Index: trunk/src/VBox/Runtime/common/misc/req.cpp
===================================================================
--- trunk/src/VBox/Runtime/common/misc/req.cpp	(revision 88810)
+++ trunk/src/VBox/Runtime/common/misc/req.cpp	(revision 88813)
@@ -197,5 +197,6 @@
          * Check packet state.
          */
-        switch (pReq->enmState)
+        RTREQSTATE const enmState = pReq->enmState;
+        switch (enmState)
         {
             case RTREQSTATE_ALLOCATED:
@@ -203,6 +204,5 @@
                 break;
             default:
-                AssertMsgFailed(("Invalid state %d!\n", pReq->enmState));
-                return 0;
+                AssertMsgFailedReturn(("Invalid state %d!\n", enmState), 0);
         }
 
@@ -248,12 +248,11 @@
 
     /*
-     * Insert it.  Donate the caller's reference if RTREQFLAGS_NO_WAIT is set,
-     * otherwise retain another reference for the queue.
+     * Insert it.  Always grab a reference for the queue (we used to
+     * donate the caller's reference in the NO_WAIT case once upon a time).
      */
     pReq->uSubmitNanoTs = RTTimeNanoTS();
     pReq->enmState      = RTREQSTATE_QUEUED;
     unsigned fFlags = ((RTREQ volatile *)pReq)->fFlags;                    /* volatile paranoia */
-    if (!(fFlags & RTREQFLAGS_NO_WAIT))
-        RTReqRetain(pReq);
+    RTReqRetain(pReq);
 
     if (!pReq->fPoolOrQueue)
@@ -285,8 +284,10 @@
     AssertPtrReturn(pReq, VERR_INVALID_HANDLE);
     AssertReturn(pReq->u32Magic == RTREQ_MAGIC, VERR_INVALID_HANDLE);
-    AssertMsgReturn(   pReq->enmState == RTREQSTATE_QUEUED
-                    || pReq->enmState == RTREQSTATE_PROCESSING
-                    || pReq->enmState == RTREQSTATE_COMPLETED,
-                    ("Invalid state %d\n", pReq->enmState),
+    RTREQSTATE enmState = pReq->enmState;
+    AssertMsgReturn(   enmState == RTREQSTATE_QUEUED
+                    || enmState == RTREQSTATE_PROCESSING
+                    || enmState == RTREQSTATE_COMPLETED
+                    || enmState == RTREQSTATE_CANCELLED,
+                    ("Invalid state %d\n", enmState),
                     VERR_RT_REQUEST_STATE);
     AssertMsgReturn(pReq->uOwner.hQueue && pReq->EventSem != NIL_RTSEMEVENT,
@@ -313,5 +314,5 @@
     }
     if (rc == VINF_SUCCESS)
-        ASMAtomicXchgSize(&pReq->fEventSemClear, true);
+        ASMAtomicWriteBool(&pReq->fEventSemClear, true);
     if (pReq->enmState == RTREQSTATE_COMPLETED)
         rc = VINF_SUCCESS;
@@ -324,4 +325,45 @@
 
 
+RTDECL(int) RTReqCancel(PRTREQ hReq)
+{
+    LogFlow(("RTReqCancel: hReq=%p\n", hReq));
+
+    /*
+     * Verify the supplied package.
+     */
+    PRTREQINT pReq = hReq;
+    AssertPtrReturn(pReq, VERR_INVALID_HANDLE);
+    AssertReturn(pReq->u32Magic == RTREQ_MAGIC, VERR_INVALID_HANDLE);
+    //AssertMsgReturn(pReq->enmState == RTREQSTATE_ALLOCATED, ("%d\n", pReq->enmState), VERR_RT_REQUEST_STATE);
+    AssertMsgReturn(pReq->uOwner.hQueue && !pReq->pNext && pReq->EventSem != NIL_RTSEMEVENT,
+                    ("Invalid request package! Anyone cooking their own packages???\n"),
+                    VERR_RT_REQUEST_INVALID_PACKAGE);
+    AssertMsgReturn(pReq->enmType > RTREQTYPE_INVALID && pReq->enmType < RTREQTYPE_MAX,
+                    ("Invalid package type %d valid range %d-%d inclusively. This was verified on alloc too...\n",
+                     pReq->enmType, RTREQTYPE_INVALID + 1, RTREQTYPE_MAX - 1),
+                    VERR_RT_REQUEST_INVALID_TYPE);
+
+    /*
+     * Try cancel the request itself by changing its state.
+     */
+    int rc;
+    if (ASMAtomicCmpXchgU32((uint32_t volatile *)&pReq->enmState, RTREQSTATE_CANCELLED, RTREQSTATE_QUEUED))
+    {
+        if (pReq->fPoolOrQueue)
+            rtReqPoolCancel(pReq->uOwner.hPool, pReq);
+        rc = VINF_SUCCESS;
+    }
+    else
+    {
+        Assert(pReq->enmState == RTREQSTATE_PROCESSING || pReq->enmState == RTREQSTATE_COMPLETED);
+        rc = VERR_RT_REQUEST_STATE;
+    }
+
+    LogFlow(("RTReqCancel: returns %Rrc\n", rc));
+    return rc;
+}
+RT_EXPORT_SYMBOL(RTReqCancel);
+
+
 RTDECL(int) RTReqGetStatus(PRTREQ hReq)
 {
@@ -347,105 +389,115 @@
 
     /*
-     * Process the request.
-     */
-    Assert(pReq->enmState == RTREQSTATE_QUEUED);
-    pReq->enmState = RTREQSTATE_PROCESSING;
+     * Try switch the request status to processing.
+     */
     int     rcRet = VINF_SUCCESS;           /* the return code of this function. */
     int     rcReq = VERR_NOT_IMPLEMENTED;   /* the request status. */
-    switch (pReq->enmType)
+    if (ASMAtomicCmpXchgU32((uint32_t volatile *)&pReq->enmState, RTREQSTATE_PROCESSING, RTREQSTATE_QUEUED))
     {
         /*
-         * A packed down call frame.
+         * Process the request.
          */
-        case RTREQTYPE_INTERNAL:
+        pReq->enmState = RTREQSTATE_PROCESSING;
+        switch (pReq->enmType)
         {
-            uintptr_t *pauArgs = &pReq->u.Internal.aArgs[0];
-            union
+            /*
+             * A packed down call frame.
+             */
+            case RTREQTYPE_INTERNAL:
             {
-                PFNRT pfn;
-                DECLCALLBACKMEMBER(int, pfn00,(void));
-                DECLCALLBACKMEMBER(int, pfn01,(uintptr_t));
-                DECLCALLBACKMEMBER(int, pfn02,(uintptr_t, uintptr_t));
-                DECLCALLBACKMEMBER(int, pfn03,(uintptr_t, uintptr_t, uintptr_t));
-                DECLCALLBACKMEMBER(int, pfn04,(uintptr_t, uintptr_t, uintptr_t, uintptr_t));
-                DECLCALLBACKMEMBER(int, pfn05,(uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t));
-                DECLCALLBACKMEMBER(int, pfn06,(uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t));
-                DECLCALLBACKMEMBER(int, pfn07,(uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t));
-                DECLCALLBACKMEMBER(int, pfn08,(uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t));
-                DECLCALLBACKMEMBER(int, pfn09,(uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t));
-                DECLCALLBACKMEMBER(int, pfn10,(uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t));
-                DECLCALLBACKMEMBER(int, pfn11,(uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t));
-                DECLCALLBACKMEMBER(int, pfn12,(uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t));
-            } u;
-            u.pfn = pReq->u.Internal.pfn;
+                uintptr_t *pauArgs = &pReq->u.Internal.aArgs[0];
+                union
+                {
+                    PFNRT pfn;
+                    DECLCALLBACKMEMBER(int, pfn00,(void));
+                    DECLCALLBACKMEMBER(int, pfn01,(uintptr_t));
+                    DECLCALLBACKMEMBER(int, pfn02,(uintptr_t, uintptr_t));
+                    DECLCALLBACKMEMBER(int, pfn03,(uintptr_t, uintptr_t, uintptr_t));
+                    DECLCALLBACKMEMBER(int, pfn04,(uintptr_t, uintptr_t, uintptr_t, uintptr_t));
+                    DECLCALLBACKMEMBER(int, pfn05,(uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t));
+                    DECLCALLBACKMEMBER(int, pfn06,(uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t));
+                    DECLCALLBACKMEMBER(int, pfn07,(uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t));
+                    DECLCALLBACKMEMBER(int, pfn08,(uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t));
+                    DECLCALLBACKMEMBER(int, pfn09,(uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t));
+                    DECLCALLBACKMEMBER(int, pfn10,(uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t));
+                    DECLCALLBACKMEMBER(int, pfn11,(uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t));
+                    DECLCALLBACKMEMBER(int, pfn12,(uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t));
+                } u;
+                u.pfn = pReq->u.Internal.pfn;
 #ifndef RT_ARCH_X86
-            switch (pReq->u.Internal.cArgs)
-            {
-                case 0:  rcRet = u.pfn00(); break;
-                case 1:  rcRet = u.pfn01(pauArgs[0]); break;
-                case 2:  rcRet = u.pfn02(pauArgs[0], pauArgs[1]); break;
-                case 3:  rcRet = u.pfn03(pauArgs[0], pauArgs[1], pauArgs[2]); break;
-                case 4:  rcRet = u.pfn04(pauArgs[0], pauArgs[1], pauArgs[2], pauArgs[3]); break;
-                case 5:  rcRet = u.pfn05(pauArgs[0], pauArgs[1], pauArgs[2], pauArgs[3], pauArgs[4]); break;
-                case 6:  rcRet = u.pfn06(pauArgs[0], pauArgs[1], pauArgs[2], pauArgs[3], pauArgs[4], pauArgs[5]); break;
-                case 7:  rcRet = u.pfn07(pauArgs[0], pauArgs[1], pauArgs[2], pauArgs[3], pauArgs[4], pauArgs[5], pauArgs[6]); break;
-                case 8:  rcRet = u.pfn08(pauArgs[0], pauArgs[1], pauArgs[2], pauArgs[3], pauArgs[4], pauArgs[5], pauArgs[6], pauArgs[7]); break;
-                case 9:  rcRet = u.pfn09(pauArgs[0], pauArgs[1], pauArgs[2], pauArgs[3], pauArgs[4], pauArgs[5], pauArgs[6], pauArgs[7], pauArgs[8]); break;
-                case 10: rcRet = u.pfn10(pauArgs[0], pauArgs[1], pauArgs[2], pauArgs[3], pauArgs[4], pauArgs[5], pauArgs[6], pauArgs[7], pauArgs[8], pauArgs[9]); break;
-                case 11: rcRet = u.pfn11(pauArgs[0], pauArgs[1], pauArgs[2], pauArgs[3], pauArgs[4], pauArgs[5], pauArgs[6], pauArgs[7], pauArgs[8], pauArgs[9], pauArgs[10]); break;
-                case 12: rcRet = u.pfn12(pauArgs[0], pauArgs[1], pauArgs[2], pauArgs[3], pauArgs[4], pauArgs[5], pauArgs[6], pauArgs[7], pauArgs[8], pauArgs[9], pauArgs[10], pauArgs[11]); break;
-                default:
-                    AssertReleaseMsgFailed(("cArgs=%d\n", pReq->u.Internal.cArgs));
-                    rcRet = rcReq = VERR_INTERNAL_ERROR;
-                    break;
-            }
+                switch (pReq->u.Internal.cArgs)
+                {
+                    case 0:  rcRet = u.pfn00(); break;
+                    case 1:  rcRet = u.pfn01(pauArgs[0]); break;
+                    case 2:  rcRet = u.pfn02(pauArgs[0], pauArgs[1]); break;
+                    case 3:  rcRet = u.pfn03(pauArgs[0], pauArgs[1], pauArgs[2]); break;
+                    case 4:  rcRet = u.pfn04(pauArgs[0], pauArgs[1], pauArgs[2], pauArgs[3]); break;
+                    case 5:  rcRet = u.pfn05(pauArgs[0], pauArgs[1], pauArgs[2], pauArgs[3], pauArgs[4]); break;
+                    case 6:  rcRet = u.pfn06(pauArgs[0], pauArgs[1], pauArgs[2], pauArgs[3], pauArgs[4], pauArgs[5]); break;
+                    case 7:  rcRet = u.pfn07(pauArgs[0], pauArgs[1], pauArgs[2], pauArgs[3], pauArgs[4], pauArgs[5], pauArgs[6]); break;
+                    case 8:  rcRet = u.pfn08(pauArgs[0], pauArgs[1], pauArgs[2], pauArgs[3], pauArgs[4], pauArgs[5], pauArgs[6], pauArgs[7]); break;
+                    case 9:  rcRet = u.pfn09(pauArgs[0], pauArgs[1], pauArgs[2], pauArgs[3], pauArgs[4], pauArgs[5], pauArgs[6], pauArgs[7], pauArgs[8]); break;
+                    case 10: rcRet = u.pfn10(pauArgs[0], pauArgs[1], pauArgs[2], pauArgs[3], pauArgs[4], pauArgs[5], pauArgs[6], pauArgs[7], pauArgs[8], pauArgs[9]); break;
+                    case 11: rcRet = u.pfn11(pauArgs[0], pauArgs[1], pauArgs[2], pauArgs[3], pauArgs[4], pauArgs[5], pauArgs[6], pauArgs[7], pauArgs[8], pauArgs[9], pauArgs[10]); break;
+                    case 12: rcRet = u.pfn12(pauArgs[0], pauArgs[1], pauArgs[2], pauArgs[3], pauArgs[4], pauArgs[5], pauArgs[6], pauArgs[7], pauArgs[8], pauArgs[9], pauArgs[10], pauArgs[11]); break;
+                    default:
+                        AssertReleaseMsgFailed(("cArgs=%d\n", pReq->u.Internal.cArgs));
+                        rcRet = rcReq = VERR_INTERNAL_ERROR;
+                        break;
+                }
 #else /* RT_ARCH_X86 */
-            size_t cbArgs = pReq->u.Internal.cArgs * sizeof(uintptr_t);
+                size_t cbArgs = pReq->u.Internal.cArgs * sizeof(uintptr_t);
 # ifdef __GNUC__
-            __asm__ __volatile__("movl  %%esp, %%edx\n\t"
-                                 "subl  %2, %%esp\n\t"
-                                 "andl  $0xfffffff0, %%esp\n\t"
-                                 "shrl  $2, %2\n\t"
-                                 "movl  %%esp, %%edi\n\t"
-                                 "rep movsl\n\t"
-                                 "movl  %%edx, %%edi\n\t"
-                                 "call  *%%eax\n\t"
-                                 "mov   %%edi, %%esp\n\t"
-                                 : "=a" (rcRet),
-                                   "=S" (pauArgs),
-                                   "=c" (cbArgs)
-                                 : "0" (u.pfn),
-                                   "1" (pauArgs),
-                                   "2" (cbArgs)
-                                 : "edi", "edx");
+                __asm__ __volatile__("movl  %%esp, %%edx\n\t"
+                                     "subl  %2, %%esp\n\t"
+                                     "andl  $0xfffffff0, %%esp\n\t"
+                                     "shrl  $2, %2\n\t"
+                                     "movl  %%esp, %%edi\n\t"
+                                     "rep movsl\n\t"
+                                     "movl  %%edx, %%edi\n\t"
+                                     "call  *%%eax\n\t"
+                                     "mov   %%edi, %%esp\n\t"
+                                     : "=a" (rcRet),
+                                       "=S" (pauArgs),
+                                       "=c" (cbArgs)
+                                     : "0" (u.pfn),
+                                       "1" (pauArgs),
+                                       "2" (cbArgs)
+                                     : "edi", "edx");
 # else
-            __asm
-            {
-                xor     edx, edx        /* just mess it up. */
-                mov     eax, u.pfn
-                mov     ecx, cbArgs
-                shr     ecx, 2
-                mov     esi, pauArgs
-                mov     ebx, esp
-                sub     esp, cbArgs
-                and     esp, 0xfffffff0
-                mov     edi, esp
-                rep movsd
-                call    eax
-                mov     esp, ebx
-                mov     rcRet, eax
-            }
+                __asm
+                {
+                    xor     edx, edx        /* just mess it up. */
+                    mov     eax, u.pfn
+                    mov     ecx, cbArgs
+                    shr     ecx, 2
+                    mov     esi, pauArgs
+                    mov     ebx, esp
+                    sub     esp, cbArgs
+                    and     esp, 0xfffffff0
+                    mov     edi, esp
+                    rep movsd
+                    call    eax
+                    mov     esp, ebx
+                    mov     rcRet, eax
+                }
 # endif
 #endif /* RT_ARCH_X86 */
-            if ((pReq->fFlags & (RTREQFLAGS_RETURN_MASK)) == RTREQFLAGS_VOID)
-                rcRet = VINF_SUCCESS;
-            rcReq = rcRet;
-            break;
+                if ((pReq->fFlags & (RTREQFLAGS_RETURN_MASK)) == RTREQFLAGS_VOID)
+                    rcRet = VINF_SUCCESS;
+                rcReq = rcRet;
+                break;
+            }
+
+            default:
+                AssertMsgFailed(("pReq->enmType=%d\n", pReq->enmType));
+                rcReq = VERR_NOT_IMPLEMENTED;
+                break;
         }
-
-        default:
-            AssertMsgFailed(("pReq->enmType=%d\n", pReq->enmType));
-            rcReq = VERR_NOT_IMPLEMENTED;
-            break;
+    }
+    else
+    {
+        Assert(pReq->enmState == RTREQSTATE_CANCELLED);
+        rcReq = VERR_CANCELLED;
     }
 
@@ -463,5 +515,5 @@
         LogFlow(("rtReqProcessOne: Completed request %p: rcReq=%Rrc rcRet=%Rrc - notifying waiting thread\n",
                  pReq, rcReq, rcRet));
-        ASMAtomicXchgSize(&pReq->fEventSemClear, false);
+        ASMAtomicWriteBool(&pReq->fEventSemClear, false);
         int rc2 = RTSemEventSignal(pReq->EventSem);
         if (rc2 != VINF_SUCCESS)
Index: trunk/src/VBox/Runtime/common/misc/reqpool.cpp
===================================================================
--- trunk/src/VBox/Runtime/common/misc/reqpool.cpp	(revision 88810)
+++ trunk/src/VBox/Runtime/common/misc/reqpool.cpp	(revision 88813)
@@ -187,4 +187,6 @@
     /** The number of requests submitted. */
     uint64_t                cReqSubmitted;
+    /** The number of cancelled. */
+    uint64_t                cReqCancelled;
 
     /** Head of the request recycling LIFO. */
@@ -231,5 +233,7 @@
 
     uint32_t cMsCurPushBack;
-    if ((cMsRange >> 2) >= cSteps)
+    if (cSteps == 0 /* disabled */)
+        cMsCurPushBack = 0;
+    else if ((cMsRange >> 2) >= cSteps)
         cMsCurPushBack = cMsRange / cSteps * iStep;
     else
@@ -558,5 +562,5 @@
     pReq->pNext = NULL;
     *pPool->ppPendingRequests = pReq;
-    pPool->ppPendingRequests  = (PRTREQINT*)&pReq->pNext;
+    pPool->ppPendingRequests  = (PRTREQINT *)&pReq->pNext;
     pPool->cCurPendingRequests++;
 
@@ -588,4 +592,57 @@
      */
     rtReqPoolCreateNewWorker(pPool);
+
+    RTCritSectLeave(&pPool->CritSect);
+    return;
+}
+
+
+/**
+ * Worker for RTReqCancel that looks for the request in the pending list and
+ * completes it if found there.
+ *
+ * @param   pPool               The request thread pool.
+ * @param   pReq                The request.
+ */
+DECLHIDDEN(void) rtReqPoolCancel(PRTREQPOOLINT pPool, PRTREQINT pReq)
+{
+    RTCritSectEnter(&pPool->CritSect);
+
+    pPool->cReqCancelled++;
+
+    /*
+     * Check if the request is in the pending list.
+     */
+    PRTREQINT pPrev = NULL;
+    PRTREQINT pCur  = pPool->pPendingRequests;
+    while (pCur)
+        if (pCur != pReq)
+        {
+            pPrev = pCur;
+            pCur  = pCur->pNext;
+        }
+        else
+        {
+            /*
+             * Unlink it and process it.
+             */
+            if (!pPrev)
+            {
+                pPool->pPendingRequests = pReq->pNext;
+                if (!pReq->pNext)
+                    pPool->ppPendingRequests = &pPool->pPendingRequests;
+            }
+            else
+            {
+                pPrev->pNext = pReq->pNext;
+                if (!pReq->pNext)
+                    pPool->ppPendingRequests = (PRTREQINT *)&pPrev->pNext;
+            }
+            Assert(pPool->cCurPendingRequests > 0);
+            pPool->cCurPendingRequests--;
+
+            rtReqProcessOne(pReq);
+            break;
+        }
 
     RTCritSectLeave(&pPool->CritSect);
@@ -692,4 +749,5 @@
     pPool->cCurActiveRequests   = 0;
     pPool->cReqSubmitted        = 0;
+    pPool->cReqCancelled        = 0;
     pPool->pFreeRequests        = NULL;
     pPool->cCurFreeRequests     = 0;
@@ -956,4 +1014,5 @@
         case RTREQPOOLSTAT_REQUESTS_PROCESSED:          u64 = pPool->cReqProcessed; break;
         case RTREQPOOLSTAT_REQUESTS_SUBMITTED:          u64 = pPool->cReqSubmitted; break;
+        case RTREQPOOLSTAT_REQUESTS_CANCELLED:          u64 = pPool->cReqCancelled; break;
         case RTREQPOOLSTAT_REQUESTS_PENDING:            u64 = pPool->cCurPendingRequests; break;
         case RTREQPOOLSTAT_REQUESTS_ACTIVE:             u64 = pPool->cCurActiveRequests; break;
@@ -1126,5 +1185,5 @@
     AssertPtrReturn(pfnFunction, VERR_INVALID_POINTER);
     AssertMsgReturn(!((uint32_t)fFlags & ~(uint32_t)(RTREQFLAGS_NO_WAIT | RTREQFLAGS_RETURN_MASK)), ("%#x\n", (uint32_t)fFlags), VERR_INVALID_PARAMETER);
-    if (!(fFlags & RTREQFLAGS_NO_WAIT))
+    if (!(fFlags & RTREQFLAGS_NO_WAIT) || phReq)
     {
         AssertPtrReturn(phReq, VERR_INVALID_POINTER);
@@ -1159,5 +1218,5 @@
     }
 
-    if (!(fFlags & RTREQFLAGS_NO_WAIT))
+    if (phReq)
     {
         *phReq = pReq;
@@ -1165,5 +1224,8 @@
     }
     else
+    {
+        RTReqRelease(pReq);
         LogFlow(("RTReqPoolCallExV: returns %Rrc\n", rc));
+    }
     return rc;
 }
Index: trunk/src/VBox/Runtime/common/misc/reqqueue.cpp
===================================================================
--- trunk/src/VBox/Runtime/common/misc/reqqueue.cpp	(revision 88810)
+++ trunk/src/VBox/Runtime/common/misc/reqqueue.cpp	(revision 88813)
@@ -237,5 +237,5 @@
     {
         AssertPtrReturn(ppReq, VERR_INVALID_POINTER);
-        *ppReq = NULL;
+        *ppReq = NIL_RTREQ;
     }
 
@@ -269,5 +269,5 @@
         pReq = NULL;
     }
-    if (!(fFlags & RTREQFLAGS_NO_WAIT))
+    if (ppReq)
     {
         *ppReq = pReq;
@@ -275,5 +275,8 @@
     }
     else
+    {
+        RTReqRelease(pReq);
         LogFlow(("RTReqQueueCallV: returns %Rrc\n", rc));
+    }
     Assert(rc != VERR_INTERRUPTED);
     return rc;
