Index: /trunk/src/VBox/Devices/Storage/DevBusLogic.cpp
===================================================================
--- /trunk/src/VBox/Devices/Storage/DevBusLogic.cpp	(revision 60552)
+++ /trunk/src/VBox/Devices/Storage/DevBusLogic.cpp	(revision 60553)
@@ -1725,4 +1725,10 @@
             break;
         }
+        case BUSLOGICCOMMAND_SET_SCSI_SELECTION_TIMEOUT:
+        {
+            /* no-op */
+            pBusLogic->cbReplyParametersLeft = 0;
+            break;
+        }
         case BUSLOGICCOMMAND_MODIFY_IO_ADDRESS:
         {
@@ -1816,9 +1822,9 @@
             /* The reply length is set by the guest and is found in the first byte of the command buffer. */
             pBusLogic->cbReplyParametersLeft = pBusLogic->aCommandBuffer[0];
-            memset(pBusLogic->aReplyBuffer, ' ', pBusLogic->cbReplyParametersLeft);
-            const char aModelName[] = "958";
-            int cCharsToTransfer =   (pBusLogic->cbReplyParametersLeft <= (sizeof(aModelName) - 1))
+            memset(pBusLogic->aReplyBuffer, 0, pBusLogic->cbReplyParametersLeft);
+            const char aModelName[] = "958";    /* Trailing \0 is fine, that's the filler anyway. */
+            int cCharsToTransfer =   pBusLogic->cbReplyParametersLeft <= sizeof(aModelName)
                                    ? pBusLogic->cbReplyParametersLeft
-                                   : sizeof(aModelName) - 1;
+                                   : sizeof(aModelName);
 
             for (int i = 0; i < cCharsToTransfer; i++)
@@ -2312,4 +2318,7 @@
                     case BUSLOGICCOMMAND_WRITE_BUSMASTER_CHIP_FIFO:
                         pBusLogic->cbCommandParametersLeft = 3;
+                        break;
+                    case BUSLOGICCOMMAND_SET_SCSI_SELECTION_TIMEOUT:
+                        pBusLogic->cbCommandParametersLeft = 4;
                         break;
                     case BUSLOGICCOMMAND_INITIALIZE_MAILBOX: