Index: /trunk/include/VBox/err.h
===================================================================
--- /trunk/include/VBox/err.h	(revision 59304)
+++ /trunk/include/VBox/err.h	(revision 59305)
@@ -1467,5 +1467,5 @@
 #define VERR_PDM_MEDIAEX_IOBUF_OVERFLOW             (-2894)
 /** There is not enough data to satisfy the request. */
-#define VERR_PDM_MEDIAEX_IOBUF_UNDERFLOW            (-2895)
+#define VERR_PDM_MEDIAEX_IOBUF_UNDERRUN             (-2895)
 /** The I/O request ID is already existing. */
 #define VERR_PDM_MEDIAEX_IOREQID_CONFLICT           (-2896)
Index: /trunk/include/VBox/vmm/pdmstorageifs.h
===================================================================
--- /trunk/include/VBox/vmm/pdmstorageifs.h	(revision 59304)
+++ /trunk/include/VBox/vmm/pdmstorageifs.h	(revision 59305)
@@ -571,4 +571,21 @@
 typedef uint64_t PDMMEDIAEXIOREQID;
 
+/**
+ * I/O Request Type.
+ */
+typedef enum PDMMEDIAEXIOREQTYPE
+{
+    /** Invalid tpe. */
+    PDMMEDIAEXIOREQTYPE_INVALID = 0,
+    /** Flush request. */
+    PDMMEDIAEXIOREQTYPE_FLUSH,
+    /** Write request. */
+    PDMMEDIAEXIOREQTYPE_WRITE,
+    /** Read request. */
+    PDMMEDIAEXIOREQTYPE_READ,
+    /** Discard request. */
+    PDMMEDIAEXIOREQTYPE_DISCARD
+} PDMMEDIAEXIOREQTYPE;
+
 /** @name I/O request specific flags
  * @{ */
@@ -623,5 +640,5 @@
      *
      * @returns VBox status code.
-     * @retval  VERR_PDM_MEDIAEX_IOBUF_UNDERFLOW if there is not enough data to copy from the buffer.
+     * @retval  VERR_PDM_MEDIAEX_IOBUF_UNDERRUN if there is not enough data to copy from the buffer.
      * @param   pInterface      Pointer to the interface structure containing the called function pointer.
      * @param   hIoReq          The I/O request handle.
Index: /trunk/src/VBox/Devices/Storage/DrvVD.cpp
===================================================================
--- /trunk/src/VBox/Devices/Storage/DrvVD.cpp	(revision 59304)
+++ /trunk/src/VBox/Devices/Storage/DrvVD.cpp	(revision 59305)
@@ -140,21 +140,4 @@
 
 /**
- * VD I/O Request Type.
- */
-typedef enum VDIOREQTYPE
-{
-    /** Invalid tpe. */
-    VDIOREQTYPE_INVALID = 0,
-    /** Flush request. */
-    VDIOREQTYPE_FLUSH,
-    /** Write request. */
-    VDIOREQTYPE_WRITE,
-    /** Read request. */
-    VDIOREQTYPE_READ,
-    /** Discard request. */
-    VDIOREQTYPE_DISCARD
-} VDIOREQTYPE;
-
-/**
  * VD I/O request state.
  */
@@ -188,5 +171,5 @@
     RTLISTNODE                    NdAllocatedList;
     /** I/O request type. */
-    VDIOREQTYPE                   enmType;
+    PDMMEDIAEXIOREQTYPE           enmType;
     /** Request state. */
     volatile VDIOREQSTATE         enmState;
@@ -2804,10 +2787,13 @@
 static void drvvdMediaExIoReqBufFree(PVBOXDISK pThis, PPDMMEDIAEXIOREQINT pIoReq)
 {
-    if (pThis->pCfgCrypto)
-        RTMemSaferFree(pIoReq->DataSeg.pvSeg, pIoReq->DataSeg.cbSeg);
-    else
-    {
-        size_t cb = RT_ALIGN_Z(pIoReq->DataSeg.cbSeg, _4K);
-        RTMemPageFree(pIoReq->DataSeg.pvSeg, cb);
+    if (pIoReq->DataSeg.pvSeg)
+    {
+        if (pThis->pCfgCrypto)
+            RTMemSaferFree(pIoReq->DataSeg.pvSeg, pIoReq->DataSeg.cbSeg);
+        else
+        {
+            size_t cb = RT_ALIGN_Z(pIoReq->DataSeg.cbSeg, _4K);
+            RTMemPageFree(pIoReq->DataSeg.pvSeg, cb);
+        }
     }
 }
@@ -2831,5 +2817,5 @@
 
         if (   RT_SUCCESS(rcReq)
-            && pIoReq->enmType == VDIOREQTYPE_READ)
+            && pIoReq->enmType == PDMMEDIAEXIOREQTYPE_READ)
         {
             /* Sync memory buffer with caller. */
@@ -2895,9 +2881,11 @@
         return VERR_NO_MEMORY;
 
-    pIoReq->uIoReqId = uIoReqId;
-    pIoReq->fFlags   = fFlags;
-    pIoReq->pDisk    = pThis;
-    pIoReq->enmState = VDIOREQSTATE_ALLOCATED;
-    pIoReq->enmType  = VDIOREQTYPE_INVALID;
+    pIoReq->uIoReqId      = uIoReqId;
+    pIoReq->fFlags        = fFlags;
+    pIoReq->pDisk         = pThis;
+    pIoReq->enmState      = VDIOREQSTATE_ALLOCATED;
+    pIoReq->enmType       = PDMMEDIAEXIOREQTYPE_INVALID;
+    pIoReq->DataSeg.pvSeg = NULL;
+    pIoReq->DataSeg.cbSeg = 0;
 
     int rc = drvvdMediaExIoReqInsert(pThis, pIoReq);
@@ -2996,5 +2984,5 @@
     VDIOREQSTATE enmState = (VDIOREQSTATE)ASMAtomicReadU32((volatile uint32_t *)&pIoReq->enmState);
 
-    if (RT_UNLIKELY(enmState != VDIOREQSTATE_CANCELED))
+    if (RT_UNLIKELY(enmState == VDIOREQSTATE_CANCELED))
         return VERR_PDM_MEDIAEX_IOREQ_CANCELED;
 
@@ -3002,5 +2990,5 @@
         return VERR_PDM_MEDIAEX_IOREQ_INVALID_STATE;
 
-    pIoReq->enmType = VDIOREQTYPE_READ;
+    pIoReq->enmType = PDMMEDIAEXIOREQTYPE_READ;
     /* Allocate a suitable I/O buffer for this request. */
     int rc = drvvdMediaExIoReqBufAlloc(pThis, pIoReq, cbRead);
@@ -3038,5 +3026,5 @@
     VDIOREQSTATE enmState = (VDIOREQSTATE)ASMAtomicReadU32((volatile uint32_t *)&pIoReq->enmState);
 
-    if (RT_UNLIKELY(enmState != VDIOREQSTATE_CANCELED))
+    if (RT_UNLIKELY(enmState == VDIOREQSTATE_CANCELED))
         return VERR_PDM_MEDIAEX_IOREQ_CANCELED;
 
@@ -3044,5 +3032,5 @@
         return VERR_PDM_MEDIAEX_IOREQ_INVALID_STATE;
 
-    pIoReq->enmType = VDIOREQTYPE_WRITE;
+    pIoReq->enmType = PDMMEDIAEXIOREQTYPE_WRITE;
     /* Allocate a suitable I/O buffer for this request. */
     int rc = drvvdMediaExIoReqBufAlloc(pThis, pIoReq, cbWrite);
@@ -3062,6 +3050,6 @@
 
             ASMAtomicIncU32(&pThis->cIoReqsActive);
-            rc = VDAsyncRead(pThis->pDisk, off, cbWrite, &pIoReq->SgBuf,
-                             drvvdMediaExIoReqComplete, pThis, pIoReq);
+            rc = VDAsyncWrite(pThis->pDisk, off, cbWrite, &pIoReq->SgBuf,
+                              drvvdMediaExIoReqComplete, pThis, pIoReq);
             if (rc == VERR_VD_ASYNC_IO_IN_PROGRESS)
                 rc = VINF_PDM_MEDIAEX_IOREQ_IN_PROGRESS;
@@ -3086,5 +3074,5 @@
     VDIOREQSTATE enmState = (VDIOREQSTATE)ASMAtomicReadU32((volatile uint32_t *)&pIoReq->enmState);
 
-    if (RT_UNLIKELY(enmState != VDIOREQSTATE_CANCELED))
+    if (RT_UNLIKELY(enmState == VDIOREQSTATE_CANCELED))
         return VERR_PDM_MEDIAEX_IOREQ_CANCELED;
 
@@ -3092,5 +3080,5 @@
         return VERR_PDM_MEDIAEX_IOREQ_INVALID_STATE;
 
-    pIoReq->enmType = VDIOREQTYPE_FLUSH;
+    pIoReq->enmType = PDMMEDIAEXIOREQTYPE_FLUSH;
 
     bool fXchg = ASMAtomicCmpXchgU32((volatile uint32_t *)&pIoReq->enmState, VDIOREQSTATE_ACTIVE, VDIOREQSTATE_ALLOCATED);
@@ -3124,5 +3112,5 @@
     VDIOREQSTATE enmState = (VDIOREQSTATE)ASMAtomicReadU32((volatile uint32_t *)&pIoReq->enmState);
 
-    if (RT_UNLIKELY(enmState != VDIOREQSTATE_CANCELED))
+    if (RT_UNLIKELY(enmState == VDIOREQSTATE_CANCELED))
         return VERR_PDM_MEDIAEX_IOREQ_CANCELED;
 
@@ -3130,5 +3118,5 @@
         return VERR_PDM_MEDIAEX_IOREQ_INVALID_STATE;
 
-    pIoReq->enmType = VDIOREQTYPE_DISCARD;
+    pIoReq->enmType = PDMMEDIAEXIOREQTYPE_DISCARD;
 
     bool fXchg = ASMAtomicCmpXchgU32((volatile uint32_t *)&pIoReq->enmState, VDIOREQSTATE_ACTIVE, VDIOREQSTATE_ALLOCATED);
Index: /trunk/src/VBox/Devices/testcase/tstDeviceStructSizeRC.cpp
===================================================================
--- /trunk/src/VBox/Devices/testcase/tstDeviceStructSizeRC.cpp	(revision 59304)
+++ /trunk/src/VBox/Devices/testcase/tstDeviceStructSizeRC.cpp	(revision 59305)
@@ -1958,8 +1958,6 @@
     GEN_CHECK_OFF(NVMEQUEUESUBM, hEvtProcess);
     GEN_CHECK_OFF(NVMEQUEUESUBM, pWrkThrdR3);
-    GEN_CHECK_OFF(NVMEQUEUESUBM, CritSectIoReqsActive);
     GEN_CHECK_OFF(NVMEQUEUESUBM, NdLstWrkThrdAssgnd);
     GEN_CHECK_OFF(NVMEQUEUESUBM, cReqsActive);
-    GEN_CHECK_OFF(NVMEQUEUESUBM, LstIoReqsActive);
 
     GEN_CHECK_SIZE(NVMEQUEUECOMP);