Index: /trunk/src/VBox/Devices/Graphics/DevVGA_VBVA.cpp
===================================================================
--- /trunk/src/VBox/Devices/Graphics/DevVGA_VBVA.cpp	(revision 58538)
+++ /trunk/src/VBox/Devices/Graphics/DevVGA_VBVA.cpp	(revision 58539)
@@ -315,7 +315,5 @@
             *ppHdr = (VBVACMDHDR *)pu8Src;
 
-            /* Advance data offset and sync with guest. */
-            pVBVAData->off32Data = (pVBVAData->off32Data + cbRecord) % pVBVAData->cbData;
-            pVBVAData->guest.pVBVA->off32Data = pVBVAData->off32Data;
+            /* The data offset will be updated in vbvaReleaseCmd. */
         }
         else
@@ -353,15 +351,17 @@
 {
     VBVAPARTIALRECORD *pPartialRecord = &pVBVAData->partialRecord;
-    uint8_t *au8RingBuffer = pVBVAData->guest.pu8Data;
-
-    if (   (uint8_t *)pHdr >= au8RingBuffer
-        && (uint8_t *)pHdr < &au8RingBuffer[pVBVAData->cbData])
+    const uint8_t *au8RingBuffer = pVBVAData->guest.pu8Data;
+
+    if (   (uintptr_t)pHdr >= (uintptr_t)au8RingBuffer
+        && (uintptr_t)pHdr < (uintptr_t)&au8RingBuffer[pVBVAData->cbData])
     {
         /* The pointer is inside ring buffer. Must be continuous chunk. */
-        Assert(pVBVAData->cbData - ((uint8_t *)pHdr - au8RingBuffer) >= cbCmd);
-
-        /* Do nothing. */
-
-        Assert (!pPartialRecord->pu8 && pPartialRecord->cb == 0);
+        Assert(pVBVAData->cbData - (uint32_t)((uint8_t *)pHdr - au8RingBuffer) >= cbCmd);
+
+        /* Advance data offset and sync with guest. */
+        pVBVAData->off32Data = (pVBVAData->off32Data + cbCmd) % pVBVAData->cbData;
+        pVBVAData->guest.pVBVA->off32Data = pVBVAData->off32Data;
+
+        Assert(!pPartialRecord->pu8 && pPartialRecord->cb == 0);
     }
     else