Index: /trunk/src/VBox/Devices/Makefile.kmk
===================================================================
--- /trunk/src/VBox/Devices/Makefile.kmk	(revision 30044)
+++ /trunk/src/VBox/Devices/Makefile.kmk	(revision 30045)
@@ -854,10 +854,10 @@
 	Network/DrvNAT.cpp \
 	Network/slirp/bootp.c \
-	Network/slirp/debug.c \
+ 	Network/slirp/debug.c \
 	Network/slirp/ip_icmp.c \
 	Network/slirp/ip_input.c \
 	Network/slirp/ip_output.c \
 	Network/slirp/misc.c \
-	Network/slirp/sbuf.c \
+    Network/slirp/sbuf.c \
 	Network/slirp/slirp.c \
 	Network/slirp/socket.c \
@@ -871,4 +871,8 @@
 	Network/slirp/dnsproxy/dnsproxy.c
 
+ifdef VBOX_WITH_SLIRP_BSD_SBUF
+VBOX_SLIRP_SOURCES += Network/slirp/bsd/kern/subr_sbuf.c
+endif
+
 VBOX_SLIRP_BSD_ARCH = $(subst x86,i386,$(KBUILD_TARGET_ARCH))
 VBOX_SLIRP_BSD_SOURCES += \
@@ -893,4 +897,5 @@
 define def_vbox_slirp_cflags
   $(file)_DEFS += \
+      $(if $(VBOX_WITH_SLIRP_BSD_SBUF),VBOX_WITH_SLIRP_BSD_SBUF,) \
       $(if $(VBOX_WITH_SLIRP_MEMORY_CHECK),RTMEM_WRAP_TO_EF_APIS,) \
       $(if $(VBOX_WITH_DEBUG_NAT_SOCKETS),VBOX_WITH_DEBUG_NAT_SOCKETS,)	\
Index: /trunk/src/VBox/Devices/Network/slirp/bsd/kern/subr_sbuf.c
===================================================================
--- /trunk/src/VBox/Devices/Network/slirp/bsd/kern/subr_sbuf.c	(revision 30044)
+++ /trunk/src/VBox/Devices/Network/slirp/bsd/kern/subr_sbuf.c	(revision 30045)
@@ -27,4 +27,5 @@
  */
 
+#ifndef VBOX
 #include <sys/cdefs.h>
 __FBSDID("$FreeBSD: src/sys/kern/subr_sbuf.c,v 1.30.8.1 2009/04/15 03:14:26 kensmith Exp $");
@@ -59,4 +60,11 @@
 #define	min(x,y)		MIN(x,y)
 #endif /* _KERNEL */
+#else /* VBOX */
+# include <iprt/param.h>
+# include <iprt/ctype.h>
+# include <slirp.h>
+# define SBMALLOC(size) RTMemAlloc((size))
+# define SBFREE(buf) RTMemFree((buf))
+#endif
 
 /*
@@ -417,6 +425,11 @@
 	do {
 		va_copy(ap_copy, ap);
+#ifndef VBOX
 		len = vsnprintf(&s->s_buf[s->s_len], SBUF_FREESPACE(s) + 1,
 		    fmt, ap_copy);
+#else
+		len = RTStrPrintfV(&s->s_buf[s->s_len], SBUF_FREESPACE(s) + 1,
+		    fmt, ap_copy);
+#endif
 		va_end(ap_copy);
 	} while (len > SBUF_FREESPACE(s) &&
@@ -492,6 +505,11 @@
 		return (-1);
 
+#ifndef VBOX
 	while (s->s_len && isspace(s->s_buf[s->s_len-1]))
 		--s->s_len;
+#else
+	while (s->s_len && RT_C_IS_SPACE(s->s_buf[s->s_len-1]))
+		--s->s_len;
+#endif
 
 	return (0);
Index: /trunk/src/VBox/Devices/Network/slirp/bsd/sys/sbuf.h
===================================================================
--- /trunk/src/VBox/Devices/Network/slirp/bsd/sys/sbuf.h	(revision 30044)
+++ /trunk/src/VBox/Devices/Network/slirp/bsd/sys/sbuf.h	(revision 30045)
@@ -32,5 +32,9 @@
 #define	_SYS_SBUF_H_
 
+#ifndef VBOX
 #include <sys/_types.h>
+#else
+# include <iprt/types.h>
+#endif
 
 /*
@@ -65,6 +69,11 @@
 int		 sbuf_cat(struct sbuf *, const char *);
 int		 sbuf_cpy(struct sbuf *, const char *);
+#ifndef VBOX
 int		 sbuf_printf(struct sbuf *, const char *, ...) __printflike(2, 3);
 int		 sbuf_vprintf(struct sbuf *, const char *, __va_list) __printflike(2, 0);
+#else
+int		 sbuf_printf(struct sbuf *, const char *, ...);
+int		 sbuf_vprintf(struct sbuf *, const char *, va_list);
+#endif
 int		 sbuf_putc(struct sbuf *, int);
 int		 sbuf_trim(struct sbuf *);
Index: /trunk/src/VBox/Devices/Network/slirp/debug.c
===================================================================
--- /trunk/src/VBox/Devices/Network/slirp/debug.c	(revision 30044)
+++ /trunk/src/VBox/Devices/Network/slirp/debug.c	(revision 30045)
@@ -207,5 +207,5 @@
         lprint("%15s %5d %5d %5d\n",
                 inet_ntoa(so->so_faddr), RT_N2H_U16(so->so_fport),
-                so->so_rcv.sb_cc, so->so_snd.sb_cc);
+                SBUF_LEN(&so->so_rcv), SBUF_LEN(&so->so_snd));
     LOOP_LABEL(tcp, so, so_next);
     }
@@ -221,5 +221,5 @@
         lprint("%15s %5d %5d %5d\n",
                 inet_ntoa(so->so_faddr), RT_N2H_U16(so->so_fport),
-                so->so_rcv.sb_cc, so->so_snd.sb_cc);
+                SBUF_LEN(&so->so_rcv), SBUF_LEN(&so->so_snd));
     LOOP_LABEL(udp, so, so_next);
     }
Index: /trunk/src/VBox/Devices/Network/slirp/sbuf.c
===================================================================
--- /trunk/src/VBox/Devices/Network/slirp/sbuf.c	(revision 30044)
+++ /trunk/src/VBox/Devices/Network/slirp/sbuf.c	(revision 30045)
@@ -26,4 +26,5 @@
 
 #include <slirp.h>
+#ifndef VBOX_WITH_SLIRP_BSD_SBUF
 
 /* Done as a macro in socket.h */
@@ -269,3 +270,86 @@
     }
 }
-
+#else /* VBOX_WITH_SLIRP_BSD_SBUF */
+void 
+sbappend (PNATState pData, struct socket *so, struct mbuf *m)
+{
+    int ret = 0;
+    int mlen = 0;
+    caddr_t buf = NULL;
+
+    STAM_PROFILE_START(&pData->StatIOSBAppend_pf, a);
+    DEBUG_CALL("sbappend");
+    DEBUG_ARG("so = %lx", (long)so);
+    DEBUG_ARG("m = %lx", (long)m);
+    DEBUG_ARG("m->m_len = %d", m ? m->m_len : 0);
+
+    STAM_COUNTER_INC(&pData->StatIOSBAppend);
+    mlen = m_length(m, NULL);
+    if (mlen <= 0)
+    {
+        STAM_COUNTER_INC(&pData->StatIOSBAppend_zm);
+        goto done;
+    }
+
+    /*
+     * We only write if there's nothing in the buffer,
+     * ottherwise it'll arrive out of order, and hence corrupt
+     */
+    buf = RTMemAlloc(mlen);
+    if (buf == NULL)
+    {
+        ret = 0;
+        goto no_sent;
+    }
+    m_copydata(m, 0, mlen, buf);
+
+    /*
+     * If there is urgent data, call sosendoob
+     * if not all was sent, sowrite will take care of the rest
+     * (The rest of this function is just an optimisation)
+     */
+    if (so->so_urgc)
+    {
+        sbuf_bcpy(&so->so_rcv, buf, mlen);
+        RTMemFree(buf);
+        m_free(pData, m);
+        sosendoob(so);
+        return;
+    }
+
+    if(!sbuf_len(&so->so_rcv))
+        ret = send(so->s, buf, mlen, 0);
+no_sent:
+
+    if (ret <= 0)
+    {
+        STAM_COUNTER_INC(&pData->StatIOSBAppend_wf);
+        /*
+         * Nothing was written
+         * It's possible that the socket has closed, but
+         * we don't need to check because if it has closed,
+         * it will be detected in the normal way by soread()
+         */
+        sbuf_bcpy(&so->so_rcv, buf, mlen);
+        STAM_PROFILE_STOP(&pData->StatIOSBAppend_pf_wf, a);
+        goto done;
+    }
+    else if (ret != mlen)
+    {
+        STAM_COUNTER_INC(&pData->StatIOSBAppend_wp);
+        /*
+         * Something was written, but not everything..
+         * sbappendsb the rest
+         */
+        sbuf_bcpy(&so->so_rcv, &buf[ret + 1], mlen - ret);
+        STAM_PROFILE_STOP(&pData->StatIOSBAppend_pf_wp, a);
+        goto done;
+    } /* else */
+    /* Whatever happened, we free the mbuf */
+    STAM_COUNTER_INC(&pData->StatIOSBAppend_wa);
+    STAM_PROFILE_STOP(&pData->StatIOSBAppend_pf_wa, a);
+done:
+    RTMemFree(buf);
+    m_free(pData, m);
+}
+#endif
Index: /trunk/src/VBox/Devices/Network/slirp/sbuf.h
===================================================================
--- /trunk/src/VBox/Devices/Network/slirp/sbuf.h	(revision 30044)
+++ /trunk/src/VBox/Devices/Network/slirp/sbuf.h	(revision 30045)
@@ -28,6 +28,10 @@
 #define _SBUF_H_
 
-#define sbflush(sb) sbdrop((sb),(sb)->sb_cc)
-#define sbspace(sb) ((sb)->sb_datalen - (sb)->sb_cc)
+#ifndef VBOX_WITH_SLIRP_BSD_SBUF
+# define sbflush(sb) sbdrop((sb),(sb)->sb_cc)
+# define sbspace(sb) ((sb)->sb_datalen - (sb)->sb_cc)
+# define SBUF_LEN(sb) ((sb)->sb_cc)
+# define SBUF_SIZE(sb) ((sb)->sb_datalen)
+
 
 struct sbuf
@@ -48,3 +52,12 @@
 void sbappendsb (PNATState, struct sbuf *, struct mbuf *);
 void sbcopy (struct sbuf *, int, int, char *);
+#else
+void sbappend (PNATState, struct socket *, struct mbuf *);
+# include "bsd/sys/sbuf.h"
+# define SBUF_LEN(sb) (sbuf_len(sb))
+/* XXX: @todo SBUF_SIZE is a hack both space and SIZE shouldn't be used out of subr_sbuf.c*/
+# define SBUF_SIZE(sb) ((sb)->s_size)
+/* see subr_sbuf.c to verify the formula */
+# define sbspace(sb) (SBUF_SIZE(sb) - SBUF_LEN((sb)) - 1)
 #endif
+#endif
Index: /trunk/src/VBox/Devices/Network/slirp/slirp.c
===================================================================
--- /trunk/src/VBox/Devices/Network/slirp/slirp.c	(revision 30044)
+++ /trunk/src/VBox/Devices/Network/slirp/slirp.c	(revision 30045)
@@ -791,4 +791,5 @@
     WSACleanup();
 #endif
+#ifndef VBOX_WITH_SLIRP_BSD_SBUF
 #ifdef LOG_ENABLED
     Log(("\n"
@@ -806,4 +807,5 @@
          "\n"));
 #endif
+#endif
     RTMemFree(pData);
 }
@@ -938,5 +940,5 @@
          * we have something to send
          */
-        if (CONN_CANFSEND(so) && so->so_rcv.sb_cc)
+        if (CONN_CANFSEND(so) && SBUF_LEN(&so->so_rcv))
         {
             STAM_COUNTER_INC(&pData->StatTCPHot);
@@ -948,5 +950,6 @@
          * receive more, and we have room for it XXX /2 ?
          */
-        if (CONN_CANFRCV(so) && (so->so_snd.sb_cc < (so->so_snd.sb_datalen/2)))
+        /* @todo: vvl - check which predicat here will be more useful here in rerm of new sbufs. */
+        if (CONN_CANFRCV(so) && (SBUF_LEN(&so->so_snd) < (SBUF_SIZE(&so->so_snd)/2)))
         {
             STAM_COUNTER_INC(&pData->StatTCPHot);
Index: /trunk/src/VBox/Devices/Network/slirp/socket.c
===================================================================
--- /trunk/src/VBox/Devices/Network/slirp/socket.c	(revision 30044)
+++ /trunk/src/VBox/Devices/Network/slirp/socket.c	(revision 30045)
@@ -134,4 +134,5 @@
  * a read() of 0 (or less) means it's disconnected
  */
+#ifndef VBOX_WITH_SLIRP_BSD_SBUF
 int
 soread(PNATState pData, struct socket *so)
@@ -311,4 +312,84 @@
     return nn;
 }
+#else /* VBOX_WITH_SLIRP_BSD_SBUF */
+int
+soread(PNATState pData, struct socket *so)
+{
+    int n;
+    char *buf;
+    struct sbuf *sb = &so->so_snd;
+    size_t len = sbspace(sb);
+    int mss = so->so_tcpcb->t_maxseg;
+
+    STAM_PROFILE_START(&pData->StatIOread, a);
+    STAM_COUNTER_RESET(&pData->StatIORead_in_1);
+    STAM_COUNTER_RESET(&pData->StatIORead_in_2);
+
+    QSOCKET_LOCK(tcb);
+    SOCKET_LOCK(so);
+    QSOCKET_UNLOCK(tcb);
+
+    DEBUG_CALL("soread");
+    DEBUG_ARG("so = %lx", (long)so);
+
+    if (len > mss)
+        len -= len % mss; 
+    buf = RTMemAlloc(len);
+    if (buf == NULL)
+    {
+        LogRel(("NAT: can't alloc enough memory\n"));
+        return -1;
+    }
+    
+    n = recv(so->s, buf, len, (so->so_tcpcb->t_force? MSG_OOB:0));
+    if (n <= 0)
+    {
+        /*
+         * Special case for WSAEnumNetworkEvents: If we receive 0 bytes that
+         * _could_ mean that the connection is closed. But we will receive an
+         * FD_CLOSE event later if the connection was _really_ closed. With
+         * www.youtube.com I see this very often. Closing the socket too early
+         * would be dangerous.
+         */
+        int status;
+        unsigned long pending = 0;
+        status = ioctlsocket(so->s, FIONREAD, &pending);
+        if (status < 0)
+            LogRel(("NAT:error in WSAIoctl: %d\n", errno));
+        if (n == 0 && (pending != 0))
+        {
+            SOCKET_UNLOCK(so);
+            STAM_PROFILE_STOP(&pData->StatIOread, a);
+            RTMemFree(buf);
+            return 0;
+        }
+        if (   n < 0
+            && (   errno == EINTR
+                || errno == EAGAIN
+                || errno == EWOULDBLOCK))
+        {
+            SOCKET_UNLOCK(so);
+            STAM_PROFILE_STOP(&pData->StatIOread, a);
+            RTMemFree(buf);
+            return 0;
+        }
+        else
+        {
+            DEBUG_MISC((dfd, " --- soread() disconnected, n = %d, errno = %d-%s\n",
+                        n, errno, strerror(errno)));
+            sofcantrcvmore(so);
+            tcp_sockclosed(pData, sototcpcb(so));
+            SOCKET_UNLOCK(so);
+            STAM_PROFILE_STOP(&pData->StatIOread, a);
+            RTMemFree(buf);
+            return -1;
+        }
+    }
+
+    sbuf_bcat(sb, buf, n);
+    RTMemFree(buf);
+    return n;
+}
+#endif
 
 /*
@@ -337,10 +418,10 @@
      */
     ret = soread(pData, so);
-    tp->snd_up = tp->snd_una + so->so_snd.sb_cc;
+    tp->snd_up = tp->snd_una + SBUF_LEN(&so->so_snd);
     tp->t_force = 1;
     tcp_output(pData, tp);
     tp->t_force = 0;
 }
-
+#ifndef VBOX_WITH_SLIRP_BSD_SBUF
 /*
  * Send urgent data
@@ -357,5 +438,4 @@
     DEBUG_CALL("sosendoob");
     DEBUG_ARG("so = %lx", (long)so);
-    DEBUG_ARG("sb->sb_cc = %d", sb->sb_cc);
 
     if (so->so_urgc > sizeof(buff))
@@ -558,4 +638,59 @@
     return nn;
 }
+#else /* VBOX_WITH_SLIRP_BSD_SBUF */
+static int
+do_sosend(struct socket *so, int fUrg)
+{
+    struct sbuf *sb = &so->so_rcv;
+
+    int n, len;
+
+    DEBUG_CALL("sosendoob");
+    DEBUG_ARG("so = %lx", (long)so);
+
+    len = sbuf_len(sb);
+    
+    n = send(so->s, sbuf_data(sb), len, (fUrg ? MSG_OOB : 0));
+    if (n < 0)
+    {
+        LogRel(("NAT: Can't sent sbuf via socket.\n"));
+    }
+    if (fUrg)
+        so->so_urgc -= n;
+    if (n > 0 && n < len)
+    {
+        char *ptr;
+        char *buff;
+        buff = RTMemAlloc(len);
+        if (buff == NULL)
+        {
+            LogRel(("NAT: No space to allocate temporal buffer\n"));
+            return -1;
+        }
+        ptr = sbuf_data(sb);
+        memcpy(buff, &ptr[n], len - n);
+        sbuf_bcpy(sb, buff, len - n);
+        RTMemFree(buff);
+        return n;
+    }
+    sbuf_clear(sb);
+    return n;
+}
+int
+sosendoob(struct socket *so)
+{
+    return do_sosend(so, 1);
+}
+
+/*
+ * Write data from so_rcv to so's socket,
+ * updating all sbuf field as necessary
+ */
+int
+sowrite(PNATState pData, struct socket *so)
+{
+    return do_sosend(so, 1);
+}
+#endif
 
 /*
@@ -993,5 +1128,5 @@
 sofwdrain(struct socket *so)
 {
-    if (so->so_rcv.sb_cc)
+    if (SBUF_LEN(&so->so_rcv))
         so->so_state |= SS_FWDRAIN;
     else
Index: /trunk/src/VBox/Devices/Network/slirp/tcp_input.c
===================================================================
--- /trunk/src/VBox/Devices/Network/slirp/tcp_input.c	(revision 30044)
+++ /trunk/src/VBox/Devices/Network/slirp/tcp_input.c	(revision 30045)
@@ -511,6 +511,11 @@
         }
         SOCKET_LOCK(so);
+#ifndef VBOX_WITH_SLIRP_BSD_SBUF
         sbreserve(pData, &so->so_snd, tcp_sndspace);
         sbreserve(pData, &so->so_rcv, tcp_rcvspace);
+#else
+        sbuf_new(&so->so_snd, NULL, tcp_sndspace, SBUF_AUTOEXTEND);
+        sbuf_new(&so->so_rcv, NULL, tcp_rcvspace, SBUF_AUTOEXTEND);
+#endif
 
 /*      tcp_last_so = so; */  /* XXX ? */
@@ -633,5 +638,13 @@
               tcpstat.tcps_rcvackpack++;
               tcpstat.tcps_rcvackbyte += acked;
+#ifndef VBOX_WITH_SLIRP_BSD_SBUF
               sbdrop(&so->so_snd, acked);
+#else
+              if (sbuf_len(&so->so_snd) < acked)
+                /* drop all what sbuf have */
+                sbuf_setpos(&so->so_snd, 0);
+              else
+                sbuf_setpos(&so->so_snd, sbuf_len(&so->so_snd) - acked);
+#endif
               tp->snd_una = ti->ti_ack;
               m_freem(pData, m);
@@ -664,5 +677,5 @@
                * we don't need this.. XXX???
                */
-              if (so->so_snd.sb_cc)
+              if (SBUF_LEN(&so->so_snd))
                   (void) tcp_output(pData, tp);
 
@@ -1324,13 +1337,21 @@
                 tp->snd_cwnd = min(cw + incr, TCP_MAXWIN<<tp->snd_scale);
             }
-            if (acked > so->so_snd.sb_cc)
-            {
-                tp->snd_wnd -= so->so_snd.sb_cc;
+            if (acked > SBUF_LEN(&so->so_snd))
+            {
+                tp->snd_wnd -= SBUF_LEN(&so->so_snd);
+#ifndef VBOX_WITH_SLIRP_BSD_SBUF
                 sbdrop(&so->so_snd, (int )so->so_snd.sb_cc);
+#else
+                sbuf_clear(&so->so_snd);
+#endif
                 ourfinisacked = 1;
             }
             else
             {
+#ifndef VBOX_WITH_SLIRP_BSD_SBUF
                 sbdrop(&so->so_snd, acked);
+#else
+                sbuf_setpos(&so->so_snd, sbuf_len(&so->so_snd) - acked);
+#endif
                 tp->snd_wnd -= acked;
                 ourfinisacked = 0;
@@ -1446,4 +1467,6 @@
             TCPS_HAVERCVDFIN(tp->t_state) == 0)
     {
+    /* BSD's sbufs are auto extent so we shouldn't worry here */
+#ifndef VBOX_WITH_SLIRP_BSD_SBUF
         /*
          * This is a kludge, but if we receive and accept
@@ -1458,4 +1481,5 @@
             goto dodata;
         }
+#endif
         /*
          * If this segment advances the known urgent pointer,
@@ -1475,5 +1499,5 @@
         {
             tp->rcv_up = ti->ti_seq + ti->ti_urp;
-            so->so_urgc =  so->so_rcv.sb_cc +
+            so->so_urgc =  SBUF_LEN(&so->so_rcv) +
                 (tp->rcv_up - tp->rcv_nxt); /* -1; */
             tp->rcv_up = ti->ti_seq + ti->ti_urp;
@@ -1539,5 +1563,5 @@
          * buffer size.
          */
-        len = so->so_rcv.sb_datalen - (tp->rcv_adv - tp->rcv_nxt);
+        len = SBUF_SIZE(&so->so_rcv) - (tp->rcv_adv - tp->rcv_nxt);
     }
     else
@@ -1891,6 +1915,11 @@
     tp->snd_cwnd = mss;
 
+#ifndef VBOX_WITH_SLIRP_BSD_SBUF
     sbreserve(pData, &so->so_snd, tcp_sndspace+((tcp_sndspace%mss)?(mss-(tcp_sndspace%mss)):0));
     sbreserve(pData, &so->so_rcv, tcp_rcvspace+((tcp_rcvspace%mss)?(mss-(tcp_rcvspace%mss)):0));
+#else
+    sbuf_new(&so->so_snd, NULL, tcp_sndspace+((tcp_sndspace%mss)?(mss-(tcp_sndspace%mss)):0), SBUF_AUTOEXTEND);
+    sbuf_new(&so->so_rcv, NULL, tcp_rcvspace+((tcp_rcvspace%mss)?(mss-(tcp_rcvspace%mss)):0), SBUF_AUTOEXTEND);
+#endif
 
     DEBUG_MISC((dfd, " returning mss = %d\n", mss));
Index: /trunk/src/VBox/Devices/Network/slirp/tcp_output.c
===================================================================
--- /trunk/src/VBox/Devices/Network/slirp/tcp_output.c	(revision 30044)
+++ /trunk/src/VBox/Devices/Network/slirp/tcp_output.c	(revision 30045)
@@ -155,5 +155,5 @@
              * itself.
              */
-            if (off < so->so_snd.sb_cc)
+            if (off < SBUF_LEN(&so->so_snd))
                 flags &= ~TH_FIN;
             win = 1;
@@ -166,5 +166,5 @@
     }
 
-    len = min(so->so_snd.sb_cc, win) - off;
+    len = min(SBUF_LEN(&so->so_snd), win) - off;
     if (len < 0)
     {
@@ -191,5 +191,5 @@
         sendalot = 1;
     }
-    if (SEQ_LT(tp->snd_nxt + len, tp->snd_una + so->so_snd.sb_cc))
+    if (SEQ_LT(tp->snd_nxt + len, tp->snd_una + SBUF_LEN(&so->so_snd)))
         flags &= ~TH_FIN;
 
@@ -211,5 +211,5 @@
             goto send;
         if ((1 || idle || tp->t_flags & TF_NODELAY) &&
-                len + off >= so->so_snd.sb_cc)
+                len + off >= SBUF_LEN(&so->so_snd))
             goto send;
         if (tp->t_force)
@@ -241,5 +241,5 @@
         if (adv >= (long) (2 * tp->t_maxseg))
             goto send;
-        if (2 * adv >= (long) so->so_rcv.sb_datalen)
+        if (2 * adv >= (long) SBUF_SIZE(&so->so_rcv))
             goto send;
     }
@@ -285,5 +285,5 @@
      * otherwise force out a byte.
      */
-    if (   so->so_snd.sb_cc
+    if (   SBUF_LEN(&so->so_snd)
         && tp->t_timer[TCPT_REXMT] == 0
         && tp->t_timer[TCPT_PERSIST] == 0)
@@ -421,6 +421,10 @@
         {
 #endif
+#ifndef VBOX_WITH_SLIRP_BSD_SBUF
             sbcopy(&so->so_snd, off, (int) len, mtod(m, caddr_t) + hdrlen);
             m->m_len += len;
+#else
+            m_copyback(pData, m, hdrlen, len, sbuf_data(&so->so_snd) + off);
+#endif
 #if 0
         }
@@ -438,5 +442,5 @@
          * a PUSH comes in.)
          */
-        if (off + len == so->so_snd.sb_cc)
+        if (off + len == SBUF_LEN(&so->so_snd))
             flags |= TH_PUSH;
     }
@@ -525,5 +529,5 @@
      * but avoid silly window syndrome.
      */
-    if (win < (long)(so->so_rcv.sb_datalen / 4) && win < (long)tp->t_maxseg)
+    if (win < (long)(SBUF_SIZE(&so->so_rcv) / 4) && win < (long)tp->t_maxseg)
         win = 0;
     if (win > (long)TCP_MAXWIN << tp->rcv_scale)
Index: /trunk/src/VBox/Devices/Network/slirp/tcp_subr.c
===================================================================
--- /trunk/src/VBox/Devices/Network/slirp/tcp_subr.c	(revision 30044)
+++ /trunk/src/VBox/Devices/Network/slirp/tcp_subr.c	(revision 30045)
@@ -306,6 +306,11 @@
     if (!(so->so_state & SS_FACCEPTCONN))
     {
+#ifndef VBOX_WITH_SLIRP_BSD_SBUF
         sbfree(&so->so_rcv);
         sbfree(&so->so_snd);
+#else
+        sbuf_delete(&so->so_rcv);
+        sbuf_delete(&so->so_snd);
+#endif
     }
     sofree(pData, so);