Index: /trunk/src/VBox/Devices/Storage/DevVirtioSCSI.cpp
===================================================================
--- /trunk/src/VBox/Devices/Storage/DevVirtioSCSI.cpp	(revision 81230)
+++ /trunk/src/VBox/Devices/Storage/DevVirtioSCSI.cpp	(revision 81231)
@@ -696,6 +696,11 @@
     RT_NOREF2(hIoReq, pInterface);
     PVIRTIOSCSIREQ pReq = (PVIRTIOSCSIREQ)pvIoReqAlloc;
-    if (pReq->pbDataIn)
-        RTSgBufCopyToBuf(pSgBuf, pReq->pbDataIn + offDst, cbCopy);
+
+    AssertReturn(pReq->pbDataIn
+                 && offDst + cbCopy <= pReq->cbDataIn
+                 && cbCopy <= pSgBuf->cbSegLeft,  VERR_INVALID_PARAMETER);
+
+    RTSgBufCopyToBuf(pSgBuf, pReq->pbDataIn + offDst, cbCopy);
+
     return VINF_SUCCESS;
 }
@@ -709,6 +714,10 @@
     RT_NOREF2(hIoReq, pInterface);
     PVIRTIOSCSIREQ pReq = (PVIRTIOSCSIREQ)pvIoReqAlloc;
-    if (pReq->pbDataOut)
-        RTSgBufCopyFromBuf(pSgBuf, pReq->pbDataOut + offSrc, cbCopy);
+
+    AssertReturn(pReq->pbDataOut
+                 && offSrc + cbCopy <= pReq->cbDataOut
+                 && cbCopy <= pSgBuf->cbSegLeft,  VERR_INVALID_PARAMETER);
+
+    RTSgBufCopyFromBuf(pSgBuf, pReq->pbDataOut + offSrc, cbCopy);
 
     return VINF_SUCCESS;
Index: /trunk/src/VBox/Devices/VirtIO/Virtio_1_0.cpp
===================================================================
--- /trunk/src/VBox/Devices/VirtIO/Virtio_1_0.cpp	(revision 81230)
+++ /trunk/src/VBox/Devices/VirtIO/Virtio_1_0.cpp	(revision 81231)
@@ -108,5 +108,5 @@
 int virtioQueueGet(VIRTIOHANDLE hVirtio, uint16_t qIdx, PPVIRTIO_DESC_CHAIN_T ppDescChain,  bool fRemove)
 {
-    Assert(ppDescChain);
+    AssertReturn(ppDescChain, VERR_INVALID_PARAMETER);
 
     PVIRTIOSTATE pVirtio = (PVIRTIOSTATE)hVirtio;
@@ -1040,6 +1040,8 @@
     }
 
-#ifdef VBOX_WITH_MSI_DEVICES
+#if 0 /* Until pdmR3DvHlp_PCISetIrq() impl is fixed and Assert that limits vec to 0 is removed */
+# ifdef VBOX_WITH_MSI_DEVICES
     pVirtio->fMsiSupport = true;
+# endif
 #endif