Index: src/VBox/Devices/USB/linux/USBProxyDevice-linux.cpp
===================================================================
--- src/VBox/Devices/USB/linux/USBProxyDevice-linux.cpp	(revision 44146)
+++ src/VBox/Devices/USB/linux/USBProxyDevice-linux.cpp	(working copy)
@@ -1916,6 +1916,10 @@
     PUSBPROXYDEV pProxyDev = usbProxyFromVusbDev(pUrb->pDev);
 #endif
     PUSBPROXYURBLNX pUrbLnx = (PUSBPROXYURBLNX)pUrb->Dev.pvPrivate;
+    /* I don't know why this happens, but it does! */
+    if (!pUrbLnx)
+        return;
+
     if (pUrbLnx->pSplitHead)
     {
         /* split */
Index: src/VBox/Devices/USB/DevOHCI.cpp
===================================================================
--- src/VBox/Devices/USB/DevOHCI.cpp	(revision 44146)
+++ src/VBox/Devices/USB/DevOHCI.cpp	(working copy)
@@ -3521,6 +3521,27 @@
     pOhci->uFrameRate         = u32FrameRate;
 }
 
+/*
+ * Test every URB in flight to ensure it hasn't been cancelled
+ *
+ * When the guest OS cancels a USB request we must ensure that it is removed from the USB
+ * proxy subsystem immediately.  If this isn't done, the guest OS may submit a new request
+ * while the USB proxy system doesn't realize the old one is canceled.  The old URB will receive
+ * the data for the new request, be subsequently discarded, and the guest USB device driver will
+ * timeout and fail.
+ */
+static int ohciPerformCancellations(POHCI pOhci)
+{
+    unsigned i, cLeft = pOhci->cInFlight;
+    PVUSBURB pUrb;
+    for (i = 0; cLeft && i < RT_ELEMENTS(pOhci->aInFlight); i++)
+        if (pOhci->aInFlight[i].GCPhysTD) {
+            pUrb = pOhci->aInFlight[i].pUrb;
+            if (ohciHasUrbBeenCanceled(pOhci, pUrb, NULL))
+                pOhci->RootHub.pIRhConn->pfnCancelUrbsEp(pOhci->RootHub.pIRhConn, pUrb);
+            cLeft--;
+        }
+}
 
 /**
  * Generate a Start-Of-Frame event, and set a timer for End-Of-Frame.
@@ -3580,6 +3601,8 @@
         return;
     }
 
+    ohciPerformCancellations(pOhci);
+
     /*
      * Periodic EPs.
      */
