Index: /trunk/src/VBox/Devices/Network/slirp/ip_output.c
===================================================================
--- /trunk/src/VBox/Devices/Network/slirp/ip_output.c	(revision 30351)
+++ /trunk/src/VBox/Devices/Network/slirp/ip_output.c	(revision 30352)
@@ -206,5 +206,5 @@
         int mhlen, firstlen = len;
         struct mbuf **mnext = &m->m_nextpkt;
-        char *buf; /* intermediate buffer we'll use for copy from orriginal packet */
+        char *buf; /* intermediate buffer we'll use for a copy of the original packet */
         {
             struct m_tag *t;
@@ -218,5 +218,5 @@
             if (m->m_next != NULL)
             {
-                /*we've receives packet in fragments*/
+                /* we've receives packet in fragments */
                 tmplen = m_length(m, NULL);
                 tmpbuf = RTMemAlloc(tmplen);
@@ -228,5 +228,4 @@
                 tmpbuf = mtod(m, char *);
                 tmplen = m_length(m, NULL);
-
             }
 
Index: /trunk/src/VBox/Devices/Network/slirp/udp.c
===================================================================
--- /trunk/src/VBox/Devices/Network/slirp/udp.c	(revision 30351)
+++ /trunk/src/VBox/Devices/Network/slirp/udp.c	(revision 30352)
@@ -161,9 +161,9 @@
 
 #endif
-            if(cksum(m, len + iphlen))
+            if (cksum(m, len + iphlen))
             {
                 udpstat.udps_badsum++;
                 Log3(("NAT: IP(id: %hd) has bad (udp) cksum\n", ip->ip_id));
-                goto bad;
+                goto bad_free_mbuf;
             }
         }
@@ -178,5 +178,5 @@
     {
         bootp_input(pData, m);
-        goto done;
+        goto done_free_mbuf;
     }
 
@@ -191,10 +191,8 @@
         dst.sin_port = uh->uh_sport;
 
-        /* udp_output2 expects pointer on the body of UDP packet. */
-
+        /* udp_output2() expects a pointer to the body of UDP packet. */
         m->m_data += sizeof(struct udpiphdr);
         m->m_len -= sizeof(struct udpiphdr);
         udp_output2(pData, NULL, m, &src, &dst, IPTOS_LOWDELAY);
-        /* we shouldn't free this mbuf*/
         return;
     }
@@ -206,5 +204,5 @@
     {
         tftp_input(pData, m);
-        goto done;
+        goto done_free_mbuf;
     }
 
@@ -245,5 +243,5 @@
         {
             Log2(("NAT: IP(id: %hd) failed to create socket\n", ip->ip_id));
-            goto bad;
+            goto bad_free_mbuf;
         }
         if (udp_attach(pData, so, 0) == -1)
@@ -252,5 +250,5 @@
                         ip->ip_id, errno, strerror(errno)));
             sofree(pData, so);
-            goto bad;
+            goto bad_free_mbuf;
         }
 
@@ -281,5 +279,5 @@
     {
         dnsproxy_query(pData, so, m, iphlen);
-        goto done;
+        goto done_free_mbuf;
     }
 
@@ -314,11 +312,11 @@
     *ip = save_ip;
     so->so_m = m;         /* ICMP backup */
-
     return;
 
-bad:
+bad_free_mbuf:
     Log2(("NAT: UDP(id: %hd) datagram to %R[IP4] with size(%d) claimed as bad\n",
         ip->ip_id, &ip->ip_dst, ip->ip_len));
-done:
+
+done_free_mbuf:
     /* some services like bootp(built-in), dns(buildt-in) and dhcp don't need sockets
      * and create new m'buffers to send them to guest, so we'll free their incomming
@@ -329,4 +327,8 @@
 }
 
+/**
+ * Output a UDP packet. This function will finally free the mbuf so
+ * do NOT free any passed mbuf.
+ */
 int udp_output2(PNATState pData, struct socket *so, struct mbuf *m,
                 struct sockaddr_in *saddr, struct sockaddr_in *daddr,