Index: /trunk/src/VBox/Devices/Audio/DevCodec.cpp
===================================================================
--- /trunk/src/VBox/Devices/Audio/DevCodec.cpp	(revision 31027)
+++ /trunk/src/VBox/Devices/Audio/DevCodec.cpp	(revision 31028)
@@ -90,5 +90,5 @@
         CODEC_CAD(cmd), CODEC_DIRECT(cmd) ? 'N' : 'Y', CODEC_NID(cmd), CODEC_VERBDATA(cmd)));
     if (CODEC_CAD(cmd) != 0)
-        *pResp = ((uint64_t)CODEC_CAD(cmd) << 4)| 0xFFFFFFFF;
+        *pResp = ((uint64_t)CODEC_CAD(cmd) << 4)| 0x0;
     else
         *pResp = 0;
@@ -225,7 +225,6 @@
         case 1:
             pNode->afg.node.name = "AFG";
-            //** @todo r=michaln: Are the comments right? Looks like copy & paste.
-            pNode->node.au32F00_param[4] = RT_MAKE_U32_FROM_U8(0x1a, 0x00, 0x02, 0x00); /* node info (start node: 1, start id = 1) */
-            pNode->node.au32F00_param[5] = RT_MAKE_U32_FROM_U8(0x1, 0x01, 0x00, 0x0); /* node info (start node: 1, start id = 1) */
+            pNode->node.au32F00_param[4] = RT_MAKE_U32_FROM_U8(0x1a, 0x00, 0x02, 0x00); 
+            pNode->node.au32F00_param[5] = RT_MAKE_U32_FROM_U8(0x1, 0x01, 0x00, 0x0); 
             pNode->node.au32F00_param[8] = RT_MAKE_U32_FROM_U8(0x0d, 0x0d, 0x01, 0x0); /* Capabilities */
             //pNode->node.au32F00_param[0xa] = RT_BIT(19)|RT_BIT(18)|RT_BIT(17)|RT_BIT(10)|RT_BIT(9)|RT_BIT(8)|RT_BIT(7)|RT_BIT(6)|RT_BIT(5);
@@ -391,6 +390,4 @@
             pNode->node.name = "VolumeKnob";
             pNode->node.au32F00_param[0x9] = (0x6 << 20);
-            //** @todo r=michaln: The next assignment is out of array bounds (0x13 items in array);
-            //  the array needs to be bigger.
             pNode->node.au32F00_param[0x13] = RT_BIT(7)| 0x7F;
             pNode->node.au32F00_param[0xe] = 0x4;
@@ -582,5 +579,4 @@
     pState->cVerbs = STAC9220_VERB_SIZE;
     pState->pfnLookup = codecLookup;
-    //** @todo r=michaln: Where is this memory freed?
     pState->pNodes = (PCODECNODE)RTMemAllocZ(sizeof(CODECNODE) * STAC9220_NODE_COUNT);
     uint8_t i;
@@ -610,3 +606,7 @@
     return VINF_SUCCESS;
 }
-int stac9220Destruct(CODECState *pCodecState);
+int stac9220Destruct(CODECState *pCodecState)
+{
+    RTMemFree(pCodecState->pNodes);
+    return VINF_SUCCESS;
+}
Index: /trunk/src/VBox/Devices/Audio/DevCodec.h
===================================================================
--- /trunk/src/VBox/Devices/Audio/DevCodec.h	(revision 31027)
+++ /trunk/src/VBox/Devices/Audio/DevCodec.h	(revision 31028)
@@ -32,5 +32,5 @@
 } CODECVERB;
 
-#define CODECNODE_F0_PARAM_LENGTH 0x13
+#define CODECNODE_F0_PARAM_LENGTH 0x14
 typedef struct CODECCOMMONNODE
 {
Index: /trunk/src/VBox/Devices/Audio/DevIchIntelHDA.cpp
===================================================================
--- /trunk/src/VBox/Devices/Audio/DevIchIntelHDA.cpp	(revision 31027)
+++ /trunk/src/VBox/Devices/Audio/DevIchIntelHDA.cpp	(revision 31028)
@@ -80,5 +80,5 @@
 #define ICH6_HDA_REG_STATES 7 /* range 0x0E */
 #define STATES(pState) (HDA_REG((pState), STATES))
-#define ICH6_HDA_STATES_SCSF 0x5
+#define ICH6_HDA_STATES_SCSF 0x1
 
 #define ICH6_HDA_REG_GSTS 8 /* range 0x10-0x11*/
@@ -585,6 +585,4 @@
     if (INTCTL_GIE(pState))
     {
-        //** @todo r=michaln: This *must* be PCISetIrq instead 
-        
         Log(("hda: irq %s\n", fIrq ? "asserted" : "deasserted"));
         PDMDevHlpPCISetIrq(ICH6_HDASTATE_2_DEVINS(pState), 0 , fIrq);
@@ -1345,5 +1343,4 @@
     pThis->hda.cbCorbBuf = CORBSIZE(&pThis->hda) * sizeof(uint32_t);
 
-    //** @todo r=michaln: Where are the Corb/RirbBuf allocations freed?
     if (pThis->hda.pu32CorbBuf)
         memset(pThis->hda.pu32CorbBuf, 0, pThis->hda.cbCorbBuf);
@@ -1495,4 +1492,20 @@
     pThis->hda.Codec.pfnTransfer = hdaTransfer;
 
+    return VINF_SUCCESS;
+}
+
+/**
+ * @interface_method_impl{PDMDEVREG,pfnDestruct}
+ */
+static DECLCALLBACK(int) hdaDestruct (PPDMDEVINS pDevIns)
+{
+    PCIINTELHDLinkState *pThis = PDMINS_2_DATA(pDevIns, PCIINTELHDLinkState *);
+    
+    int rc = stac9220Destruct(&pThis->hda.Codec);
+    AssertRC(rc);
+    if (pThis->hda.pu32CorbBuf)
+        RTMemFree(pThis->hda.pu32CorbBuf);
+    if (pThis->hda.pu32CorbBuf)
+        RTMemFree(pThis->hda.pu32CorbBuf);
     return VINF_SUCCESS;
 }
@@ -1524,5 +1537,5 @@
     hdaConstruct,
     /* pfnDestruct */
-    NULL,
+    hdaDestruct,
     /* pfnRelocate */
     NULL,