Index: trunk/src/VBox/Devices/Storage/DevLsiLogicSCSI.cpp
===================================================================
--- trunk/src/VBox/Devices/Storage/DevLsiLogicSCSI.cpp	(revision 64807)
+++ trunk/src/VBox/Devices/Storage/DevLsiLogicSCSI.cpp	(revision 64808)
@@ -287,4 +287,10 @@
     /** Critical section protecting the reply free queue. */
     PDMCRITSECT           ReplyFreeQueueCritSect;
+    /** Critical section protecting the request queue against
+     * concurrent access from the guest. */
+    PDMCRITSECT           RequestQueueCritSect;
+    /** Critical section protecting the reply free queue against
+     * concurrent write access from the guest. */
+    PDMCRITSECT           ReplyFreeQueueWriteCritSect;
 
     /** Pointer to the start of the reply free queue - R3. */
@@ -1276,12 +1282,20 @@
         case LSILOGIC_REG_REPLY_QUEUE:
         {
+            int rc = PDMCritSectEnter(&pThis->ReplyFreeQueueWriteCritSect, VINF_IOM_R3_MMIO_WRITE);
+            if (rc != VINF_SUCCESS)
+                return rc;
             /* Add the entry to the reply free queue. */
             ASMAtomicWriteU32(&pThis->CTX_SUFF(pReplyFreeQueueBase)[pThis->uReplyFreeQueueNextEntryFreeWrite], u32);
             pThis->uReplyFreeQueueNextEntryFreeWrite++;
             pThis->uReplyFreeQueueNextEntryFreeWrite %= pThis->cReplyQueueEntries;
+            PDMCritSectLeave(&pThis->ReplyFreeQueueWriteCritSect);
             break;
         }
         case LSILOGIC_REG_REQUEST_QUEUE:
         {
+            int rc = PDMCritSectEnter(&pThis->RequestQueueCritSect, VINF_IOM_R3_MMIO_WRITE);
+            if (rc != VINF_SUCCESS)
+                return rc;
+
             uint32_t uNextWrite = ASMAtomicReadU32(&pThis->uRequestQueueNextEntryFreeWrite);
 
@@ -1297,4 +1311,5 @@
             uNextWrite %= pThis->cRequestQueueEntries;
             ASMAtomicWriteU32(&pThis->uRequestQueueNextEntryFreeWrite, uNextWrite);
+            PDMCritSectLeave(&pThis->RequestQueueCritSect);
 
             /* Send notification to R3 if there is not one sent already. Do this
@@ -1310,5 +1325,5 @@
 #else
                     LogFlowFunc(("Signal event semaphore\n"));
-                    int rc = SUPSemEventSignal(pThis->pSupDrvSession, pThis->hEvtProcess);
+                    rc = SUPSemEventSignal(pThis->pSupDrvSession, pThis->hEvtProcess);
                     AssertRC(rc);
 #endif
@@ -5305,4 +5320,6 @@
     PDMR3CritSectDelete(&pThis->ReplyFreeQueueCritSect);
     PDMR3CritSectDelete(&pThis->ReplyPostQueueCritSect);
+    PDMR3CritSectDelete(&pThis->RequestQueueCritSect);
+    PDMR3CritSectDelete(&pThis->ReplyFreeQueueWriteCritSect);
 
     RTMemFree(pThis->paDeviceStates);
@@ -5470,4 +5487,12 @@
     if (RT_FAILURE(rc))
         return PDMDEV_SET_ERROR(pDevIns, rc, N_("LsiLogic: cannot create critical section for reply post queue"));
+
+    rc = PDMDevHlpCritSectInit(pDevIns, &pThis->RequestQueueCritSect, RT_SRC_POS, "%sRQ", szDevTag);
+    if (RT_FAILURE(rc))
+        return PDMDEV_SET_ERROR(pDevIns, rc, N_("LsiLogic: cannot create critical section for request queue"));
+
+    rc = PDMDevHlpCritSectInit(pDevIns, &pThis->ReplyFreeQueueWriteCritSect, RT_SRC_POS, "%sRFQW", szDevTag);
+    if (RT_FAILURE(rc))
+        return PDMDEV_SET_ERROR(pDevIns, rc, N_("LsiLogic: cannot create critical section for reply free queue write access"));
 
     /*
Index: trunk/src/VBox/Devices/testcase/tstDeviceStructSizeRC.cpp
===================================================================
--- trunk/src/VBox/Devices/testcase/tstDeviceStructSizeRC.cpp	(revision 64807)
+++ trunk/src/VBox/Devices/testcase/tstDeviceStructSizeRC.cpp	(revision 64808)
@@ -1745,4 +1745,6 @@
     GEN_CHECK_OFF(LSILOGICSCSI, ReplyPostQueueCritSect);
     GEN_CHECK_OFF(LSILOGICSCSI, ReplyFreeQueueCritSect);
+    GEN_CHECK_OFF(LSILOGICSCSI, RequestQueueCritSect);
+    GEN_CHECK_OFF(LSILOGICSCSI, ReplyFreeQueueWriteCritSect);
     GEN_CHECK_OFF(LSILOGICSCSI, pReplyFreeQueueBaseR3);
     GEN_CHECK_OFF(LSILOGICSCSI, pReplyPostQueueBaseR3);
