The net_checksum_calculate function in net/checksum.c in QEMU allows guest OS users to cause a denial of service (out-of-bounds heap read and crash) via the payload length in a crafted packet. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2857
