Index: /trunk/src/VBox/HostDrivers/VBoxNetAdp/win/VBoxNetAdp-win.cpp
===================================================================
--- /trunk/src/VBox/HostDrivers/VBoxNetAdp/win/VBoxNetAdp-win.cpp	(revision 75168)
+++ /trunk/src/VBox/HostDrivers/VBoxNetAdp/win/VBoxNetAdp-win.cpp	(revision 75169)
@@ -526,7 +526,5 @@
         }
 
-        if (cbSrc > cbPacket)
-            cbSrc = cbPacket;
-
+        /* Handle the offset in the current (which is the first for us) MDL */
         if (uOffset)
         {
@@ -539,8 +537,13 @@
             else
             {
-                uOffset -= cbSrc;
-                continue;
+                /* This is an invalid MDL chain */
+                vboxNetAdpWinDestroySG(pSG);
+                return NULL;
             }
         }
+
+        /* Do not read the last MDL beyond packet's end */
+        if (cbSrc > cbPacket)
+            cbSrc = cbPacket;
 
         Assert(cSegs < pSG->cSegsAlloc);
Index: /trunk/src/VBox/HostDrivers/VBoxNetFlt/win/drv/VBoxNetLwf-win.cpp
===================================================================
--- /trunk/src/VBox/HostDrivers/VBoxNetFlt/win/drv/VBoxNetLwf-win.cpp	(revision 75168)
+++ /trunk/src/VBox/HostDrivers/VBoxNetFlt/win/drv/VBoxNetLwf-win.cpp	(revision 75169)
@@ -1633,7 +1633,5 @@
         }
 
-        if (cbSrc > cbPacket)
-            cbSrc = cbPacket;
-
+        /* Handle the offset in the current (which is the first for us) MDL */
         if (uOffset)
         {
@@ -1646,8 +1644,13 @@
             else
             {
-                uOffset -= cbSrc;
-                continue;
+                /* This is an invalid MDL chain */
+                vboxNetLwfWinDestroySG(pSG);
+                return NULL;
             }
         }
+
+        /* Do not read the last MDL beyond packet's end */
+        if (cbSrc > cbPacket)
+            cbSrc = cbPacket;
 
         Assert(cSegs < pSG->cSegsAlloc);