@@ -198,5 +198,5 @@
 #endif
             VBOX_SLIRP_UNLOCK(pData->if_batchq_mutex);
-	    if (so == ifq->ifq_so) {
+	    if (so == ifq->ifq_so && ifq->ifs_prev != NULL ) {
 			/* A match! */
 			ifm->ifq_so = so;
@@ -235,4 +235,5 @@
 	ifm->ifq_so = so;
 	ifs_init(ifm);
+        if (ifq != NULL)
 	insque(pData, ifm, ifq);
 
@@ -373,5 +374,7 @@
 
 	/* If there are more packets for this session, re-queue them */
-	if (ifm->ifs_next != /* ifm->ifs_prev != */ ifm && ifm->ifs_next != NULL) {
+	if (ifm->ifs_next != /* ifm->ifs_prev != */ ifm
+                && ifm->ifs_next != NULL
+                && ifqt != NULL) {
 		insque(pData, ifm->ifs_next, ifqt);
 		ifs_remque(ifm);
@@ -388,4 +391,10 @@
         if_encap(pData, (const uint8_t *)ifm->m_data, ifm->m_len);
 
+#ifdef VBOX_WITH_SYNC_SLIRP
+        if (ifm != &if_fastq
+            && ifm != &if_batchq
+            && ifm != &m_freelist
+            && ifm != &m_usedlist)
+#endif
         m_free(pData, ifm);
 
Index: /trunk/src/VBox/Devices/Network/slirp/mbuf.c
===================================================================
--- /trunk/src/VBox/Devices/Network/slirp/mbuf.c	(revision 13895)
+++ /trunk/src/VBox/Devices/Network/slirp/mbuf.c	(revision 13896)
@@ -16,4 +16,5 @@
  */
 
+#define IN_MBUF
 #include <slirp.h>
 
@@ -110,4 +111,5 @@
 {
 
+  VBOX_QUEUE_EDGE_CHECK(m);
   DEBUG_CALL("m_free");
   DEBUG_ARG("m = %lx", (long )m);
@@ -117,5 +119,6 @@
 	if (m->m_flags & M_USEDLIST) {
            VBOX_SLIRP_LOCK(pData->m_usedlist_mutex);
-	   remque(pData, m);
+           if (m->m_next != NULL && m->m_prev != NULL)
+	     remque(pData, m);
            VBOX_SLIRP_UNLOCK(pData->m_usedlist_mutex);
         }
@@ -157,5 +160,6 @@
 	 * If there's no room, realloc
 	 */
-
+        VBOX_QUEUE_EDGE_CHECK(m);
+        VBOX_QUEUE_EDGE_CHECK(n);
 	if (M_FREEROOM(m) < n->m_len)
 		m_inc(m,m->m_size+MINCSIZE);
@@ -254,4 +258,7 @@
 {
 	struct mbuf *m;
+#ifdef VBOX_WITH_SYNC_SLIRP
+	struct mbuf *mnext;
+#endif
 
 	DEBUG_CALL("dtom");
@@ -262,5 +269,4 @@
 	for (m = m_usedlist.m_next; m != &m_usedlist; m = m->m_next) {
 #else
-	struct mbuf *mnext;
         VBOX_SLIRP_LOCK(pData->m_usedlist_mutex);
         m = m_usedlist.m_next;
Index: /trunk/src/VBox/Devices/Network/slirp/mbuf.h
===================================================================
--- /trunk/src/VBox/Devices/Network/slirp/mbuf.h	(revision 13895)
+++ /trunk/src/VBox/Devices/Network/slirp/mbuf.h	(revision 13896)
@@ -151,3 +151,37 @@
 struct mbuf * dtom _P((PNATState, void *));
 
+#ifdef VBOX_WITH_SYNC_SLIRP
+#define VBOX_QUEUE_EDGE_CHECK(x)             \
+do {                                         \
+    AssertRelease((x) != &m_freelist);       \
+    AssertRelease((x) != &m_usedlist);       \
+    AssertRelease((x) != &if_fastq);         \
+    AssertRelease((x) != &if_batchq);        \
+} while(0)
+#ifndef IN_MBUF
+#define m_inc(a, b)                         \
+do {                                        \
+    VBOX_QUEUE_EDGE_CHECK((a));             \
+    m_inc((a),(b));                         \
+} while (0)
+
+#define m_adj(a, b)                         \
+do {                                        \
+    VBOX_QUEUE_EDGE_CHECK((a));             \
+    m_adj((a), (b));                        \
+} while (0)
+
+#ifndef RT_OS_WINDOWS
+#define m_copy(a, b, c, d)                  \
+({                                          \
+    VBOX_QUEUE_EDGE_CHECK((a));             \
+    VBOX_QUEUE_EDGE_CHECK((b));             \
+    m_copy((a), (b), (c), (d));             \
+})
 #endif
+#endif /*IN_MBUF*/
+#else
+#define VBOX_QUEUE_EDGE_CHECK(x) /*ignore*/
+#endif
+
+#endif
Index: /trunk/src/VBox/Devices/Network/slirp/slirp.c
===================================================================
--- /trunk/src/VBox/Devices/Network/slirp/slirp.c	(revision 13895)
+++ /trunk/src/VBox/Devices/Network/slirp/slirp.c	(revision 13896)
@@ -378,5 +378,5 @@
                 while (1) {
                     tcp_loop_begin:
-                    if (so == &tcb) {
+                    if (so == &tcb || so == NULL) {
                         VBOX_SLIRP_UNLOCK(pData->tcb_mutex);
                         break;
@@ -568,5 +568,5 @@
                 while (1) {
                     loop_begin:
-                    if (so == &tcb) {
+                    if (so == &tcb || so == NULL) {
                         VBOX_SLIRP_UNLOCK(pData->tcb_mutex);
                         break;
