Index: /trunk/src/VBox/Devices/Network/DevPCNet.cpp
===================================================================
--- /trunk/src/VBox/Devices/Network/DevPCNet.cpp	(revision 359)
+++ /trunk/src/VBox/Devices/Network/DevPCNet.cpp	(revision 360)
@@ -219,6 +219,6 @@
 
 #ifdef PCNET_NO_POLLING
-    RTGCPHYS                            TRDAPhysOld;
-    uint32_t                            cbTRDAOld;
+    RTGCPHYS                            TDRAPhysOld;
+    uint32_t                            cbTDRAOld;
 
     RTGCPHYS                            RDRAPhysOld;
@@ -984,5 +984,6 @@
     if (VBOX_SUCCESS(rc) && cb)
     {
-        if (GCPhysFault >= pData->GCTDRA && GCPhysFault + cb < pcnetTdraAddr(pData, 0))
+        if (    (GCPhysFault >= pData->GCTDRA && GCPhysFault + cb < pcnetTdraAddr(pData, 0))
+            ||  (GCPhysFault >= pData->GCRDRA && GCPhysFault + cb < pcnetRdraAddr(pData, 0)))
         {
             int rc = PDMCritSectEnter(&pData->CritSect, VERR_SEM_BUSY);
@@ -1194,19 +1195,15 @@
 {
     PPDMDEVINS pDevIns = PCNETSTATE_2_DEVINS(pData);
-
-    Log(("pcnetUpdateRingHandlers TD %VGp size %x -> %VGp size %x\n", pData->TRDAPhysOld, pData->cbTRDAOld, pData->GCTDRA, pcnetTdraAddr(pData, 0)));
+    int rc;
+
+    Log(("pcnetUpdateRingHandlers TD %VGp size %x -> %VGp size %x\n", pData->TDRAPhysOld, pData->cbTDRAOld, pData->GCTDRA, pcnetTdraAddr(pData, 0)));
     Log(("pcnetUpdateRingHandlers RX %VGp size %x -> %VGp size %x\n", pData->RDRAPhysOld, pData->cbRDRAOld, pData->GCRDRA, pcnetRdraAddr(pData, 0)));
 
-#if 0
-    if (pData->RDRAPhysOld != 0 && pData->GCRDRA != pData->RDRAPhysOld)
-        PGMHandlerPhysicalDeregister(PDMDevHlpGetVM(pDevIns),
-                                     pData->RDRAPhysOld & ~PAGE_OFFSET_MASK);
-    if (   pData->TRDAPhysOld != 0 && pData->GCTDRA != pData->TRDAPhysOld
-        && (pData->GCRDRA & ~PAGE_OFFSET_MASK) != (pData->GCTDRA & ~PAGE_OFFSET_MASK))
-#endif
-#if 0
-    if (pData->GCRDRA != oldrdra)
-    {
-        int rc;
+    if (pData->GCRDRA != pData->RDRAPhysOld || CSR_RCVRL(pData) != pData->cbRDRAOld)
+    {
+        if (pData->RDRAPhysOld != 0)
+            PGMHandlerPhysicalDeregister(PDMDevHlpGetVM(pDevIns),
+                                        pData->RDRAPhysOld & ~PAGE_OFFSET_MASK);
+
         rc = PGMR3HandlerPhysicalRegister(PDMDevHlpGetVM(pDevIns),
                                           PGMPHYSHANDLERTYPE_PHYSICAL_WRITE,
@@ -1224,28 +1221,52 @@
         pData->cbRDRAOld   = pcnetRdraAddr(pData, 0);
     }
-#endif
-    if (pData->GCTDRA != pData->TRDAPhysOld || CSR_XMTRL(pData) != pData->cbTRDAOld)
-    {
-        if (pData->TRDAPhysOld != 0)
-            PGMHandlerPhysicalDeregister(PDMDevHlpGetVM(pDevIns),
-                                         pData->TRDAPhysOld & ~PAGE_OFFSET_MASK);
-
-        int rc;
-
-        rc = PGMR3HandlerPhysicalRegister(PDMDevHlpGetVM(pDevIns),
-                                          PGMPHYSHANDLERTYPE_PHYSICAL_WRITE,
-                                          pData->GCTDRA & ~PAGE_OFFSET_MASK,
-                                          RT_ALIGN(pcnetTdraAddr(pData, 0), PAGE_SIZE) - 1,
-                                          pcnetHandleRingWrite, pDevIns,
-                                          g_DevicePCNet.szR0Mod, "pcnetHandleRingWrite",
-                                          pData->pDevInsHC->pvInstanceDataHC,
-                                          g_DevicePCNet.szGCMod, "pcnetHandleRingWrite",
-                                          pData->pDevInsHC->pvInstanceDataGC,
-                                          "PCNet transmit ring write access handler");
-        AssertRC(rc);
-
-        pData->TRDAPhysOld = pData->GCTDRA;
-        pData->cbTRDAOld   = pcnetTdraAddr(pData, 0);
-    }
+
+    /* 3 possibilities:
+     * 1) TDRA on different physical page as RDRA
+     * 2) TDRA completely on same physical page as RDRA
+     * 3) TDRA & RDRA overlap partly with different physical pages
+     */
+    RTGCPHYS RDRAPageStart = pData->GCRDRA & ~PAGE_OFFSET_MASK;
+    RTGCPHYS RDRAPageEnd   = (pcnetRdraAddr(pData, 0) - 1) & ~PAGE_OFFSET_MASK;
+    RTGCPHYS TDRAPageStart = pData->GCTDRA & ~PAGE_OFFSET_MASK;
+    RTGCPHYS TDRAPageEnd   = (pcnetTdraAddr(pData, 0) - 1) & ~PAGE_OFFSET_MASK;
+    
+    if (    RDRAPageStart > TDRAPageEnd
+        ||  TDRAPageStart > RDRAPageEnd)
+    {
+        /* 1) */
+        if (pData->GCTDRA != pData->TDRAPhysOld || CSR_XMTRL(pData) != pData->cbTDRAOld)
+        {
+            if (pData->TDRAPhysOld != 0)
+                PGMHandlerPhysicalDeregister(PDMDevHlpGetVM(pDevIns),
+                                             pData->TDRAPhysOld & ~PAGE_OFFSET_MASK);
+
+            rc = PGMR3HandlerPhysicalRegister(PDMDevHlpGetVM(pDevIns),
+                                              PGMPHYSHANDLERTYPE_PHYSICAL_WRITE,
+                                              pData->GCTDRA & ~PAGE_OFFSET_MASK,
+                                              RT_ALIGN(pcnetTdraAddr(pData, 0), PAGE_SIZE) - 1,
+                                              pcnetHandleRingWrite, pDevIns,
+                                              g_DevicePCNet.szR0Mod, "pcnetHandleRingWrite",
+                                              pData->pDevInsHC->pvInstanceDataHC,
+                                              g_DevicePCNet.szGCMod, "pcnetHandleRingWrite",
+                                              pData->pDevInsHC->pvInstanceDataGC,
+                                              "PCNet transmit ring write access handler");
+            AssertRC(rc);
+
+            pData->TDRAPhysOld = pData->GCTDRA;
+            pData->cbTDRAOld   = pcnetTdraAddr(pData, 0);
+        }
+    }
+    else
+    if (    RDRAPageStart != TDRAPageStart
+        &&  (   TDRAPageStart == RDRAPageEnd
+             || TDRAPageEnd   == RDRAPageStart
+            )
+        )
+    {
+        /* 3) */
+        AssertFailed();
+    }
+    /* else 2) */
 }
 #endif /* PCNET_NO_POLLING */
@@ -2111,5 +2132,5 @@
 #ifdef LOG_ENABLED
     TMD dummy;
-    Log2(("#%d pcnetPollTimer time=%08x TDMD=%d TXON=%d POLL=%d TDTE=%d TRDA=%x\n",
+    Log2(("#%d pcnetPollTimer time=%08x TDMD=%d TXON=%d POLL=%d TDTE=%d TDRA=%x\n",
           PCNETSTATE_2_DEVINS(pData)->iInstance, RTTimeMilliTS(), CSR_TDMD(pData), CSR_TXON(pData),
           !CSR_DPOLL(pData), pcnetTdtePoll(pData, &dummy), pData->GCTDRA));
@@ -3546,4 +3567,8 @@
         pData->pDrv->pfnSetPromiscuousMode(pData->pDrv, CSR_PROM(pData));
 
+#ifdef PCNET_NO_POLLING
+    /* Enable physical monitoring again (!) */
+    pcnetUpdateRingHandlers(pData);
+#endif
     /* Indicate link down to the guest OS that all network connections have been lost. */
     if (pData->fLinkUp)