Index: /trunk/src/VBox/Additions/common/VBoxGuest/VBoxGuest-solaris.c
===================================================================
--- /trunk/src/VBox/Additions/common/VBoxGuest/VBoxGuest-solaris.c	(revision 26628)
+++ /trunk/src/VBox/Additions/common/VBoxGuest/VBoxGuest-solaris.c	(revision 26629)
@@ -169,6 +169,4 @@
 /** Size of the MMIO region. */
 static off_t                g_cbMMIO;
-/** VMMDev Version. */
-static uint32_t             g_u32Version;
 /** Pointer to the interrupt handle vector */
 static ddi_intr_handle_t   *g_pIntr;
@@ -612,6 +610,5 @@
         return EINVAL;
     }
-    if (RT_UNLIKELY(   ReqWrap.cbData == 0
-                    || ReqWrap.cbData > _1M*16))
+    if (RT_UNLIKELY(ReqWrap.cbData > _1M*16))
     {
         LogRel((DEVICE_NAME "::IOCtl: bad size %#x; pArg=%p Cmd=%#x.\n", ReqWrap.cbData, pArg, Cmd));
@@ -620,26 +617,29 @@
 
     /*
-     * Read the request.
+     * Read the request payload if any; requests like VBOXGUEST_IOCTL_CANCEL_ALL_WAITEVENTS have no data payload.
      */
-    void *pvBuf = RTMemTmpAlloc(ReqWrap.cbData);
-    if (RT_UNLIKELY(!pvBuf))
-    {
-        LogRel((DEVICE_NAME "::IOCtl: RTMemTmpAlloc failed to alloc %d bytes.\n", ReqWrap.cbData));
-        return ENOMEM;
-    }
-
-    rc = ddi_copyin((void *)(uintptr_t)ReqWrap.pvDataR3, pvBuf, ReqWrap.cbData, Mode);
-    if (RT_UNLIKELY(rc))
-    {
-        RTMemTmpFree(pvBuf);
-        LogRel((DEVICE_NAME "::IOCtl: ddi_copyin failed; pvBuf=%p pArg=%p Cmd=%d. rc=%d\n", pvBuf, pArg, Cmd, rc));
-        return EFAULT;
-    }
-    if (RT_UNLIKELY(   ReqWrap.cbData != 0
-                    && !VALID_PTR(pvBuf)))
-    {
-        RTMemTmpFree(pvBuf);
-        LogRel((DEVICE_NAME "::IOCtl: pvBuf invalid pointer %p\n", pvBuf));
-        return EINVAL;
+    void *pvBuf = NULL;
+    if (RT_LIKELY(ReqWrap.cbData > 0))
+    {
+        pvBuf = RTMemTmpAlloc(ReqWrap.cbData);
+        if (RT_UNLIKELY(!pvBuf))
+        {
+            LogRel((DEVICE_NAME "::IOCtl: RTMemTmpAlloc failed to alloc %d bytes.\n", ReqWrap.cbData));
+            return ENOMEM;
+        }
+
+        rc = ddi_copyin((void *)(uintptr_t)ReqWrap.pvDataR3, pvBuf, ReqWrap.cbData, Mode);
+        if (RT_UNLIKELY(rc))
+        {
+            RTMemTmpFree(pvBuf);
+            LogRel((DEVICE_NAME "::IOCtl: ddi_copyin failed; pvBuf=%p pArg=%p Cmd=%d. rc=%d\n", pvBuf, pArg, Cmd, rc));
+            return EFAULT;
+        }
+        if (RT_UNLIKELY(!VALID_PTR(pvBuf)))
+        {
+            RTMemTmpFree(pvBuf);
+            LogRel((DEVICE_NAME "::IOCtl: pvBuf invalid pointer %p\n", pvBuf));
+            return EINVAL;
+        }
     }
     Log((DEVICE_NAME "::IOCtl: pSession=%p pid=%d.\n", pSession, (int)RTProcSelf()));
@@ -648,5 +648,5 @@
      * Process the IOCtl.
      */
-    size_t cbDataReturned;
+    size_t cbDataReturned = 0;
     rc = VBoxGuestCommonIOCtl(Cmd, &g_DevExt, pSession, pvBuf, ReqWrap.cbData, &cbDataReturned);
     if (RT_SUCCESS(rc))
@@ -678,5 +678,6 @@
     }
     *pVal = rc;
-    RTMemTmpFree(pvBuf);
+    if (pvBuf)
+        RTMemTmpFree(pvBuf);
     return rc;
 }