Index: /trunk/src/VBox/Devices/Storage/DevAHCI.cpp
===================================================================
--- /trunk/src/VBox/Devices/Storage/DevAHCI.cpp	(revision 46818)
+++ /trunk/src/VBox/Devices/Storage/DevAHCI.cpp	(revision 46819)
@@ -4080,6 +4080,7 @@
     uint8_t *pbBufDst;
     uint8_t *pbBufSrc  = (uint8_t *)pAhciReq->u.Io.DataSeg.pvSeg;
-
-    pbBuf = (uint8_t *)RTMemAlloc(pAhciReq->cbTransfer);
+    size_t cbAlloc = pAhciReq->cbTransfer + cSectors * (1 + 11 + 3 + 1 + 288); /* Per sector data like ECC. */
+
+    pbBuf = (uint8_t *)RTMemAlloc(cbAlloc);
     if (RT_UNLIKELY(!pbBuf))
         return VERR_NO_MEMORY;
@@ -4107,5 +4108,5 @@
 
     *ppvProc = pbBuf;
-    *pcbProc = pAhciReq->cbTransfer;
+    *pcbProc = cbAlloc;
 
     return VINF_SUCCESS;
@@ -5360,5 +5361,5 @@
             if (RT_SUCCESS(rc))
             {
-                ahciCopyToPrdtl(pDevIns, pAhciReq, pv, cb);
+                pAhciReq->cbTransfer = ahciCopyToPrdtl(pDevIns, pAhciReq, pv, cb);
                 RTMemFree(pv);
             }