Index: /trunk/src/VBox/Main/src-server/MachineImpl.cpp
===================================================================
--- /trunk/src/VBox/Main/src-server/MachineImpl.cpp	(revision 39562)
+++ /trunk/src/VBox/Main/src-server/MachineImpl.cpp	(revision 39563)
@@ -9034,13 +9034,21 @@
 
         /* Network adapters (required) */
+        uint32_t uMaxNICs = RT_MIN(getMaxNetworkAdapters(mHWData->mChipsetType), mNetworkAdapters.size());
         data.llNetworkAdapters.clear();
-        for (ULONG slot = 0; slot < mNetworkAdapters.size(); ++slot)
+        /* Write out only the nominal number of network adapters for this
+         * chipset type. Since Machine::commit() hasn't been called there
+         * may be extra NIC settings in the vector. */
+        for (ULONG slot = 0; slot < uMaxNICs; ++slot)
         {
             settings::NetworkAdapter nic;
             nic.ulSlot = slot;
-            rc = mNetworkAdapters[slot]->saveSettings(nic);
-            if (FAILED(rc)) throw rc;
-
-            data.llNetworkAdapters.push_back(nic);
+            /* paranoia check... must not be NULL, but must not crash either. */
+            if (mNetworkAdapters[slot])
+            {
+                rc = mNetworkAdapters[slot]->saveSettings(nic);
+                if (FAILED(rc)) throw rc;
+
+                data.llNetworkAdapters.push_back(nic);
+            }
         }
 
@@ -10422,4 +10430,6 @@
     mBandwidthControl->commit();
 
+    /* Keep the original network adapter count until this point, so that
+     * discarding a chipset type change will not lose settings. */
     mNetworkAdapters.resize(Global::getMaxNetworkAdapters(mHWData->mChipsetType));
     for (ULONG slot = 0; slot < mNetworkAdapters.size(); slot++)