Index: /trunk/src/VBox/Devices/Network/slirp/ip_icmpwin.c
===================================================================
--- /trunk/src/VBox/Devices/Network/slirp/ip_icmpwin.c	(revision 88524)
+++ /trunk/src/VBox/Devices/Network/slirp/ip_icmpwin.c	(revision 88525)
@@ -46,5 +46,8 @@
     TAILQ_ENTRY(pong) queue_entry;
 
-    struct ip reqiph;
+    union {
+        struct ip ip;
+        uint8_t au[60];
+    } reqiph;
     struct icmp_echo reqicmph;
 
@@ -146,5 +149,6 @@
     AssertReturnVoid(ttl > 0);
 
-    reqsize = ip->ip_len - hlen - sizeof(struct icmp_echo);
+    size_t hdrsize = hlen + sizeof(struct icmp_echo);
+    reqsize = ip->ip_len - hdrsize;
 
     bufsize = sizeof(ICMP_ECHO_REPLY);
@@ -172,5 +176,5 @@
     {
         /* already in single contiguous buffer */
-        reqdata = mtod(m, char *) + sizeof(struct ip) + sizeof(struct icmp_echo);
+        reqdata = mtod(m, char *) + hdrsize;
     }
     else
@@ -178,6 +182,5 @@
         /* use reply buffer as temporary storage */
         reqdata = pong->buf;
-        m_copydata(m, sizeof(struct ip) + sizeof(struct icmp_echo),
-                   (int)reqsize, reqdata);
+        m_copydata(m, (int)hdrsize, (int)reqsize, reqdata);
     }
 
@@ -398,5 +401,5 @@
         ip->ip_p = IPPROTO_ICMP;
         ip->ip_src.s_addr = reply->Address;
-        ip->ip_dst = pong->reqiph.ip_src;
+        ip->ip_dst = pong->reqiph.ip.ip_src;
 
         icmp->icmp_type = ICMP_ECHOREPLY;
@@ -479,5 +482,6 @@
     Log2(("NAT: ping error type %d/code %d\n", type, code));
 
-    reqsize = sizeof(pong->reqiph) + sizeof(pong->reqicmph);
+    size_t reqhlen = pong->reqiph.ip.ip_hl << 2;
+    reqsize = reqhlen + sizeof(pong->reqicmph);
 
     m = icmpwin_get_mbuf(pData, reqsize);
@@ -494,5 +498,5 @@
     ip->ip_p = IPPROTO_ICMP;
     ip->ip_src.s_addr = 0;      /* NB */
-    ip->ip_dst = pong->reqiph.ip_src;
+    ip->ip_dst = pong->reqiph.ip.ip_src;
 
     icmp->icmp_type = type;
@@ -502,5 +506,6 @@
     icmp->icmp_echo_seq = 0;
 
-    m_append(pData, m, sizeof(pong->reqiph), (caddr_t)&pong->reqiph);
+    /* payload: the IP and ICMP headers of the original request */
+    m_append(pData, m, (int)reqhlen, (caddr_t)&pong->reqiph);
     m_append(pData, m, sizeof(pong->reqicmph), (caddr_t)&pong->reqicmph);