1 files changed, 4 insertions, 5 deletions
diff --git a/src/VBox/HostDrivers/VBoxNetFlt/win/drv/VBoxNetFltRt-win.cpp b/src/VBox/HostDrivers/VBoxNetFlt/win/drv/VBoxNetFltRt-win.cpp
index 5913697b..d6ed6bb1 100644
--- a/src/VBox/HostDrivers/VBoxNetFlt/win/drv/VBoxNetFltRt-win.cpp
+++ b/src/VBox/HostDrivers/VBoxNetFlt/win/drv/VBoxNetFltRt-win.cpp
@@ -1134,17 +1134,16 @@ DECLHIDDEN(void) vboxNetFltWinQuFiniPacketQueue(PVBOXNETFLTINS pInstance)
  */
 DECLHIDDEN(NDIS_STATUS) vboxNetFltWinAllocSG(UINT cbPacket, PINTNETSG *ppSG)
 {
-    NDIS_STATUS Status;
-    PINTNETSG pSG;
-
     /* allocation:
      * 1. SG_PACKET - with one aSegs pointing to
      * 2. buffer of cbPacket containing the entire packet */
     AssertCompileSizeAlignment(INTNETSG, sizeof(PVOID));
-    Status = vboxNetFltWinMemAlloc((PVOID*)&pSG, cbPacket + RT_UOFFSETOF_DYN(INTNETSG, aSegs[1]));
+    PINTNETSG   pSG    = NULL;
+    UINT const  cbSg   = RT_UOFFSETOF_DYN(INTNETSG, aSegs[1]);
+    NDIS_STATUS Status = vboxNetFltWinMemAlloc((PVOID *)&pSG, cbSg + cbPacket);
     if (Status == NDIS_STATUS_SUCCESS)
     {
-        IntNetSgInitTemp(pSG, pSG + 1, cbPacket);
+        IntNetSgInitTemp(pSG, (uint8_t *)pSG + cbSg, cbPacket);
         LogFlow(("pSG created (%p)\n", pSG));
         *ppSG = pSG;
     }