Index: /trunk/src/VBox/Devices/Network/DevE1000.cpp
===================================================================
--- /trunk/src/VBox/Devices/Network/DevE1000.cpp	(revision 67973)
+++ /trunk/src/VBox/Devices/Network/DevE1000.cpp	(revision 67974)
@@ -3725,5 +3725,4 @@
                  pThis->fVTag ? "VLAN " : "",
                  pThis->fGSO ? "GSO " : ""));
-        pThis->cbTxAlloc = 0;
     }
     else
@@ -3741,4 +3740,5 @@
         pSg->aSegs[0].cbSeg = sizeof(pThis->aTxPacketFallback);
     }
+    pThis->cbTxAlloc = 0;
 
     pThis->CTX_SUFF(pTxSg) = pSg;
@@ -4366,11 +4366,19 @@
 
     uint16_t u16MaxPktLen = pThis->contextTSE.dw3.u8HDRLEN + pThis->contextTSE.dw3.u16MSS;
-    Assert(u16MaxPktLen != 0);
-    Assert(u16MaxPktLen < E1K_MAX_TX_PKT_SIZE);
+    if (RT_UNLIKELY(u16MaxPktLen <= pThis->contextTSE.dw3.u8HDRLEN))
+    {
+        E1kLog(("%s Transmit packet is too small: %u <= %u(min)\n", pThis->szPrf, u16MaxPktLen, pThis->contextTSE.dw3.u8HDRLEN));
+        return VINF_SUCCESS; // @todo consider VERR_BUFFER_UNDERFLOW;
+    }
+    if (RT_UNLIKELY(u16MaxPktLen > E1K_MAX_TX_PKT_SIZE || u16MaxPktLen > pThis->CTX_SUFF(pTxSg)->cbAvailable))
+    {
+        E1kLog(("%s Transmit packet is too large: %u > %u(max)\n", pThis->szPrf, u16MaxPktLen, E1K_MAX_TX_PKT_SIZE));
+        return VINF_SUCCESS; // @todo consider VERR_BUFFER_OVERFLOW;
+    }
 
     /*
      * Carve out segments.
      */
-    int rc;
+    int rc = VINF_SUCCESS;
     do
     {
@@ -4406,5 +4414,5 @@
     }
 
-    return false;
+    return VINF_SUCCESS; // @todo consider rc;
 }
 #endif /* E1K_WITH_TXD_CACHE */