diff -BurN qemu.orig/slirp/libslirp.h qemu/slirp/libslirp.h
--- qemu.orig/slirp/libslirp.h	2006-05-01 16:05:27.000000000 +0000
+++ qemu/slirp/libslirp.h	2006-05-02 17:27:59.000000000 +0000
@@ -13,6 +13,8 @@
 extern "C" {
 #endif
 
+#include "ctl.h"
+
 void slirp_init(void);
 
 void slirp_select_fill(int *pnfds, 
@@ -33,6 +35,8 @@
 
 extern const char *tftp_prefix;
 extern char slirp_hostname[33];
+extern struct in_addr special_addr;
+extern struct in_addr alias_addr;
 
 #ifdef __cplusplus
 }
diff -BurN qemu.orig/slirp/main.h qemu/slirp/main.h
--- qemu.orig/slirp/main.h	2006-05-02 17:27:34.000000000 +0000
+++ qemu/slirp/main.h	2006-05-02 17:27:59.000000000 +0000
@@ -33,8 +33,6 @@
 extern u_int curtime;
 extern fd_set *global_readfds, *global_writefds, *global_xfds;
 extern struct in_addr ctl_addr;
-extern struct in_addr special_addr;
-extern struct in_addr alias_addr;
 extern struct in_addr our_addr;
 extern struct in_addr loopback_addr;
 extern struct in_addr dns_addr;
diff -BurN qemu.orig/slirp/slirp.c qemu/slirp/slirp.c
--- qemu.orig/slirp/slirp.c	2006-05-02 17:27:34.000000000 +0000
+++ qemu/slirp/slirp.c	2006-05-02 17:27:59.000000000 +0000
@@ -155,8 +155,6 @@
         fprintf (stderr, "Warning: No DNS servers found\n");
     }
 
-    inet_aton(CTL_SPECIAL, &special_addr);
-    alias_addr.s_addr = special_addr.s_addr | htonl(CTL_ALIAS);
     getouraddr();
 }
 
diff -BurN qemu.orig/vl.c qemu/vl.c
--- qemu.orig/vl.c	2006-05-01 16:05:27.000000000 +0000
+++ qemu/vl.c	2006-05-02 17:28:44.000000000 +0000
@@ -2400,7 +2400,7 @@
     if (get_str_sep(buf, sizeof(buf), &p, ':') < 0)
         goto fail;
     if (buf[0] == '\0') {
-        pstrcpy(buf, sizeof(buf), "10.0.2.15");
+        pstrcpy(buf, sizeof(buf), CTL_LOCAL);
     }
     if (!inet_aton(buf, &guest_addr))
         goto fail;
@@ -3170,6 +3170,22 @@
     } else
 #ifdef CONFIG_SLIRP
     if (!strcmp(device, "user")) {
+        if (get_param_value(buf, sizeof(buf), "subnet", p)) {
+            char *len;
+            len = strchr(buf, 0) - 3;
+            if (len < buf || strcmp(len, "/24")) {
+                fprintf(stderr, "qemu: invalid subnet=%s (mask must be /24)\n", buf);
+                return -1;
+            }              
+            *len = 0;
+        } else {
+            pstrcpy(buf, sizeof(buf), CTL_SPECIAL);
+        }
+        if (!inet_aton(buf, &special_addr) || (ntohl(special_addr.s_addr) & 0xff)) {
+            fprintf(stderr, "qemu: invalid subnet=%s\n", buf);
+            return -1;
+        }
+        alias_addr.s_addr = special_addr.s_addr | htonl(CTL_ALIAS);
         if (get_param_value(buf, sizeof(buf), "hostname", p)) {
             pstrcpy(slirp_hostname, sizeof(slirp_hostname), buf);
         }
@@ -4628,9 +4644,9 @@
            "-net nic[,vlan=n][,macaddr=addr][,model=type]\n"
            "                create a new Network Interface Card and connect it to VLAN 'n'\n"
 #ifdef CONFIG_SLIRP
-           "-net user[,vlan=n][,hostname=host]\n"
-           "                connect the user mode network stack to VLAN 'n' and send\n"
-           "                hostname 'host' to DHCP clients\n"
+           "-net user[,vlan=n][,hostname=host][,subnet=addr/24]\n"
+           "                connect the user mode network stack to VLAN 'n'; send\n"
+           "                hostname 'host' to DHCP clients; use subnet addr\n"
 #endif
 #ifdef _WIN32
            "-net tap[,vlan=n],ifname=name\n"