那位大侠帮我看看我的PtReceive 为什么老是蓝屏

NDIS_STATUS
PtReceive(
IN  NDIS_HANDLE ProtocolBindingContext,
IN  NDIS_HANDLE MacReceiveContext,
IN  PVOID HeaderBuffer,
IN  UINT HeaderBufferSize,
IN  PVOID LookAheadBuffer,
IN  UINT LookAheadBufferSize,
IN  UINT PacketSize
)
{
PADAPT pAdapt =(PADAPT)ProtocolBindingContext;
PNDIS_PACKET MyPacket, Packet;
NDIS_STATUS Status = NDIS_STATUS_SUCCESS;

// [2004年5月21日9时15分]
//PNDIS_PACKET        pMyPacket;
BOOLEAN             Remaining;

ULONG               MACAddrComp,                  // ja, 17.08.2003.
ulEncPayload,
ulUnencPayload;

#define             szPayloadCopy ETH_MAX_PACKET_SIZE
char                PayloadCopy[szPayloadCopy];
pEthHdr             pETH;
PUCHAR              pCurr,
pEnd,
pUnencPayload = NULL;

if(!pAdapt->MiniportHandle)
{
return NDIS_STATUS_FAILURE;
}
else
{
if(pAdapt->isSecondary)
{
DBGPRINT(\"PASSTHRU GETTING RECIEVES ON SECONDARY\\n\");
ASSERT(0);
}

Packet = NdisGetReceivedPacket(pAdapt->BindingHandle, MacReceiveContext);

if(Packet != NULL)
{
DbgPrint(\"==> Passthru Protocol PtReceive RePacket...\\n\");


// [2004年5月21日9时16分]
// ja, 17.08.2003.

GetPktPayload(Packet,                            // Copy payload
PayloadCopy,                        //   to area.
szPayloadCopy,                      // Amount of space in area.
&ulEncPayload                       // Return number of bytes in packet.
);

pETH = (pEthHdr)PayloadCopy;


switch(NDIS_GET_PACKET_PROTOCOL_TYPE(Packet))
{
case NDIS_PROTOCOL_ID_DEFAULT:

DbgPrint((\"Receive DEFAULT packet\\n\"));


Status =                                             // Allocate nonpaged storage for new, unencapsulated payload.
NdisAllocateMemoryWithTag(&pUnencPayload,
ulEncPayload,
TAG
);

if (NDIS_STATUS_SUCCESS!=Status)
{
DbgPrint(\"PtReceive():  Failed to allocate memory for payload, status = 0x%08x\\n\", Status);

ASSERT(0);
return(0);

}
memcpy(pUnencPayload,                              // Copy original payload to area for new payload.
PayloadCopy,
ulEncPayload
);

break;
case NDIS_PROTOCOL_ID_TCP_IP :
{

DbgPrint(\"Receive TCP/IP packet\\n\");

Status = PtBuildOrigPkt(                     // Get original, unencapsulated payload.
PayloadCopy,
&pUnencPayload,
&ulUnencPayload
);

if (NDIS_STATUS_SUCCESS!=Status)             // A problem?
{
DbgPrint(\"PtReceive():  Status from PtBuildOrigPkt() = 0x%08x\\n\", Status);
ASSERT(0);
}
if (NULL==pUnencPayload)                          // Don\'t have unencapsulated payload?
{

#ifdef NDIS51
//
// Check if we can reuse the same packet for indicating up.
// See also: PtReceive().
//
(VOID)NdisIMGetCurrentPacketStack(pPacket, &Remaining);
if (Remaining)
{
//
// We can reuse \"Packet\". Indicate it up and be done with it.
//
Status = NDIS_GET_PACKET_STATUS(pPacket);
NdisMIndicateReceivePacket(pAdapt->MiniportHandle, &pPacket, 1);
return((Status != NDIS_STATUS_RESOURCES) ? 1 : 0);
}
#endif // NDIS51

}


}
break;
case NDIS_PROTOCOL_ID_IPX :

DbgPrint(\"Receive IPX packet\\n\");
// pUnencPayload=PayloadCopy;
// ulUnencPayload=ulEncPayload;

break;
case NDIS_PROTOCOL_ID_NBF :

DbgPrint(\"Receive NBF packet\\n\");
// pUnencPayload=PayloadCopy;
// ulUnencPayload=ulEncPayload;

break;
default:

DbgPrint(\"Receive UNKNOWN packet\\n\");
// 如果是没有明确指出要处理的包，就不处理。[2004年5月18日9时05分]
// pUnencPayload=PayloadCopy;
// ulUnencPayload=ulEncPayload;

break;
}


// [2004年5月21日9时18分]
// NdisAllocatePacket( &Status,&MyPacket,pAdapt->RecvPacketPoolHandle);

NdisDprAllocatePacket(&Status,&MyPacket, pAdapt->RecvPacketPoolHandle);

if(Status == NDIS_STATUS_SUCCESS)
{
PNDIS_BUFFER pNewNdisBfr;
PRSVD Resvd;

Resvd =(PRSVD)(MyPacket->MiniportReserved);
Resvd->OriginalPkt = Packet;

MyPacket->Private.Head = Packet->Private.Head;
MyPacket->Private.Tail = Packet->Private.Tail;

if (NULL!=pUnencPayload)                      // Have unencapsulated payload?
{

NdisAllocateBuffer( &Status,                // Build new buffer descriptor.
&pNewNdisBfr,
pAdapt->RecvPacketPoolHandle,
pUnencPayload,
ulUnencPayload
);

if (NDIS_STATUS_SUCCESS!=Status)
{
DbgPrint(\"PtReceive() failed to get a buffer, status = 0x%08x\\n\", Status);
ASSERT(0);

// Do something!
}

NdisChainBufferAtFront( MyPacket,          // Chain new buffer descriptor to new packet.
pNewNdisBfr
);

}
else
{
MyPacket->Private.Head = Packet->Private.Head;
MyPacket->Private.Tail = Packet->Private.Tail;
}

NDIS_SET_ORIGINAL_PACKET(MyPacket, NDIS_GET_ORIGINAL_PACKET(Packet));
NDIS_SET_PACKET_HEADER_SIZE(MyPacket,NDIS_GET_PACKET_HEADER_SIZE(Packet));

NdisGetPacketFlags(MyPacket) = NdisGetPacketFlags(Packet);

//NDIS_SET_PACKET_STATUS(MyPacket, NDIS_STATUS_RESOURCES);

Status = NDIS_GET_PACKET_STATUS(Packet);

NDIS_SET_PACKET_STATUS(MyPacket, Status);

NdisMIndicateReceivePacket(pAdapt->MiniportHandle, &MyPacket, 1);

//ASSERT(NDIS_GET_PACKET_STATUS(MyPacket) == NDIS_STATUS_RESOURCES)
if (Status == NDIS_STATUS_RESOURCES)
{
if (NULL!=pUnencPayload)                  // Have unencapsulated payload?
{
NdisFreeBuffer(pNewNdisBfr);           // Recycle buffer descriptor.                              

//就是这里要蓝屏
NdisFreeMemory(pUnencPayload,          // Recycle memory.
ulUnencPayload,
0
);

pUnencPayload = NULL;
}

//
// Our ReturnPackets handler will not be called for this packet.
// We should reclaim it right here.
//
NdisDprFreePacket(MyPacket);
}

return((Status != NDIS_STATUS_RESOURCES) ? 1 : 0);
//PrintPacket(MyPacket);

//NdisDprFreePacket(MyPacket);
    //DBGPRINT(\"<== Passthru Protocol PtReceive RePacket Success...\\n\");
}
else
{
if (NULL!=pUnencPayload)                      // Have unencapsulated payload?
NdisFreeMemory(pUnencPayload,               // Recycle memory.
ulUnencPayload,
0
);

//
// We are out of packets. Silently drop it.
//
return(0);
}
}

}

//DBGPRINT(\"<== Passthru Protocol PtReceive\\n\");

return Status;

}

只有case NDIS_PROTOCOL_ID_DEFAULT:时pUnencPayload才被分配，而
NdisFreeMemory(pUnencPayload,。。。却总被执行。释放一块不存在的内存会有什么结果呢。

把ptRecivedPacket 也修该和ptRecive一样试试。