Index: /trunk/src/VBox/Devices/Network/DevE1000.cpp
===================================================================
--- /trunk/src/VBox/Devices/Network/DevE1000.cpp	(revision 78118)
+++ /trunk/src/VBox/Devices/Network/DevE1000.cpp	(revision 78119)
@@ -2482,4 +2482,6 @@
         if (pDesc->u64BufAddr)
         {
+            uint16_t u16RxBufferSize = pThis->u16RxBSize; /* see @bugref{9427} */
+
             /* Update descriptor */
             pDesc->status        = status;
@@ -2495,14 +2497,14 @@
              * fetched RxD cache entries either.
              */
-            if (cb > pThis->u16RxBSize)
+            if (cb > u16RxBufferSize)
             {
                 pDesc->status.fEOP = false;
                 e1kCsRxLeave(pThis);
-                e1kStoreRxFragment(pThis, pDesc, ptr, pThis->u16RxBSize);
+                e1kStoreRxFragment(pThis, pDesc, ptr, u16RxBufferSize);
                 rc = e1kCsRxEnter(pThis, VERR_SEM_BUSY);
                 if (RT_UNLIKELY(rc != VINF_SUCCESS))
                     return rc;
-                ptr += pThis->u16RxBSize;
-                cb -= pThis->u16RxBSize;
+                ptr += u16RxBufferSize;
+                cb -= u16RxBufferSize;
             }
             else
@@ -3158,4 +3160,6 @@
     if (value & RCTL_BSEX)
         cbRxBuf *= 16;
+    if (cbRxBuf > E1K_MAX_RX_PKT_SIZE)
+        cbRxBuf = E1K_MAX_RX_PKT_SIZE;
     if (cbRxBuf != pThis->u16RxBSize)
         E1kLog2(("%s e1kRegWriteRCTL: Setting receive buffer size to %d (old %d)\n",