Index: /trunk/src/VBox/Devices/Network/slirp/ip_icmp.c
===================================================================
--- /trunk/src/VBox/Devices/Network/slirp/ip_icmp.c	(revision 35922)
+++ /trunk/src/VBox/Devices/Network/slirp/ip_icmp.c	(revision 35923)
@@ -537,5 +537,5 @@
  * packet.  The maximum payload is 576-20(ip hdr)-8(icmp hdr)=548
  *
- * @note This function will NOT free msrc!
+ * @note This function will free msrc!
  */
 
@@ -591,23 +591,13 @@
     new_m_size = sizeof(struct ip) + ICMP_MINLEN + msrc->m_len + ICMP_MAXDATALEN;
     if (new_m_size < MSIZE)
-    {
         size = MCLBYTES;
-    }
     else if (new_m_size < MCLBYTES)
-    {
         size = MCLBYTES;
-    }
     else if(new_m_size < MJUM9BYTES)
-    {
         size = MJUM9BYTES;
-    }
     else if (new_m_size < MJUM16BYTES)
-    {
         size = MJUM16BYTES;
-    }
     else
-    {
         AssertMsgFailed(("Unsupported size"));
-    }
     m = m_getjcl(pData, M_NOWAIT, MT_HEADER, M_PKTHDR, size);
     if (!m)
@@ -645,4 +635,5 @@
 
     memcpy(&icp->icmp_ip, msrc->m_data, s_ip_len);   /* report the ip packet */
+    m_freem(pData, msrc);
 
     HTONS(icp->icmp_ip.ip_len);
Index: /trunk/src/VBox/Devices/Network/slirp/ip_input.c
===================================================================
--- /trunk/src/VBox/Devices/Network/slirp/ip_input.c	(revision 35922)
+++ /trunk/src/VBox/Devices/Network/slirp/ip_input.c	(revision 35923)
@@ -131,6 +131,5 @@
     {
         ipstat.ips_toosmall++;
-        STAM_PROFILE_STOP(&pData->StatIP_input, a);
-        return;
+        goto bad_free_m;
     }
 
@@ -194,5 +193,5 @@
     {
         icmp_error(pData, m, ICMP_TIMXCEED, ICMP_TIMXCEED_INTRANS, 0, "ttl");
-        goto bad_free_m;
+        goto no_free_m;
     }
 
@@ -210,8 +209,5 @@
         m = ip_reass(pData, m);
         if (m == NULL)
-        {
-             STAM_PROFILE_STOP(&pData->StatIP_input, a);
-             return;
-        }
+            goto no_free_m;
         ip = mtod(m, struct ip *);
         hlen = ip->ip_hl << 2;
@@ -239,6 +235,5 @@
             m_freem(pData, m);
     }
-    STAM_PROFILE_STOP(&pData->StatIP_input, a);
-    return;
+    goto no_free_m;
 
 bad_free_m:
@@ -246,4 +241,5 @@
         &ip->ip_dst, ip->ip_len));
     m_freem(pData, m);
+no_free_m:
     STAM_PROFILE_STOP(&pData->StatIP_input, a);
     return;
Index: /trunk/src/VBox/Devices/Network/slirp/socket.c
===================================================================
--- /trunk/src/VBox/Devices/Network/slirp/socket.c	(revision 35922)
+++ /trunk/src/VBox/Devices/Network/slirp/socket.c	(revision 35923)
@@ -815,5 +815,4 @@
             Log2((" rx error, tx icmp ICMP_UNREACH:%i\n", code));
             icmp_error(pData, so->so_m, ICMP_UNREACH, code, 0, strerror(errno));
-            m_freem(pData, so->so_m);
             so->so_m = NULL;
         }
@@ -1368,5 +1367,4 @@
                 code = (code != ~0 ? code : ICMP_UNREACH_PORT);
                 icmp_error(pData, so->so_m, ICMP_UNREACH, code, 0, "Error occurred!!!");
-                m_freem(pData, so->so_m);
                 so->so_m = NULL;
                 break;
@@ -1487,5 +1485,4 @@
         LogRel((" udp icmp rx errno = %d (%s)\n", errno, strerror(errno)));
         icmp_error(pData, so->so_m, ICMP_UNREACH, code, 0, strerror(errno));
-        m_freem(pData, so->so_m);
         so->so_m = NULL;
         Log(("sorecvfrom_icmp_unix: 1 - step can't read IP datagramm\n"));
Index: /trunk/src/VBox/Devices/Network/slirp/tcp_input.c
===================================================================
--- /trunk/src/VBox/Devices/Network/slirp/tcp_input.c	(revision 35922)
+++ /trunk/src/VBox/Devices/Network/slirp/tcp_input.c	(revision 35923)
@@ -790,5 +790,4 @@
                     *ip = save_ip;
                     icmp_error(pData, m, ICMP_UNREACH, code, 0, strerror(errno));
-                    m_freem(pData, m);
                     tp->t_socket->so_m = NULL;
                 }