Index: /trunk/src/VBox/Devices/USB/DevOHCI.cpp
===================================================================
--- /trunk/src/VBox/Devices/USB/DevOHCI.cpp	(revision 82660)
+++ /trunk/src/VBox/Devices/USB/DevOHCI.cpp	(revision 82661)
@@ -3121,5 +3121,4 @@
          TdAddr, EdAddr, pUrb));
     ohciR3InFlightRemove(pThis, pThisCC, TdAddr);
-    VUSBIRhFreeUrb(pThisCC->RootHub.pIRhConn, pUrb);
     return false;
 }
@@ -3292,6 +3291,7 @@
     Log(("ohciR3ServiceTdMultiple: failed submitting pUrb=%p cbData=%#x EdAddr=%#010x cTds=%d TdAddr0=%#010x - rc=%Rrc\n",
          pUrb, cbTotal, EdAddr, cTds, TdAddr, rc));
-    ohciR3InFlightRemoveUrb(pThis, pThisCC, pUrb);
-    VUSBIRhFreeUrb(pThisCC->RootHub.pIRhConn, pUrb);
+    /* NB: We cannot call ohciR3InFlightRemoveUrb() because the URB is already gone! */
+    for (struct OHCITDENTRY *pCur = &Head; pCur; pCur = pCur->pNext, iTd++)
+        ohciR3InFlightRemove(pThis, pThisCC, pCur->TdAddr);
     return false;
 }
@@ -3539,5 +3539,4 @@
          pUrb, cbTotal, EdAddr, 1, ITdAddr, rc));
     ohciR3InFlightRemove(pThis, pThisCC, ITdAddr);
-    VUSBIRhFreeUrb(pThisCC->RootHub.pIRhConn, pUrb);
     return false;
 }