Index: /trunk/src/VBox/Devices/Network/slirp/bootp.c
===================================================================
--- /trunk/src/VBox/Devices/Network/slirp/bootp.c	(revision 30362)
+++ /trunk/src/VBox/Devices/Network/slirp/bootp.c	(revision 30363)
@@ -200,5 +200,5 @@
 
     eh = mtod(m, struct ethhdr *);
-    memcpy(eh->h_source, bp->bp_hwaddr, ETH_ALEN); /* XXX: if_encap just swap source with dest*/
+    memcpy(eh->h_source, bp->bp_hwaddr, ETH_ALEN); /* XXX: if_encap just swap source with dest */
 
     m->m_data += if_maxlinkhdr; /*reserve ether header */
@@ -650,5 +650,5 @@
     p = dhcp_find_option(bp->bp_vend, RFC2132_MSG_TYPE);
     Assert(p);
-    if (p == NULL)
+    if (!p)
         return;
     /*
@@ -657,6 +657,6 @@
      */
     if (   !pData->fUseHostResolver
-           && (   pData->dnsLastUpdate == 0
-               || curtime - pData->dnsLastUpdate > 60 * 1000)) /* one minute*/
+        && (   pData->dnsLastUpdate == 0
+            || curtime - pData->dnsLastUpdate > 60 * 1000)) /* one minute*/
     {
         uint8_t i = 2; /* i = 0 - tag, i == 1 - length */
@@ -674,5 +674,6 @@
     }
 
-    if ((m = m_getcl(pData, M_DONTWAIT, MT_HEADER, M_PKTHDR)) == NULL)
+    m = m_getcl(pData, M_DONTWAIT, MT_HEADER, M_PKTHDR);
+    if (!m)
     {
         LogRel(("NAT: can't alocate memory for response!\n"));
@@ -684,5 +685,5 @@
         case DHCPDISCOVER:
             fDhcpDiscover = 1;
-            /**/
+            /* fall through */
         case DHCPINFORM:
             rc = dhcp_decode_discover(pData, bp, buf, size, fDhcpDiscover, m);
@@ -722,6 +723,5 @@
             AssertMsgFailed(("unsupported DHCP message type"));
     }
-    Assert(m);
-    /*silently ignore*/
+    /* silently ignore */
     m_freem(pData, m);
     return;
@@ -729,5 +729,4 @@
 reply:
     bootp_reply(pData, m, rc, bp->bp_flags);
-    return;
 }
 
Index: /trunk/src/VBox/Devices/Network/slirp/ip_icmp.c
===================================================================
--- /trunk/src/VBox/Devices/Network/slirp/ip_icmp.c	(revision 30362)
+++ /trunk/src/VBox/Devices/Network/slirp/ip_icmp.c	(revision 30363)
@@ -510,5 +510,5 @@
 
 
-/*
+/**
  * Send an ICMP message in response to a situation
  *
@@ -526,4 +526,6 @@
  * ICMP fragmentation is illegal.  All machines must accept 576 bytes in one
  * packet.  The maximum payload is 576-20(ip hdr)-8(icmp hdr)=548
+ *
+ * @note This function will free msrc!
  */
 
@@ -544,5 +546,7 @@
         M_ASSERTPKTHDR(msrc);
 
-    if (type!=ICMP_UNREACH && type!=ICMP_TIMXCEED && type != ICMP_SOURCEQUENCH)
+    if (   type != ICMP_UNREACH
+        && type != ICMP_TIMXCEED
+        && type != ICMP_SOURCEQUENCH)
         goto end_error;
 
@@ -560,5 +564,6 @@
     }
 #endif
-    if (ip->ip_off & IP_OFFMASK && type != ICMP_SOURCEQUENCH)
+    if (   ip->ip_off & IP_OFFMASK
+        && type != ICMP_SOURCEQUENCH)
         goto end_error;    /* Only reply to fragment 0 */
 
@@ -598,7 +603,6 @@
     }
     m = m_getjcl(pData, M_NOWAIT, MT_HEADER, M_PKTHDR, size);
-
-    if (m == NULL)
-        goto end_error;                    /* get mbuf */
+    if (!m)
+        goto end_error;
 
     m->m_data += if_maxlinkhdr;
@@ -674,6 +678,7 @@
 end_error_free_m:
     m_freem(pData, m);
+
 end_error:
-    LogRel(("NAT: error occurred while sending ICMP error message \n"));
+    LogRel(("NAT: error occurred while sending ICMP error message\n"));
 }
 #undef ICMP_MAXDATALEN
Index: /trunk/src/VBox/Devices/Network/slirp/ip_output.c
===================================================================
--- /trunk/src/VBox/Devices/Network/slirp/ip_output.c	(revision 30362)
+++ /trunk/src/VBox/Devices/Network/slirp/ip_output.c	(revision 30363)
@@ -105,4 +105,5 @@
 }
 
+/* This function will free m0! */
 int
 ip_output0(PNATState pData, struct socket *so, struct mbuf *m0, int urg)
@@ -218,5 +219,5 @@
             if (m->m_next != NULL)
             {
-                /* we've receives packet in fragments */
+                /* we've received a packet in fragments */
                 tmplen = m_length(m, NULL);
                 tmpbuf = RTMemAlloc(tmplen);
@@ -269,5 +270,5 @@
                 error = -1;
                 ipstat.ips_odropped++;
-                goto sendorfree;
+                goto send_or_free;
             }
             m->m_data += if_maxlinkhdr;
@@ -320,5 +321,5 @@
         ip->ip_sum = cksum(m, hlen);
 
-sendorfree:
+send_or_free:
         for (m = m0; m; m = m0)
         {
@@ -335,7 +336,5 @@
             }
             else
-            {
                 m_freem(pData, m);
-            }
         }
 
Index: /trunk/src/VBox/Devices/Network/slirp/slirp.c
===================================================================
--- /trunk/src/VBox/Devices/Network/slirp/slirp.c	(revision 30362)
+++ /trunk/src/VBox/Devices/Network/slirp/slirp.c	(revision 30363)
@@ -1380,4 +1380,7 @@
 AssertCompileSize(struct arphdr, 28);
 
+/**
+ * @note This function will free m! 
+ */
 static void arp_input(PNATState pData, struct mbuf *m)
 {
@@ -1526,5 +1529,9 @@
 }
 
-/* output the IP packet to the ethernet device */
+/**
+ * Output the IP packet to the ethernet device.
+ *
+ * @note This function will free m!
+ */
 void if_encap(PNATState pData, uint16_t eth_proto, struct mbuf *m, int flags)
 {
@@ -1553,5 +1560,5 @@
     mlen = m_length(m, NULL);
     buf = RTMemAlloc(mlen);
-    if (buf == NULL)
+    if (!buf)
     {
         LogRel(("NAT: Can't alloc memory for outgoing buffer\n"));
Index: /trunk/src/VBox/Devices/Network/slirp/socket.c
===================================================================
--- /trunk/src/VBox/Devices/Network/slirp/socket.c	(revision 30362)
+++ /trunk/src/VBox/Devices/Network/slirp/socket.c	(revision 30363)
@@ -766,9 +766,10 @@
         if (m == NULL)
             return;
+
         m->m_data += ETH_HLEN;
         m->m_pkthdr.header = mtod(m, void *);
         m->m_data += sizeof(struct udpiphdr);
         ret = recvfrom(so->s, mtod(m, char *), n, 0,
-                            (struct sockaddr *)&addr, &addrlen);
+                       (struct sockaddr *)&addr, &addrlen);
         /* @todo (vvl) check which flags and type should be passed */
         m->m_len = ret;
Index: /trunk/src/VBox/Devices/Network/slirp/tftp.c
===================================================================
--- /trunk/src/VBox/Devices/Network/slirp/tftp.c	(revision 30362)
+++ /trunk/src/VBox/Devices/Network/slirp/tftp.c	(revision 30363)
@@ -181,5 +181,5 @@
     int nobytes;
 
-    if ((m = m_getcl(pData, M_DONTWAIT, MT_HEADER, M_PKTHDR)) == NULL)
+    m = m_getcl(pData, M_DONTWAIT, MT_HEADER, M_PKTHDR);
     if (!m)
         return -1;
@@ -229,5 +229,5 @@
         return -1;
 
-    if ((m = m_getcl(pData, M_DONTWAIT, MT_HEADER, M_PKTHDR)) == NULL)
+    m = m_getcl(pData, M_DONTWAIT, MT_HEADER, M_PKTHDR);
     if (!m)
         return -1;
Index: /trunk/src/VBox/Devices/Network/slirp/udp.c
===================================================================
--- /trunk/src/VBox/Devices/Network/slirp/udp.c	(revision 30362)
+++ /trunk/src/VBox/Devices/Network/slirp/udp.c	(revision 30363)
@@ -298,5 +298,5 @@
         *ip = save_ip;
         DEBUG_MISC((dfd,"NAT: UDP tx errno = %d-%s (on sent to %R[IP4])\n", errno,
-                strerror(errno), &ip->ip_dst));
+                   strerror(errno), &ip->ip_dst));
         icmp_error(pData, m, ICMP_UNREACH, ICMP_UNREACH_NET, 0, strerror(errno));
         /* in case we receive ICMP on this socket we'll aware that ICMP has been already sent to host*/
@@ -328,6 +328,7 @@
 
 /**
- * Output a UDP packet. This function will finally free the mbuf so
- * do NOT free any passed mbuf.
+ * Output a UDP packet.
+ *
+ * @note This function will finally free m!
  */
 int udp_output2(PNATState pData, struct socket *so, struct mbuf *m,
@@ -336,5 +337,5 @@
 {
     register struct udpiphdr *ui;
-    int error = 0;
+    int error;
 
     DEBUG_CALL("udp_output");
@@ -385,4 +386,7 @@
 }
 
+/**
+ * @note This function will free m!
+ */
 int udp_output(PNATState pData, struct socket *so, struct mbuf *m,
                struct sockaddr_in *addr)