Index: /trunk/src/VBox/Devices/Network/SrvIntNetR0.cpp
===================================================================
--- /trunk/src/VBox/Devices/Network/SrvIntNetR0.cpp	(revision 30003)
+++ /trunk/src/VBox/Devices/Network/SrvIntNetR0.cpp	(revision 30004)
@@ -3106,5 +3106,20 @@
 {
     /*
-     * Trunk first so we don't wast any more time before hitting the wire.
+     * Do the interfaces first before sending it to the wire and risk having to
+     * modify it.
+     */
+    uint32_t iIf = pDstTab->cIfs;
+    while (iIf-- > 0)
+    {
+        PINTNETIF pIf = pDstTab->aIfs[iIf].pIf;
+        intnetR0IfSend(pIf, pIfSender, pSG,
+                       pDstTab->aIfs[iIf].fReplaceDstMac ? &pIf->MacAddr: NULL);
+        intnetR0BusyDecIf(pIf);
+        pDstTab->aIfs[iIf].pIf = NULL;
+    }
+    pDstTab->cIfs = 0;
+
+    /*
+     * Send to the trunk.
      *
      * Note! The switching functions will include the trunk even when the frame
@@ -3125,18 +3140,4 @@
         pDstTab->fTrunkDst = 0;
     }
-
-    /*
-     * Do the interfaces.
-     */
-    uint32_t iIf = pDstTab->cIfs;
-    while (iIf-- > 0)
-    {
-        PINTNETIF pIf = pDstTab->aIfs[iIf].pIf;
-        intnetR0IfSend(pIf, pIfSender, pSG,
-                       pDstTab->aIfs[iIf].fReplaceDstMac ? &pIf->MacAddr: NULL);
-        intnetR0BusyDecIf(pIf);
-        pDstTab->aIfs[iIf].pIf = NULL;
-    }
-    pDstTab->cIfs = 0;
 }
 
@@ -3945,6 +3946,6 @@
 
     /*
-     * Set fDestroying if requested to do so and then wake up all the sleeping        
-     * threads (usually just one).   We leave the semaphore in the signalled 
+     * Set fDestroying if requested to do so and then wake up all the sleeping
+     * threads (usually just one).   We leave the semaphore in the signalled
      * state so the next caller will return immediately.
      */