Index: trunk/src/VBox/Devices/USB/DrvVUSBRootHub.cpp
===================================================================
--- trunk/src/VBox/Devices/USB/DrvVUSBRootHub.cpp	(revision 59724)
+++ trunk/src/VBox/Devices/USB/DrvVUSBRootHub.cpp	(revision 59737)
@@ -541,5 +541,5 @@
 {
     if (!cMillies)
-        vusbUrbDoReapAsync(pDev->pAsyncUrbHead, 0);
+        vusbUrbDoReapAsync(&pDev->LstAsyncUrbs, 0);
     else
     {
@@ -547,6 +547,6 @@
         do
         {
-            vusbUrbDoReapAsync(pDev->pAsyncUrbHead, RT_MIN(cMillies >> 8, 10));
-        } while (   pDev->pAsyncUrbHead
+            vusbUrbDoReapAsync(&pDev->LstAsyncUrbs, RT_MIN(cMillies >> 8, 10));
+        } while (   !RTListIsEmpty(&pDev->LstAsyncUrbs)
                  && RTTimeMilliTS() - u64Start < cMillies);
     }
@@ -561,5 +561,5 @@
     PVUSBDEV pDev = (PVUSBDEV)pDevice;
 
-    if (!pDev->pAsyncUrbHead)
+    if (RTListIsEmpty(&pDev->LstAsyncUrbs))
         return;
 
@@ -606,12 +606,11 @@
      * moment.
      */
-    PVUSBURB pUrb = pDev->pAsyncUrbHead;
-
-    while (pUrb)
-    {
-        PVUSBURB pNext = pUrb->pVUsb->pNext;
+    PVUSBURBVUSB pVUsbUrb, pVUsbUrbNext;
+
+    RTListForEachSafe(&pDev->LstAsyncUrbs, pVUsbUrb, pVUsbUrbNext, VUSBURBVUSBINT, NdLst)
+    {
+        PVUSBURB pUrb = pVUsbUrb->pUrb;
         /* Call the worker directly. */
         vusbUrbCancelWorker(pUrb, CANCELMODE_FAIL);
-        pUrb = pNext;
     }
 
@@ -648,8 +647,9 @@
      * Iterate the URBs, find ones corresponding to given EP, and cancel them.
      */
-    PVUSBURB pUrb = pDev->pAsyncUrbHead;
-    while (pUrb)
-    {
-        PVUSBURB pNext = pUrb->pVUsb->pNext;
+    PVUSBURBVUSB pVUsbUrb, pVUsbUrbNext;
+
+    RTListForEachSafe(&pDev->LstAsyncUrbs, pVUsbUrb, pVUsbUrbNext, VUSBURBVUSBINT, NdLst)
+    {
+        PVUSBURB pUrb = pVUsbUrb->pUrb;
 
         Assert(pUrb->pVUsb->pDev == pDev);
@@ -661,5 +661,4 @@
             AssertRC(rc);
         }
-        pUrb = pNext;
     }
 
Index: trunk/src/VBox/Devices/USB/VUSBDevice.cpp
===================================================================
--- trunk/src/VBox/Devices/USB/VUSBDevice.cpp	(revision 59724)
+++ trunk/src/VBox/Devices/USB/VUSBDevice.cpp	(revision 59737)
@@ -1049,8 +1049,8 @@
      * Iterate the URBs and cancel them.
      */
-    PVUSBURB pUrb = pDev->pAsyncUrbHead;
-    while (pUrb)
-    {
-        PVUSBURB pNext = pUrb->pVUsb->pNext;
+    PVUSBURBVUSB pVUsbUrb, pVUsbUrbNext;
+    RTListForEachSafe(&pDev->LstAsyncUrbs, pVUsbUrb, pVUsbUrbNext, VUSBURBVUSBINT, NdLst)
+    {
+        PVUSBURB pUrb = pVUsbUrb->pUrb;
 
         Assert(pUrb->pVUsb->pDev == pDev);
@@ -1059,5 +1059,4 @@
         int rc = vusbUrbCancelWorker(pUrb, CANCELMODE_FAIL);
         AssertRC(rc);
-        pUrb = pNext;
     }
 
@@ -1070,8 +1069,9 @@
     {
         cReaped = 0;
-        pUrb = pDev->pAsyncUrbHead;
-        while (pUrb)
+        pVUsbUrb = RTListGetFirst(&pDev->LstAsyncUrbs, VUSBURBVUSBINT, NdLst);
+        while (pVUsbUrb)
         {
-            PVUSBURB pNext = pUrb->pVUsb->pNext;
+            PVUSBURBVUSB pNext = RTListGetNext(&pDev->LstAsyncUrbs, pVUsbUrb, VUSBURBVUSBINT, NdLst);
+            PVUSBURB pUrb = pVUsbUrb->pUrb;
             Assert(pUrb->pVUsb->pDev == pDev);
 
@@ -1090,11 +1090,11 @@
             if (pRipe)
             {
-                if (pRipe == pNext)
-                    pNext = pNext->pVUsb->pNext;
+                if (pRipe == pNext->pUrb)
+                    pNext = RTListGetNext(&pDev->LstAsyncUrbs, pNext, VUSBURBVUSBINT, NdLst);
                 vusbUrbRipe(pRipe);
                 cReaped++;
             }
 
-            pUrb = pNext;
+            pVUsbUrb = pNext;
         }
     } while (cReaped > 0);
@@ -1105,8 +1105,7 @@
     if (fDetaching)
     {
-        pUrb = pDev->pAsyncUrbHead;
-        while (pUrb)
+        RTListForEachSafe(&pDev->LstAsyncUrbs, pVUsbUrb, pVUsbUrbNext, VUSBURBVUSBINT, NdLst)
         {
-            PVUSBURB pNext = pUrb->pVUsb->pNext;
+            PVUSBURB pUrb = pVUsbUrb->pUrb;
             Assert(pUrb->pVUsb->pDev == pDev);
 
@@ -1119,5 +1118,4 @@
              */
             pUrb->pVUsb->pfnFree(pUrb);
-            pUrb = pNext;
         }
     }
@@ -1764,4 +1762,5 @@
     pDev->pCurCfgDesc = NULL;
     pDev->paIfStates = NULL;
+    RTListInit(&pDev->LstAsyncUrbs);
     memset(&pDev->aPipes[0], 0, sizeof(pDev->aPipes));
     for (unsigned i = 0; i < RT_ELEMENTS(pDev->aPipes); i++)
Index: trunk/src/VBox/Devices/USB/VUSBInternal.h
===================================================================
--- trunk/src/VBox/Devices/USB/VUSBInternal.h	(revision 59724)
+++ trunk/src/VBox/Devices/USB/VUSBInternal.h	(revision 59737)
@@ -75,8 +75,8 @@
 typedef struct VUSBURBVUSBINT
 {
-    /** URB chain pointer. */
-    PVUSBURB        pNext;
-    /** URB chain pointer. */
-    PVUSBURB       *ppPrev;
+    /** Node for one of the lists the URB can be in. */
+    RTLISTNODE      NdLst;
+    /** Pointer to the URB this structure is part of. */
+    PVUSBURB        pUrb;
     /** Pointer to the original for control messages. */
     PVUSBURB        pCtrlUrb;
@@ -248,5 +248,9 @@
     RTCRITSECT          CritSectAsyncUrbs;
     /** List of active async URBs. */
-    PVUSBURB            pAsyncUrbHead;
+    RTLISTANCHOR        LstAsyncUrbs;
+#if HC_ARCH_BITS == 32
+    /** Align the size to a 8 byte boundary. */
+    uint32_t            u32Alignment0;
+#endif
 
     /** Dumper state. */
@@ -476,5 +480,5 @@
 int  vusbUrbSubmit(PVUSBURB pUrb);
 void vusbUrbTrace(PVUSBURB pUrb, const char *pszMsg, bool fComplete);
-void vusbUrbDoReapAsync(PVUSBURB pHead, RTMSINTERVAL cMillies);
+void vusbUrbDoReapAsync(PRTLISTANCHOR pUrbLst, RTMSINTERVAL cMillies);
 void vusbUrbDoReapAsyncDev(PVUSBDEV pDev, RTMSINTERVAL cMillies);
 void vusbUrbCancel(PVUSBURB pUrb, CANCELMODE mode);
@@ -548,9 +552,5 @@
 
     RTCritSectEnter(&pDev->CritSectAsyncUrbs);
-    *pUrb->pVUsb->ppPrev = pUrb->pVUsb->pNext;
-    if (pUrb->pVUsb->pNext)
-        pUrb->pVUsb->pNext->pVUsb->ppPrev = pUrb->pVUsb->ppPrev;
-    pUrb->pVUsb->pNext = NULL;
-    pUrb->pVUsb->ppPrev = NULL;
+    RTListNodeRemove(&pUrb->pVUsb->NdLst);
     RTCritSectLeave(&pDev->CritSectAsyncUrbs);
 }
Index: trunk/src/VBox/Devices/USB/VUSBUrb.cpp
===================================================================
--- trunk/src/VBox/Devices/USB/VUSBUrb.cpp	(revision 59724)
+++ trunk/src/VBox/Devices/USB/VUSBUrb.cpp	(revision 59737)
@@ -1236,10 +1236,6 @@
     ASMAtomicIncU32(&pDev->aPipes[pUrb->EndPt].async);
 
-    /* Queue the pUrb on the roothub */
-    pUrb->pVUsb->pNext = pDev->pAsyncUrbHead;
-    if (pDev->pAsyncUrbHead)
-        pDev->pAsyncUrbHead->pVUsb->ppPrev = &pUrb->pVUsb->pNext;
-    pDev->pAsyncUrbHead = pUrb;
-    pUrb->pVUsb->ppPrev = &pDev->pAsyncUrbHead;
+    /* Queue the Urb on the roothub */
+    RTListAppend(&pDev->LstAsyncUrbs, &pUrb->pVUsb->NdLst);
     RTCritSectLeave(&pDev->CritSectAsyncUrbs);
 
@@ -1994,16 +1990,18 @@
  * Reap in-flight URBs.
  *
- * @param   pHead       Pointer to the head of the URB list.
+ * @param   pUrbLst     Pointer to the head of the URB list.
  * @param   cMillies    Number of milliseconds to block in each reap operation.
  *                      Use 0 to not block at all.
  */
-void vusbUrbDoReapAsync(PVUSBURB pHead, RTMSINTERVAL cMillies)
-{
-    PVUSBURB pUrb = pHead;
-    while (pUrb)
-    {
+void vusbUrbDoReapAsync(PRTLISTANCHOR pUrbLst, RTMSINTERVAL cMillies)
+{
+    PVUSBURBVUSB pVUsbUrb = RTListGetFirst(pUrbLst, VUSBURBVUSBINT, NdLst);
+    while (pVUsbUrb)
+    {
+        PVUSBURB pUrb = pVUsbUrb->pUrb;
+
         vusbUrbAssert(pUrb);
-        PVUSBURB pUrbNext = pUrb->pVUsb->pNext;
-        PVUSBDEV pDev = pUrb->pVUsb->pDev;
+        PVUSBURBVUSB pVUsbUrbNext = RTListGetNext(pUrbLst, pVUsbUrb, VUSBURBVUSBINT, NdLst);
+        PVUSBDEV pDev = pVUsbUrb->pDev;
 
         /* Don't touch resetting devices - paranoid safety precaution. */
@@ -2024,6 +2022,6 @@
             {
                 vusbUrbAssert(pRipe);
-                if (pRipe == pUrbNext)
-                    pUrbNext = pUrbNext->pVUsb->pNext;
+                if (pRipe == pVUsbUrbNext->pUrb)
+                    pVUsbUrbNext = RTListGetNext(pUrbLst, pVUsbUrb, VUSBURBVUSBINT, NdLst);
                 vusbUrbRipe(pRipe);
             }
@@ -2031,5 +2029,5 @@
 
         /* next */
-        pUrb = pUrbNext;
+        pVUsbUrb = pVUsbUrbNext;
     }
 }
Index: trunk/src/VBox/Devices/USB/VUSBUrbPool.cpp
===================================================================
--- trunk/src/VBox/Devices/USB/VUSBUrbPool.cpp	(revision 59724)
+++ trunk/src/VBox/Devices/USB/VUSBUrbPool.cpp	(revision 59737)
@@ -192,8 +192,7 @@
     pUrb->pVUsb                  = (PVUSBURBVUSB)&pUrb->abData[offAlloc];
     offAlloc += sizeof(VUSBURBVUSBINT);
+    pUrb->pVUsb->pUrb            = pUrb;
     pUrb->pVUsb->pvFreeCtx       = NULL;
     pUrb->pVUsb->pfnFree         = NULL;
-    pUrb->pVUsb->pNext           = NULL;
-    pUrb->pVUsb->ppPrev          = NULL;
     pUrb->pVUsb->pCtrlUrb        = NULL;
     pUrb->pVUsb->u64SubmitTS     = 0;
