Index: /trunk/src/VBox/Devices/Network/DevE1000.cpp
===================================================================
--- /trunk/src/VBox/Devices/Network/DevE1000.cpp	(revision 81217)
+++ /trunk/src/VBox/Devices/Network/DevE1000.cpp	(revision 81218)
@@ -2433,5 +2433,6 @@
     }
     /* Compute checksum of complete packet */
-    uint16_t checksum = e1kCSum16(rxPacket + GET_BITS(RXCSUM, PCSS), cb);
+    size_t cbCSumStart = RT_MIN(GET_BITS(RXCSUM, PCSS), cb);
+    uint16_t checksum = e1kCSum16(rxPacket + cbCSumStart, cb - cbCSumStart);
     e1kRxChecksumOffload(pThis, rxPacket, cb, &status);
 
@@ -4247,5 +4248,5 @@
     E1kLog3(("%s e1kFallbackAddSegment: Length=%x, remaining payload=%x, header=%x, send=%RTbool\n",
              pThis->szPrf, u16Len, pThis->u32PayRemain, pThis->u16HdrRemain, fSend));
-    Assert(pThis->u32PayRemain + pThis->u16HdrRemain > 0);
+    AssertReturn(pThis->u32PayRemain + pThis->u16HdrRemain > 0, VINF_SUCCESS);
 
     if (pThis->u16TxPktLen + u16Len <= sizeof(pThis->aTxPacketFallback))
@@ -4286,5 +4287,8 @@
     }
 
-    pThis->u32PayRemain -= u16Len;
+    if (u16Len > pThis->u32PayRemain)
+        pThis->u32PayRemain = 0;
+    else
+        pThis->u32PayRemain -= u16Len;
 
     if (fSend)
@@ -4454,4 +4458,7 @@
 
     uint16_t u16MaxPktLen = pThis->contextTSE.dw3.u8HDRLEN + pThis->contextTSE.dw3.u16MSS;
+    /* We cannot produce empty packets, ignore all TX descriptors (see @bugref{9571}) */
+    if (u16MaxPktLen == 0)
+        return VINF_SUCCESS;
 
     /*