Index: /trunk/src/VBox/Devices/Network/slirp/ip_icmpwin.c
===================================================================
--- /trunk/src/VBox/Devices/Network/slirp/ip_icmpwin.c	(revision 53379)
+++ /trunk/src/VBox/Devices/Network/slirp/ip_icmpwin.c	(revision 53380)
@@ -115,5 +115,5 @@
 {
     struct ip *ip = mtod(m, struct ip *);
-    int icmplen = ip->ip_len - hlen;
+    size_t reqsize;
     uint8_t ttl;
     size_t bufsize;
@@ -122,5 +122,4 @@
     IP_OPTION_INFORMATION opts;
     void *reqdata;
-    size_t reqsize;
     int status;
 
@@ -129,5 +128,14 @@
     --ttl;
 
-    bufsize = sizeof(ICMP_ECHO_REPLY) + icmplen;
+    reqsize = ip->ip_len - hlen - sizeof(struct icmp_echo);
+
+    bufsize = sizeof(ICMP_ECHO_REPLY);
+    if (reqsize < sizeof(IO_STATUS_BLOCK) + sizeof(struct icmp_echo))
+        bufsize += sizeof(IO_STATUS_BLOCK) + sizeof(struct icmp_echo);
+    else
+        bufsize += reqsize;
+    bufsize += 16; /* whatever that is; empirically at least XP needs it */
+    LogRel(("NAT: ping size=%d bufsize=%d\n", (int)reqsize, (int)bufsize));
+
     pong = RTMemAlloc(RT_OFFSETOF(struct pong, buf) + bufsize);
     if (RT_UNLIKELY(pong == NULL))
@@ -140,5 +148,4 @@
     AssertReturnVoid(pong->reqicmph.icmp_type == ICMP_ECHO);
 
-    reqsize = icmplen - sizeof(struct icmp_echo); /* just the payload */
     if (m->m_next == NULL)
     {