Index: /trunk/src/VBox/Devices/Network/DevVirtioNet.cpp
===================================================================
--- /trunk/src/VBox/Devices/Network/DevVirtioNet.cpp	(revision 66520)
+++ /trunk/src/VBox/Devices/Network/DevVirtioNet.cpp	(revision 66521)
@@ -1149,5 +1149,5 @@
 }
 
-DECLINLINE(void) vnetCompleteChecksum(uint8_t *pBuf, unsigned cbSize, uint16_t uStart, uint16_t uOffset)
+DECLINLINE(void) vnetCompleteChecksum(uint8_t *pBuf, size_t cbSize, uint16_t uStart, uint16_t uOffset)
 {
     *(uint16_t*)(pBuf + uStart + uOffset) = vnetCSum16(pBuf + uStart, cbSize - uStart);
@@ -1212,8 +1212,11 @@
             STAM_PROFILE_ADV_START(&pThis->StatTransmit, a);
             /* Compute total frame size. */
-            for (unsigned int i = 1; i < elem.nOut; i++)
+            for (unsigned int i = 1; i < elem.nOut && uSize < VNET_MAX_FRAME_SIZE; i++)
                 uSize += elem.aSegsOut[i].cb;
             Log5(("%s vnetTransmitPendingPackets: complete frame is %u bytes.\n", INSTANCE(pThis), uSize));
             Assert(uSize <= VNET_MAX_FRAME_SIZE);
+            /* Truncate oversized frames. */
+            if (uSize > VNET_MAX_FRAME_SIZE)
+                uSize = VNET_MAX_FRAME_SIZE;
             if (pThis->pDrv)
             {
@@ -1235,14 +1238,16 @@
                 {
                     Assert(pSgBuf->cSegs == 1);
+                    pSgBuf->cbUsed = uSize;
                     /* Assemble a complete frame. */
-                    for (unsigned int i = 1; i < elem.nOut; i++)
+                    for (unsigned int i = 1; i < elem.nOut && uSize > 0; i++)
                     {
+                        unsigned int cbSegment = RT_MIN(uSize, elem.aSegsOut[i].cb);
                         PDMDevHlpPhysRead(pThis->VPCI.CTX_SUFF(pDevIns), elem.aSegsOut[i].addr,
                                           ((uint8_t*)pSgBuf->aSegs[0].pvSeg) + uOffset,
-                                          elem.aSegsOut[i].cb);
-                        uOffset += elem.aSegsOut[i].cb;
+                                          cbSegment);
+                        uOffset += cbSegment;
+                        uSize -= cbSegment;
                     }
-                    pSgBuf->cbUsed = uSize;
-                    vnetPacketDump(pThis, (uint8_t *)pSgBuf->aSegs[0].pvSeg, uSize, "--> Outgoing");
+                    vnetPacketDump(pThis, (uint8_t *)pSgBuf->aSegs[0].pvSeg, pSgBuf->cbUsed, "--> Outgoing");
                     if (pGso)
                     {
@@ -1285,5 +1290,5 @@
                          * This is not GSO frame but checksum offloading is requested.
                          */
-                        vnetCompleteChecksum((uint8_t*)pSgBuf->aSegs[0].pvSeg, uSize,
+                        vnetCompleteChecksum((uint8_t*)pSgBuf->aSegs[0].pvSeg, pSgBuf->cbUsed,
                                              Hdr.u16CSumStart, Hdr.u16CSumOffset);
                     }