Index: /trunk/src/VBox/NetworkServices/NAT/pxping_win.c
===================================================================
--- /trunk/src/VBox/NetworkServices/NAT/pxping_win.c	(revision 53366)
+++ /trunk/src/VBox/NetworkServices/NAT/pxping_win.c	(revision 53367)
@@ -192,5 +192,11 @@
     }
 
-    bufsize = sizeof(ICMP_ECHO_REPLY) + p->tot_len;
+    bufsize = sizeof(ICMP_ECHO_REPLY);
+    if (p->tot_len < sizeof(IO_STATUS_BLOCK) + sizeof(struct icmp_echo_hdr))
+        bufsize += sizeof(IO_STATUS_BLOCK) + sizeof(struct icmp_echo_hdr);
+    else
+        bufsize += p->tot_len;
+    bufsize += 16; /* whatever that is; empirically at least XP needs it */
+
     pong = (struct pong4 *)malloc(RT_OFFSETOF(struct pong4, buf) + bufsize);
     if (RT_UNLIKELY(pong == NULL)) {