Index: /trunk/src/VBox/Devices/USB/VUSBUrb.cpp
===================================================================
--- /trunk/src/VBox/Devices/USB/VUSBUrb.cpp	(revision 59795)
+++ /trunk/src/VBox/Devices/USB/VUSBUrb.cpp	(revision 59796)
@@ -631,4 +631,5 @@
         //pExtra->Urb.pVUsb->pNext = NULL;
         //pExtra->Urb.pVUsb->ppPrev = NULL;
+        pExtra->Urb.pVUsb->pUrb = &pExtra->Urb;
         pExtra->Urb.pVUsb->pDev = pUrb->pVUsb->pDev;
         pExtra->Urb.pVUsb->pfnFree = vusbMsgFreeUrb;
@@ -688,4 +689,6 @@
         LogFlow(("vusbMsgSetup: Replacing canceled pExtra=%p with %p.\n", pExtra, pvNew));
         pPipe->pCtrl = pExtra = (PVUSBCTRLEXTRA)pvNew;
+        pExtra->Urb.pVUsb = (PVUSBURBVUSB)&pExtra->Urb.abData[sizeof(pExtra->Urb.abData) + sizeof(VUSBSETUP)];
+        pExtra->Urb.pVUsb->pUrb = &pExtra->Urb;
         pExtra->pMsg = (PVUSBSETUP)pExtra->Urb.abData;
         pExtra->Urb.enmState = VUSBURBSTATE_ALLOCATED;
@@ -696,7 +699,7 @@
      * Check that we've got sufficient space in the message URB.
      */
-    if (pExtra->cbMax < cbBuf + pSetupIn->wLength)
-    {
-        uint32_t cbReq = RT_ALIGN_32(cbBuf + pSetupIn->wLength, 1024);
+    if (pExtra->cbMax < cbBuf + pSetupIn->wLength + sizeof(VUSBURBVUSBINT))
+    {
+        uint32_t cbReq = RT_ALIGN_32(cbBuf + pSetupIn->wLength + sizeof(VUSBURBVUSBINT), 1024);
         PVUSBCTRLEXTRA pNew = (PVUSBCTRLEXTRA)RTMemRealloc(pExtra, RT_OFFSETOF(VUSBCTRLEXTRA, Urb.abData[cbReq]));
         if (!pNew)
@@ -711,4 +714,6 @@
             pExtra = pNew;
         }
+        pExtra->Urb.pVUsb = (PVUSBURBVUSB)&pExtra->Urb.abData[cbBuf + pSetupIn->wLength];
+        pExtra->Urb.pVUsb->pUrb = &pExtra->Urb;
         pExtra->cbMax = cbReq;
     }