diff -up xen-3.0.3_0-src/tools/ioemu/hw/ne2000.c.cve xen-3.0.3_0-src/tools/ioemu/hw/ne2000.c
--- xen-3.0.3_0-src/tools/ioemu/hw/ne2000.c.cve	2007-09-25 10:27:44.000000000 -0400
+++ xen-3.0.3_0-src/tools/ioemu/hw/ne2000.c	2007-09-25 10:27:47.000000000 -0400
@@ -252,7 +252,7 @@ static void ne2000_receive(void *opaque,
 {
     NE2000State *s = opaque;
     uint8_t *p;
-    int total_len, next, avail, len, index, mcast_idx;
+    unsigned int total_len, next, avail, len, index, mcast_idx;
     uint8_t buf1[60];
     static const uint8_t broadcast_macaddr[6] = 
         { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
@@ -327,7 +327,10 @@ static void ne2000_receive(void *opaque,
 
     /* write packet data */
     while (size > 0) {
-        avail = s->stop - index;
+        if (index <= s->stop)
+            avail = s->stop - index;
+        else
+            avail = 0;
         len = size;
         if (len > avail)
             len = avail;