Index: /trunk/src/VBox/Devices/Network/slirp/tcp_subr.c
===================================================================
--- /trunk/src/VBox/Devices/Network/slirp/tcp_subr.c	(revision 15918)
+++ /trunk/src/VBox/Devices/Network/slirp/tcp_subr.c	(revision 15919)
@@ -264,10 +264,11 @@
     register struct mbuf *m;
 
-    struct tseg_qent *te;
+    struct tseg_qent *te = NULL;
     DEBUG_CALL("tcp_close");
     DEBUG_ARG("tp = %lx", (long )tp);
     /*XXX: freeing the reassembly queue */
-    LIST_FOREACH(te, &tp->t_segq, tqe_q)
-    {
+    while (!LIST_EMPTY(&tp->t_segq))
+    {
+        te = LIST_FIRST(&tp->t_segq);
         LIST_REMOVE(te, tqe_q);
         m_freem(pData, te->tqe_m);