Index: /trunk/src/VBox/Devices/USB/DevOHCI.cpp
===================================================================
--- /trunk/src/VBox/Devices/USB/DevOHCI.cpp	(revision 81185)
+++ /trunk/src/VBox/Devices/USB/DevOHCI.cpp	(revision 81186)
@@ -1193,4 +1193,5 @@
      */
     pThis->RootHub.pIRhConn->pfnCancelAllUrbs(pThis->RootHub.pIRhConn);
+    Assert(pThis->cInFlight == 0);
 
     /*
@@ -2812,5 +2813,7 @@
     ohciR3Lock(pThis);
 
-    /* Do nothing if the HC encountered an unrecoverable error. */
+    int cFmAge = ohciR3InFlightRemoveUrb(pThis, pUrb);
+
+    /* Do nothing requiring memory access if the HC encountered an unrecoverable error. */
     if (!(pThis->intr_status & OHCI_INTR_UNRECOVERABLE_ERROR))
     {
@@ -2831,5 +2834,4 @@
          * with the data copying, buffer pointer advancing and error handling.
          */
-        int cFmAge = ohciR3InFlightRemoveUrb(pThis, pUrb);
         if (pUrb->enmStatus == VUSBSTATUS_UNDO)
         {
@@ -3046,6 +3048,6 @@
     Log(("ohciR3ServiceTd: failed submitting TdAddr=%#010x EdAddr=%#010x pUrb=%p!!\n",
          TdAddr, EdAddr, pUrb));
+    ohciR3InFlightRemove(pThis, TdAddr);
     VUSBIRhFreeUrb(pThis->RootHub.pIRhConn, pUrb);
-    ohciR3InFlightRemove(pThis, TdAddr);
     return false;
 }
@@ -3216,6 +3218,5 @@
     Log(("ohciR3ServiceTdMultiple: failed submitting pUrb=%p cbData=%#x EdAddr=%#010x cTds=%d TdAddr0=%#010x - rc=%Rrc\n",
          pUrb, cbTotal, EdAddr, cTds, TdAddr, rc));
-    for (struct OHCITDENTRY *pCur = &Head; pCur; pCur = pCur->pNext, iTd++)
-        ohciR3InFlightRemove(pThis, pCur->TdAddr);
+    ohciR3InFlightRemoveUrb(pThis, pUrb);
     VUSBIRhFreeUrb(pThis->RootHub.pIRhConn, pUrb);
     return false;
@@ -3448,5 +3449,5 @@
      * Submit the URB.
      */
-    ohciR3InFlightAddUrb(pThis, pUrb);
+    ohciR3InFlightAdd(pThis, ITdAddr, pUrb);
     Log(("%s: ohciR3ServiceIsochronousTd: submitting cbData=%#x cIsocPkts=%d EdAddr=%#010x TdAddr=%#010x SF=%#x (%#x)\n",
          pUrb->pszDesc, pUrb->cbData, pUrb->cIsocPkts, EdAddr, ITdAddr, pITd->HwInfo & ITD_HWINFO_SF, pThis->HcFmNumber));
@@ -3640,4 +3641,9 @@
     {
         OHCIED Ed;
+
+        /* Bail if previous processing ended up in the unrecoverable error state. */
+        if (pThis->intr_status & OHCI_INTR_UNRECOVERABLE_ERROR)
+            break;
+
         ohciR3ReadEd(pThis, EdAddr, &Ed);
         Assert(!(Ed.hwinfo & ED_HWINFO_ISO)); /* the guest is screwing us */
@@ -3781,4 +3787,9 @@
     {
         OHCIED Ed;
+
+        /* Bail if previous processing ended up in the unrecoverable error state. */
+        if (pThis->intr_status & OHCI_INTR_UNRECOVERABLE_ERROR)
+            break;
+
         ohciR3ReadEd(pThis, EdAddr, &Ed);
         Assert(!(Ed.hwinfo & ED_HWINFO_ISO)); /* the guest is screwing us */
@@ -3852,4 +3863,8 @@
     {
         OHCIED Ed;
+
+        /* Bail if previous processing ended up in the unrecoverable error state. */
+        if (pThis->intr_status & OHCI_INTR_UNRECOVERABLE_ERROR)
+            break;
 
         ohciR3ReadEd(pThis, EdAddr, &Ed);