Index: /trunk/src/VBox/Devices/Network/SrvIntNetR0.cpp
===================================================================
--- /trunk/src/VBox/Devices/Network/SrvIntNetR0.cpp	(revision 37908)
+++ /trunk/src/VBox/Devices/Network/SrvIntNetR0.cpp	(revision 37909)
@@ -283,4 +283,6 @@
     /** Pointer to the trunk's per interface data.  Can be NULL. */
     void                   *pvIfData;
+    /** Header buffer for when we're carving GSO frames. */
+    uint8_t                 abGsoHdrs[256];
 } INTNETIF;
 /** Pointer to an internal network interface. */
@@ -319,6 +321,4 @@
      * number. */
     uint32_t                fHostGsoCapabilites;
-    /** Header buffer for when we're carving GSO frames. */
-    uint8_t                 abGsoHdrs[256];
     /** The destination table spinlock, interrupt safe.
      * Protects apTaskDstTabs and apIntDstTabs. */
@@ -2665,9 +2665,9 @@
         uint32_t cbSegPayload;
         uint32_t offSegPayload = PDMNetGsoCarveSegment(&pSG->GsoCtx, (uint8_t *)pSG->aSegs[0].pv, pSG->cbTotal, iSeg, cSegs,
-                                                       pThis->abGsoHdrs, &cbSegPayload);
+                                                       pIfSender->abGsoHdrs, &cbSegPayload);
 
         IntNetSgInitTempSegs(&u.SG, pSG->GsoCtx.cbHdrs + cbSegPayload, 2, 2);
         u.SG.aSegs[0].Phys = NIL_RTHCPHYS;
-        u.SG.aSegs[0].pv   = pThis->abGsoHdrs;
+        u.SG.aSegs[0].pv   = pIfSender->abGsoHdrs;
         u.SG.aSegs[0].cb   = pSG->GsoCtx.cbHdrs;
         u.SG.aSegs[1].Phys = NIL_RTHCPHYS;