diff --git a/hw/hw.h b/hw/hw.h
index 531031dc1f..4260e039e7 100644
--- a/hw/hw.h
+++ b/hw/hw.h
@@ -285,9 +285,10 @@ enum VMStateFlags {
     VMS_POINTER          = 0x002,
     VMS_ARRAY            = 0x004,
     VMS_STRUCT           = 0x008,
-    VMS_VARRAY_INT32     = 0x010,  /* Array with size in another field */
+    VMS_VARRAY_INT32     = 0x010,  /* Array with size in int32_t field*/
     VMS_BUFFER           = 0x020,  /* static sized buffer */
     VMS_ARRAY_OF_POINTER = 0x040,
+    VMS_VARRAY_UINT16    = 0x080,  /* Array with size in uint16_t field */
 };
 
 typedef struct {
@@ -411,6 +412,16 @@ extern const VMStateInfo vmstate_info_buffer;
     .offset     = vmstate_offset_pointer(_state, _field, _type),     \
 }
 
+#define VMSTATE_VARRAY_UINT16_UNSAFE(_field, _state, _field_num, _version, _info, _type) {\
+    .name       = (stringify(_field)),                               \
+    .version_id = (_version),                                        \
+    .num_offset = vmstate_offset_value(_state, _field_num, uint16_t),\
+    .info       = &(_info),                                          \
+    .size       = sizeof(_type),                                     \
+    .flags      = VMS_VARRAY_UINT16,                                 \
+    .offset     = offsetof(_state, _field),                          \
+}
+
 #define VMSTATE_STRUCT(_field, _state, _version, _vmsd, _type) {     \
     .name       = (stringify(_field)),                               \
     .version_id = (_version),                                        \
diff --git a/savevm.c b/savevm.c
index f82a6e65d7..cbb60f3a29 100644
--- a/savevm.c
+++ b/savevm.c
@@ -1100,6 +1100,8 @@ int vmstate_load_state(QEMUFile *f, const VMStateDescription *vmsd,
                 n_elems = field->num;
             } else if (field->flags & VMS_VARRAY_INT32) {
                 n_elems = *(int32_t *)(opaque+field->num_offset);
+            } else if (field->flags & VMS_VARRAY_UINT16) {
+                n_elems = *(uint16_t *)(opaque+field->num_offset);
             }
             if (field->flags & VMS_POINTER) {
                 base_addr = *(void **)base_addr;
@@ -1147,6 +1149,8 @@ void vmstate_save_state(QEMUFile *f, const VMStateDescription *vmsd,
                 n_elems = field->num;
             } else if (field->flags & VMS_VARRAY_INT32) {
                 n_elems = *(int32_t *)(opaque+field->num_offset);
+            } else if (field->flags & VMS_VARRAY_UINT16) {
+                n_elems = *(uint16_t *)(opaque+field->num_offset);
             }
             if (field->flags & VMS_POINTER) {
                 base_addr = *(void **)base_addr;