Index: /trunk/src/VBox/Devices/Storage/IOBufMgmt.cpp
===================================================================
--- /trunk/src/VBox/Devices/Storage/IOBufMgmt.cpp	(revision 64681)
+++ /trunk/src/VBox/Devices/Storage/IOBufMgmt.cpp	(revision 64682)
@@ -189,6 +189,6 @@
     /* Round to the next power of two and get the bin to try first. */
     uint32_t u32Order = ASMBitLastSetU32((uint32_t)cb) - 1;
-    if (cbAlloc & ~RT_BIT_32(u32Order))
-        u32Order <<= 1;
+    if (cb & (RT_BIT_32(u32Order) - 1))
+        u32Order++;
 
     u32Order = RT_CLAMP(u32Order, pThis->u32OrderMin, pThis->u32OrderMax);
@@ -374,4 +374,5 @@
         unsigned iSeg = 0;
         size_t   cbLeft = cbIoBuf;
+        size_t   cbIoBufAlloc = 0;
         PRTSGSEG pSeg = &pIoBufDesc->Int.aSegs[0];
 
@@ -386,4 +387,5 @@
             pSeg++;
             cbLeft -= RT_MIN(cbAlloc, cbLeft);
+            cbIoBufAlloc += cbAlloc;
         }
 
@@ -395,9 +397,9 @@
         pIoBufDesc->Int.cSegsUsed = iSeg;
         pIoBufDesc->Int.pIoBufMgr = pThis;
-        *pcbIoBufAllocated = cbIoBuf - cbLeft;
+        *pcbIoBufAllocated = cbIoBufAlloc;
         Assert(   (RT_SUCCESS(rc) && *pcbIoBufAllocated > 0)
                || RT_FAILURE(rc));
 
-        pThis->cbFree -= cbIoBuf - cbLeft;
+        pThis->cbFree -= cbIoBufAlloc;
 
         RTCritSectLeave(&pThis->CritSectAlloc);
@@ -429,5 +431,5 @@
             pBin->papvFree[pBin->iFree] = pSeg->pvSeg;
             pBin->iFree++;
-            pThis->cbFree += (size_t)RT_BIT_32(u32Order);
+            pThis->cbFree += pSeg->cbSeg;
         }