Index: /trunk/src/VBox/Additions/linux/drm/vbox_mode.c
===================================================================
--- /trunk/src/VBox/Additions/linux/drm/vbox_mode.c	(revision 59913)
+++ /trunk/src/VBox/Additions/linux/drm/vbox_mode.c	(revision 59914)
@@ -617,14 +617,14 @@
  *  if the corresponding alpha value in the ARGB image is greater than 0xF0. */
 static void copy_cursor_image(u8 *src, u8 *dst, int width, int height,
-                              size_t cbMask)
+                              size_t mask_size)
 {
     unsigned i, j;
-    size_t cbLine = (width + 7) / 8;
-
-    memcpy(dst + cbMask, src, width * height * 4);
+    size_t line_size = (width + 7) / 8;
+
+    memcpy(dst + mask_size, src, width * height * 4);
     for (i = 0; i < height; ++i)
         for (j = 0; j < width; ++j)
             if (((uint32_t *)src)[i * width + j] > 0xf0000000)
-                dst[i * cbLine + j / 8] |= (0x80 >> (j % 8));
+                dst[i * line_size + j / 8] |= (0x80 >> (j % 8));
 }
 
@@ -641,5 +641,6 @@
     u8 *src;
     u8 *dst = NULL;
-    size_t cbData, cbMask;
+    u32 caps = 0;
+    size_t data_size, mask_size;
     bool src_isiomem;
 
@@ -651,4 +652,12 @@
     if (   width > VBOX_MAX_CURSOR_WIDTH || height > VBOX_MAX_CURSOR_HEIGHT
         || width == 0 || hot_x > width || height == 0 || hot_y > height)
+        return -EINVAL;
+    rc = VBoxQueryConfHGSMI(&vbox->submit_info,
+                            VBOX_VBVA_CONF32_CURSOR_CAPABILITIES, &caps);
+    ret = -RTErrConvertToErrno(rc);
+    if (ret)
+        return ret;
+    if (   caps & VMMDEV_MOUSE_HOST_CANNOT_HWPOINTER
+        || !(caps & VMMDEV_MOUSE_HOST_WANTS_ABSOLUTE))
         return -EINVAL;
 
@@ -662,7 +671,7 @@
             /* The mask must be calculated based on the alpha channel, one bit
              * per ARGB word, and must be 32-bit padded. */
-            cbMask  = ((width + 7) / 8 * height + 3) & ~3;
-            cbData = width * height * 4 + cbMask;
-            dst = kmalloc(cbData, GFP_KERNEL);
+            mask_size  = ((width + 7) / 8 * height + 3) & ~3;
+            data_size = width * height * 4 + mask_size;
+            dst = kmalloc(data_size, GFP_KERNEL);
             if (dst)
             {
@@ -676,9 +685,9 @@
                                           | VBOX_MOUSE_POINTER_SHAPE
                                           | VBOX_MOUSE_POINTER_ALPHA;
-                        copy_cursor_image(src, dst, width, height, cbMask);
+                        copy_cursor_image(src, dst, width, height, mask_size);
                         rc = VBoxHGSMIUpdatePointerShape(&vbox->submit_info, flags,
                                                          hot_x, hot_y, width,
-                                                         height, dst, cbData);
-                        ret = RTErrConvertToErrno(rc);
+                                                         height, dst, data_size);
+                        ret = -RTErrConvertToErrno(rc);
                     }
                     else