Index: /trunk/src/VBox/Devices/Network/DrvNAT.cpp
===================================================================
--- /trunk/src/VBox/Devices/Network/DrvNAT.cpp	(revision 24057)
+++ /trunk/src/VBox/Devices/Network/DrvNAT.cpp	(revision 24058)
@@ -287,21 +287,16 @@
     {
         rc = pThis->pPort->pfnReceive(pThis->pPort, pu8Buf, cb);
-        rc = RTCritSectLeave(&pThis->csDevAccess);
         AssertReleaseRC(rc);
-        slirp_ext_m_free(pThis->pNATState, pvArg);
     }
     else if (   RT_FAILURE(rc) 
              && (  rc == VERR_TIMEOUT
-                || rc == VERR_INTERRUPTED))
-    {
-        rc = RTCritSectLeave(&pThis->csDevAccess);
-        slirp_ext_m_free(pThis->pNATState, pvArg);
+                && rc == VERR_INTERRUPTED))
+    {
+        AssertReleaseRC(rc);
     } 
-    else
-    {
-        rc = RTCritSectLeave(&pThis->csDevAccess);
-        slirp_ext_m_free(pThis->pNATState, pvArg);
-        AssertReleaseRC(rc);
-    }
+
+    rc = RTCritSectLeave(&pThis->csDevAccess);
+    AssertReleaseRC(rc);
+
     if (ASMAtomicDecU32(&pThis->cUrgPkt) == 0) 
     {
@@ -309,4 +304,5 @@
         drvNATNotifyNATThread(pThis);
     }
+    slirp_ext_m_free(pThis->pNATState, pvArg);
 }
 
@@ -314,4 +310,5 @@
 static DECLCALLBACK(void) drvNATRecvWorker(PDRVNAT pThis, uint8_t *pu8Buf, int cb, void *pvArg)
 {
+    int rc;
     STAM_PROFILE_START(&pThis->StatNATRecv, a);
 
@@ -319,7 +316,14 @@
 
     while(ASMAtomicReadU32(&pThis->cUrgPkt) != 0)
-        RTSemEventWait(pThis->EventRecv, RT_INDEFINITE_WAIT);
-
-    int rc = RTCritSectEnter(&pThis->csDevAccess);
+    {
+        rc = RTSemEventWait(pThis->EventRecv, RT_INDEFINITE_WAIT);
+        if (   RT_FAILURE(rc) 
+            && ( rc == VERR_TIMEOUT
+                 || rc == VERR_INTERRUPTED))
+            goto done_unlocked; 
+    }
+
+    rc = RTCritSectEnter(&pThis->csDevAccess);
+
     rc = pThis->pPort->pfnWaitReceiveAvail(pThis->pPort, RT_INDEFINITE_WAIT);
     if (RT_SUCCESS(rc))
@@ -327,22 +331,16 @@
         rc = pThis->pPort->pfnReceive(pThis->pPort, pu8Buf, cb);
         AssertReleaseRC(rc);
-        rc = RTCritSectLeave(&pThis->csDevAccess);
-        AssertReleaseRC(rc);
-        slirp_ext_m_free(pThis->pNATState, pvArg);
     } 
     else if (   RT_FAILURE(rc) 
-             && (  rc == VERR_TIMEOUT
-                || rc == VERR_INTERRUPTED))
-    {
-        rc = RTCritSectLeave(&pThis->csDevAccess);
+             && (  rc != VERR_TIMEOUT
+                && rc != VERR_INTERRUPTED))
+    {
         AssertReleaseRC(rc);
-        slirp_ext_m_free(pThis->pNATState, pvArg);
-    }
-    else
-    {
-        rc = RTCritSectLeave(&pThis->csDevAccess);
-        slirp_ext_m_free(pThis->pNATState, pvArg);
-        AssertReleaseRC(rc);
-    }
+    }
+
+    rc = RTCritSectLeave(&pThis->csDevAccess);
+    AssertReleaseRC(rc);
+done_unlocked:
+    slirp_ext_m_free(pThis->pNATState, pvArg);
     ASMAtomicDecU32(&pThis->cPkt);