--- xen-4.5.1/tools/qemu-xen-traditional/hw/ne2000.c.orig	2015-06-09 16:32:24.000000000 +0100

+++ xen-4.5.1/tools/qemu-xen-traditional/hw/ne2000.c	2015-09-26 17:27:49.494334726 +0100

@@ -304,6 +304,9 @@

     }

     index = s->curpag << 8;

+    if (index >= NE2000_PMEM_END) {

+        index = s->start;

+    }

     /* 4 bytes for header */

     total_len = size + 4;

     /* address for next packet (4 bytes for CRC) */

@@ -387,15 +390,21 @@

         offset = addr | (page << 4);

         switch(offset) {

         case EN0_STARTPG:

-            s->start = val << 8;

+            if (val << 8 <= NE2000_PMEM_END) {

+                s->start = val << 8;

+            }

             s->tainted = 1;

             break;

         case EN0_STOPPG:

-            s->stop = val << 8;

+            if (val << 8 <= NE2000_PMEM_END) {

+                s->stop = val << 8;

+            }

             s->tainted = 1;

             break;

         case EN0_BOUNDARY:

-            s->boundary = val;

+            if (val << 8 < NE2000_PMEM_END) {

+                s->boundary = val;

+            }

             break;

         case EN0_IMR:

             s->imr = val;

@@ -436,7 +445,9 @@

             s->phys[offset - EN1_PHYS] = val;

             break;

         case EN1_CURPAG:

-            s->curpag = val;

+            if (val << 8 < NE2000_PMEM_END) {

+                s->curpag = val;

+            }

             s->tainted = 1;

             break;

         case EN1_MULT ... EN1_MULT + 7: