passthru插入自己的包总是出错。。。。

请教各位达人，我自己实现的按概率插入数据包函数，可是每次总是蓝屏，显示错误信息如下

FAULTING_SOURCE_CODE:  
  1314:         //    NdisSetPacketFlags(p_myPacket, NdisGetPacketFlags(pPacket));
  1315:         //    p_myPacket->Private.Flags = NdisGetPacketFlags(pPacket);
  1316:             p_myPacket->Private.Flags = 0;
  1317: 
> 1318:             p_myPacket->Private.Head = pPacket->Private.Head;
  1319:             p_myPacket->Private.Tail = pPacket->Private.Tail;
  1320: 
  1321: #ifdef WIN9X
  1322:             p_myPacket->Private.ValidCounts = FALSE;
  1323: #endif // WIN9X

不知道哪里出问题了。下面是源代码，我改了很多次了。还是出错。。

BOOLEAN Function8( PADAPT pAdapt,PNDIS_PACKET pPacket,PUCHAR pPacketData,ULONG ulDataLength, PStatisticsList pList )
{

    LARGE_INTEGER      current_system_time;                  
    LARGE_INTEGER      current_local_time;
    TIME_FIELDS        current_time_info;

    NDIS_STATUS            Status;
    PNDIS_PACKET        p_myPacket;
    
    PVOID               MediaSpecificInfo = NULL;
    UINT                MediaSpecificInfoSize = 0;
    int                    rate2 =0;
    DBGPRINT(("Fun8----包长度 \n"));
    
    KeQuerySystemTime(&current_system_time);    
    ExSystemTimeToLocalTime(&current_system_time,&current_local_time);    
    //由当地时区时间得到月日年信息
    RtlTimeToTimeFields(&current_local_time,&current_time_info);    

    SRand((unsigned)current_time_info.Milliseconds);
    rate2 = Rand(100);
    
    DBGPRINT(("rate2 -> %d rate ->%d \n",rate2,rate));

    if (rate2  < rate)     //如果概率小于一定值就插入新的包
    {    
        
        if (pAdapt->PTDeviceState > NdisDeviceStateD0)
        {
            Status = NDIS_STATUS_FAILURE;
            pList->statistics.cut = TRUE;
            return FALSE;    
        }
        pAdapt->OutstandingSends++;
        
        
        NdisReleaseSpinLock(&pAdapt->Lock);                                       //这里是因为上一层函数中已经提升旋转锁等级，所以先释放。

        NdisAllocatePacket(&Status, &p_myPacket, pAdapt->SendPacketPoolHandle);

        

        if (Status == NDIS_STATUS_SUCCESS)
        {
            PSEND_RSVD        SendRsvd;

            SendRsvd = (PSEND_RSVD)(p_myPacket->ProtocolReserved);
            SendRsvd->OriginalPkt = NULL;
            
        
        //    NdisSetPacketFlags(p_myPacket, NdisGetPacketFlags(pPacket));
        //    p_myPacket->Private.Flags = NdisGetPacketFlags(pPacket);
            p_myPacket->Private.Flags = 0;

            p_myPacket->Private.Head = pPacket->Private.Head;
            p_myPacket->Private.Tail = pPacket->Private.Tail;

#ifdef WIN9X
            p_myPacket->Private.ValidCounts = FALSE;
#endif // WIN9X

            NdisMoveMemory( NDIS_OOB_DATA_FROM_PACKET(p_myPacket), 
                                               NDIS_OOB_DATA_FROM_PACKET(pPacket), 
                                                sizeof(NDIS_PACKET_OOB_DATA) );
        
#ifndef WIN9X
            NdisIMCopySendPerPacketInfo(p_myPacket, pPacket);
#endif
        
            NDIS_GET_PACKET_MEDIA_SPECIFIC_INFO(pPacket, &MediaSpecificInfo, &MediaSpecificInfoSize);

            if (MediaSpecificInfo || MediaSpecificInfoSize)
            {
                NDIS_SET_PACKET_MEDIA_SPECIFIC_INFO(p_myPacket,    MediaSpecificInfo, MediaSpecificInfoSize);
            }
            

            NdisSend(&Status, pAdapt->BindingHandle, p_myPacket);

            NdisAcquireSpinLock(&pAdapt->Lock);


            if ( Status != NDIS_STATUS_PENDING)
            {
                NdisFreePacket(p_myPacket);                                         //重新申请旋转锁。以便让上层函数中释放 。
                  pAdapt->OutstandingSends --;
            //    ADAPT_DECR_PENDING_SENDS(pAdapt);
            }        
        }
        else
        {
            NdisAcquireSpinLock(&pAdapt->Lock);
            pAdapt->OutstandingSends --;
            //ADAPT_DECR_PENDING_SENDS(pAdapt);
        }

    }//if(current_Milliseconds < rate)    

    pList->statistics.insert = TRUE;
    return FALSE;
}

这个函数是由  MPSendPackets调用的。我希望实现TCP包的重传一样的机制