Index: /trunk/src/VBox/Devices/Storage/DevATA.cpp
===================================================================
--- /trunk/src/VBox/Devices/Storage/DevATA.cpp	(revision 65967)
+++ /trunk/src/VBox/Devices/Storage/DevATA.cpp	(revision 65968)
@@ -3398,7 +3398,4 @@
 {
     const uint8_t *pbPacket = &s->aATAPICmd[0];
-    size_t cbTransfer = 0;
-    PDMMEDIATXDIR uTxDir = PDMMEDIATXDIR_NONE;
-    uint8_t u8ScsiSts = SCSI_STATUS_OK;
 
     /* Some cases we have to handle here. */
@@ -3406,5 +3403,5 @@
         && ASMAtomicReadU32(&s->MediaEventStatus) != ATA_EVENT_STATUS_UNCHANGED)
     {
-        cbTransfer = scsiBE2H_U16(pbPacket + 7);
+        uint32_t cbTransfer = scsiBE2H_U16(pbPacket + 7);
         ataR3StartTransfer(s, RT_MIN(cbTransfer, 8), PDMMEDIATXDIR_FROM_DEVICE, ATAFN_BT_ATAPI_CMD, ATAFN_SS_ATAPI_GET_EVENT_STATUS_NOTIFICATION, true);
     }
@@ -3416,4 +3413,8 @@
         size_t cbBuf = 0;
         size_t cbATAPISector = 0;
+        size_t cbTransfer = 0;
+        PDMMEDIATXDIR uTxDir = PDMMEDIATXDIR_NONE;
+        uint8_t u8ScsiSts = SCSI_STATUS_OK;
+
         if (pbPacket[0] == SCSI_FORMAT_UNIT || pbPacket[0] == SCSI_GET_PERFORMANCE)
             cbBuf = s->uATARegLCyl | (s->uATARegHCyl << 8); /* use ATAPI transfer length */
@@ -3426,4 +3427,5 @@
             s->cbATAPISector = (uint32_t)cbATAPISector;
             Assert(s->cbATAPISector == (uint32_t)cbATAPISector);
+            Assert(cbTransfer == (uint32_t)cbTransfer);
 
             /*
@@ -3435,5 +3437,5 @@
             if (cbTransfer == 0)
                 uTxDir = PDMMEDIATXDIR_NONE;
-            ataR3StartTransfer(s, cbTransfer, uTxDir, ATAFN_BT_ATAPI_PASSTHROUGH_CMD, ATAFN_SS_ATAPI_PASSTHROUGH, true);
+            ataR3StartTransfer(s, (uint32_t)cbTransfer, uTxDir, ATAFN_BT_ATAPI_PASSTHROUGH_CMD, ATAFN_SS_ATAPI_PASSTHROUGH, true);
         }
         else if (u8ScsiSts == SCSI_STATUS_CHECK_CONDITION)