Index: /trunk/src/VBox/Main/src-client/DisplayImpl.cpp
===================================================================
--- /trunk/src/VBox/Main/src-client/DisplayImpl.cpp	(revision 90226)
+++ /trunk/src/VBox/Main/src-client/DisplayImpl.cpp	(revision 90227)
@@ -16,7 +16,4 @@
  */
 
-#ifdef DEBUG_bird               // temporary - bugref:9990
-# define RTMEM_WRAP_TO_EF_APIS  // temporary - bugref:9990
-#endif                          // temporary - bugref:9990
 #define LOG_GROUP LOG_GROUP_MAIN_DISPLAY
 #include "LoggingNew.h"
Index: /trunk/src/VBox/Main/src-client/HGCM.cpp
===================================================================
--- /trunk/src/VBox/Main/src-client/HGCM.cpp	(revision 90226)
+++ /trunk/src/VBox/Main/src-client/HGCM.cpp	(revision 90227)
@@ -72,6 +72,4 @@
     /* The service name follows. */
 };
-
-class HGCMClient;
 
 /** Internal helper service object. HGCM code would use it to
@@ -172,5 +170,5 @@
 
         int CreateAndConnectClient(uint32_t *pu32ClientIdOut, uint32_t u32ClientIdIn, uint32_t fRequestor, bool fRestoring);
-        int DisconnectClient(uint32_t u32ClientId, bool fFromService, HGCMClient *pClient);
+        int DisconnectClient(uint32_t u32ClientId, bool fFromService);
 
         int HostCall(uint32_t u32Function, uint32_t cParms, VBOXHGCMSVCPARM *paParms);
@@ -434,8 +432,6 @@
 {
     public:
-        /** client identifier */
+        /* client identifier */
         uint32_t u32ClientId;
-        /** The client instance. */
-        HGCMClient *pClient;
 };
 
@@ -636,10 +632,14 @@
                 HGCMMsgSvcDisconnect *pMsg = (HGCMMsgSvcDisconnect *)pMsgCore;
 
-                LogFlowFunc(("SVC_MSG_DISCONNECT u32ClientId = %d, pClient = %p\n", pMsg->u32ClientId, pMsg->pClient));
-
-                if (pMsg->pClient)
+                LogFlowFunc(("SVC_MSG_DISCONNECT u32ClientId = %d\n", pMsg->u32ClientId));
+
+                HGCMClient *pClient = (HGCMClient *)hgcmObjReference(pMsg->u32ClientId, HGCMOBJ_CLIENT);
+
+                if (pClient)
                 {
                     rc = pSvc->m_fntable.pfnDisconnect(pSvc->m_fntable.pvService, pMsg->u32ClientId,
-                                                       HGCM_CLIENT_DATA(pSvc, pMsg->pClient));
+                                                       HGCM_CLIENT_DATA(pSvc, pClient));
+
+                    hgcmObjDereference(pClient);
                 }
                 else
@@ -868,10 +868,7 @@
      HGCMService *pService = static_cast <HGCMService *> (pvInstance);
 
-     AssertMsgFailed(("This is unused code with a serialization issue.\n"
-                      "It touches data which is normally serialized by only running on the HGCM thread!\n"));
-
      if (pService)
      {
-         pService->DisconnectClient(u32ClientId, true, NULL);
+         pService->DisconnectClient(u32ClientId, true);
      }
 }
@@ -1383,12 +1380,6 @@
         while (pSvc->m_cClients && pSvc->m_paClientIds)
         {
-            uint32_t const     idClient = pSvc->m_paClientIds[0];
-            HGCMClient * const pClient  = (HGCMClient *)hgcmObjReference(idClient, HGCMOBJ_CLIENT);
-            Assert(pClient);
-            LogFlowFunc(("handle %d/%p\n", pSvc->m_paClientIds[0], pClient));
-
-            pSvc->DisconnectClient(pSvc->m_paClientIds[0], false, pClient);
-
-            hgcmObjDereference(pClient);
+            LogFlowFunc(("handle %d\n", pSvc->m_paClientIds[0]));
+            pSvc->DisconnectClient(pSvc->m_paClientIds[0], false);
         }
 
@@ -1657,56 +1648,15 @@
 }
 
-/**
- * Disconnect the client from the service and delete the client handle.
- *
- * @param   u32ClientId     The handle of the client.
- * @param   fFromService    Set if called by the service via
- *                          svcHlpDisconnectClient().  pClient can be NULL when
- *                          this is @c true.
- * @param   pClient         The client disconnecting.  NULL if from service.
- * @return  VBox status code.
- */
-int HGCMService::DisconnectClient(uint32_t u32ClientId, bool fFromService, HGCMClient *pClient)
-{
-    Assert(pClient || !fFromService);
-
-    LogFlowFunc(("client id = %d, fFromService = %d, pClient = %p\n", u32ClientId, fFromService, pClient));
-
-    /*
-     * Destroy the client handle prior to the disconnecting to avoid creating
-     * a race with other messages from the same client.  See @bugref{10038}
-     * for further details. 
-     */
-    bool fReleaseService = false;
-    int  rc              = VERR_NOT_FOUND;
-    for (uint32_t i = 0; i < m_cClients; i++)
-    {
-        if (m_paClientIds[i] == u32ClientId)
-        {
-            m_cClients--;
-
-            if (m_cClients > i)
-                memmove(&m_paClientIds[i], &m_paClientIds[i + 1], sizeof(m_paClientIds[0]) * (m_cClients - i));
-
-            /* Delete the client handle. */
-            hgcmObjDeleteHandle(u32ClientId);
-            fReleaseService = true;
-
-            rc = VINF_SUCCESS;
-            break;
-        }
-    }
-
-    /* Some paranoia wrt to not trusting the client ID array. */
-    Assert(rc == VINF_SUCCESS || fFromService);
-    if (rc == VERR_NOT_FOUND && !fFromService)
-    {
-        hgcmObjDeleteHandle(u32ClientId);
-        fReleaseService = true;
-    }
-
-    /*
-     * Call the service.
-     */
+/* Disconnect the client from the service and delete the client handle.
+ *
+ * @param u32ClientId  The handle of the client.
+ * @return VBox rc.
+ */
+int HGCMService::DisconnectClient(uint32_t u32ClientId, bool fFromService)
+{
+    int rc = VINF_SUCCESS;
+
+    LogFlowFunc(("client id = %d, fFromService = %d\n", u32ClientId, fFromService));
+
     if (!fFromService)
     {
@@ -1721,5 +1671,4 @@
 
             pMsg->u32ClientId = u32ClientId;
-            pMsg->pClient = pClient;
 
             rc = hgcmMsgSend(pMsg);
@@ -1732,10 +1681,25 @@
     }
 
-
-    /*
-     * Release the pClient->pService reference.
-     */
-    if (fReleaseService)
-        ReleaseService();
+    /* Remove the client id from the array in any case, rc does not matter. */
+    uint32_t i;
+
+    for (i = 0; i < m_cClients; i++)
+    {
+        if (m_paClientIds[i] == u32ClientId)
+        {
+            m_cClients--;
+
+            if (m_cClients > i)
+                memmove(&m_paClientIds[i], &m_paClientIds[i + 1], sizeof(m_paClientIds[0]) * (m_cClients - i));
+
+            /* Delete the client handle. */
+            hgcmObjDeleteHandle(u32ClientId);
+
+            /* The service must be released. */
+            ReleaseService();
+
+            break;
+        }
+    }
 
     LogFlowFunc(("rc = %Rrc\n", rc));
@@ -2125,5 +2089,5 @@
 
                 /* Call the service instance to disconnect the client. */
-                rc = pService->DisconnectClient(pMsg->u32ClientId, false, pClient);
+                rc = pService->DisconnectClient(pMsg->u32ClientId, false);
 
                 hgcmObjDereference(pClient);
