Index: /trunk/src/VBox/Devices/Network/DrvNAT.cpp
===================================================================
--- /trunk/src/VBox/Devices/Network/DrvNAT.cpp	(revision 30420)
+++ /trunk/src/VBox/Devices/Network/DrvNAT.cpp	(revision 30421)
@@ -284,6 +284,5 @@
     AssertRC(rc);
 
-    slirp_ext_m_free(pThis->pNATState, m);
-    RTMemFree(pu8Buf);
+    slirp_ext_m_free(pThis->pNATState, m, pu8Buf);
     if (ASMAtomicDecU32(&pThis->cUrgPkts) == 0)
     {
@@ -329,6 +328,5 @@
 
 done_unlocked:
-    slirp_ext_m_free(pThis->pNATState, m);
-    RTMemFree(pu8Buf);
+    slirp_ext_m_free(pThis->pNATState, m, pu8Buf);
     ASMAtomicDecU32(&pThis->cPkts);
 
@@ -352,5 +350,5 @@
     {
         Assert(!pSgBuf->pvUser);
-        slirp_ext_m_free(pThis->pNATState, (struct mbuf *)pSgBuf->pvAllocator);
+        slirp_ext_m_free(pThis->pNATState, (struct mbuf *)pSgBuf->pvAllocator, NULL);
         pSgBuf->pvAllocator = NULL;
     }
Index: /trunk/src/VBox/Devices/Network/slirp/libslirp.h
===================================================================
--- /trunk/src/VBox/Devices/Network/slirp/libslirp.h	(revision 30420)
+++ /trunk/src/VBox/Devices/Network/slirp/libslirp.h	(revision 30421)
@@ -127,5 +127,5 @@
 
 struct mbuf *slirp_ext_m_get(PNATState pData, size_t cbMin, void **ppvBuf, size_t *pcbBuf);
-void slirp_ext_m_free(PNATState pData, struct mbuf *);
+void slirp_ext_m_free(PNATState pData, struct mbuf *, uint8_t *pu8Buf);
 
 /*
Index: /trunk/src/VBox/Devices/Network/slirp/misc.c
===================================================================
--- /trunk/src/VBox/Devices/Network/slirp/misc.c	(revision 30420)
+++ /trunk/src/VBox/Devices/Network/slirp/misc.c	(revision 30421)
@@ -418,6 +418,10 @@
 }
 
-void slirp_ext_m_free(PNATState pData, struct mbuf *m)
-{
+void slirp_ext_m_free(PNATState pData, struct mbuf *m, uint8_t *pu8Buf)
+{
+    
+    if (   !pu8Buf 
+        && pu8Buf != mtod(m, uint8_t *))
+        RTMemFree(pu8Buf); /* This buffer was allocated on heap */
     m_freem(pData, m);
 }
Index: /trunk/src/VBox/Devices/Network/slirp/slirp.c
===================================================================
--- /trunk/src/VBox/Devices/Network/slirp/slirp.c	(revision 30420)
+++ /trunk/src/VBox/Devices/Network/slirp/slirp.c	(revision 30421)
@@ -1538,4 +1538,5 @@
     struct ethhdr *eh;
     uint8_t *buf = NULL;
+    uint8_t *mbuf = NULL;
     size_t mlen = 0;
     STAM_PROFILE_START(&pData->StatIF_encap, a);
@@ -1545,4 +1546,5 @@
     m->m_len += ETH_HLEN;
     eh = mtod(m, struct ethhdr *);
+    mlen = m_length(m, NULL);
 
     if (memcmp(eh->h_source, special_ethaddr, ETH_ALEN) != 0)
@@ -1558,18 +1560,23 @@
         }
     }
-    mlen = m_length(m, NULL);
-    buf = RTMemAlloc(mlen);
-    if (!buf)
-    {
-        LogRel(("NAT: Can't alloc memory for outgoing buffer\n"));
-        m_freem(pData, m);
-        goto done;
-    }
+    if (m->m_next)
+    {
+        buf = RTMemAlloc(mlen);
+        if (!buf)
+        {
+            LogRel(("NAT: Can't alloc memory for outgoing buffer\n"));
+            m_freem(pData, m);
+            goto done;
+        }
+        mbuf = buf;
+        m_copydata(m, 0, mlen, (char *)buf);
+    }
+    else
+        mbuf = mtod(m, uint8_t *);
     eh->h_proto = RT_H2N_U16(eth_proto);
-    m_copydata(m, 0, mlen, (char *)buf);
     if (flags & ETH_ENCAP_URG)
-        slirp_urg_output(pData->pvUser, m, buf, mlen);
+        slirp_urg_output(pData->pvUser, m, mbuf, mlen);
     else
-        slirp_output(pData->pvUser, m, buf, mlen);
+        slirp_output(pData->pvUser, m, mbuf, mlen);
 done:
     STAM_PROFILE_STOP(&pData->StatIF_encap, a);