Index: /trunk/src/VBox/Devices/VMMDev/VMMDevHGCM.cpp
===================================================================
--- /trunk/src/VBox/Devices/VMMDev/VMMDevHGCM.cpp	(revision 40717)
+++ /trunk/src/VBox/Devices/VMMDev/VMMDevHGCM.cpp	(revision 40718)
@@ -81,4 +81,10 @@
     bool fCancelled;
 
+    /* Whether the command is in the active commands list. */
+    bool fInList;
+
+    /* Whether the command was saved. */
+    bool fSaved;
+
     /* GC physical address of the guest request. */
     RTGCPHYS        GCPhys;
@@ -137,4 +143,6 @@
 
         pVMMDevState->pHGCMCmdList = pCmd;
+
+        pCmd->fInList = true;
 
         if (enmCmdType != VBOXHGCMCMDTYPE_LOADSTATE)
@@ -174,4 +182,11 @@
         LogFlowFunc(("%p\n", pCmd));
 
+        if (!pCmd->fInList)
+        {
+            LogFlowFunc(("%p not in the list\n", pCmd));
+            vmmdevHGCMCmdListUnlock (pVMMDevState);
+            return VINF_SUCCESS;
+        }
+
         if (pCmd->pNext)
         {
@@ -191,4 +206,8 @@
             pVMMDevState->pHGCMCmdList = pCmd->pNext;
         }
+
+        pCmd->pNext = NULL;
+        pCmd->pPrev = NULL;
+        pCmd->fInList = false;
 
         vmmdevHGCMCmdListUnlock (pVMMDevState);
@@ -1774,7 +1793,7 @@
     vmmdevHGCMRemoveCommand (pVMMDevState, pCmd);
 
-    if (pCmd->fCancelled)
-    {
-        LogFlowFunc(("A cancelled command %p\n", pCmd));
+    if (pCmd->fCancelled || pCmd->fSaved)
+    {
+        LogFlowFunc(("A cancelled command %p: %d %d\n", pCmd, pCmd->fCancelled, pCmd->fSaved));
     }
     else
@@ -2308,4 +2327,8 @@
             AssertRCReturn(rc, rc);
 
+            /* Mark the command as saved to make sure that it will not be
+             * completed later by a still running host service.
+             */
+            pIter->fSaved = true;
             vmmdevHGCMRemoveCommand (pVMMDevState, pIter);