大家都帮忙看看，送40分

我基于论坛上的一个虚拟磁盘源代码，想加入 tdi支持（参考另一位论坛上朋友的代码），但是安装驱动后总是显示缺页错误（softice调试）。
现把一部分代码列出：
// worker thread function
VOID MiniportRequestProcessorWorker(PVOID pContext)
{
// set priority
KeSetPriorityThread(KeGetCurrentThread(),LOW_REALTIME_PRIORITY);
devDebugPrint(DRIVER_NAME\"*******ok\\n\");
PVOID pObject[2] = {&g_evRequestArrival,&g_evShutdown};

PMiniportExt pExt = NULL;
   NTSTATUS status;


devDebugPrint(DRIVER_NAME\"*******begin\\n\");
TA_IP_ADDRESS transAddr;

// 打开本地传输层地址
TuInitTransAddr(&transAddr,  0,htons(5889));
status = TuOpenTransAddr(L\"\\\\Device\\\\Udp\", &transAddr, &pExt->TuLocalAddr);
if ( !NT_SUCCESS(status)) {
KdPrint((\"In VDiskWorkerThrd, Fail to Open Transport Address!\\n\"));
return;
}

// 查询注册表，读取服务器地址和端口
// ...
((UCHAR *)(&pExt->srvAddr))[0] = 10;
((UCHAR *)(&pExt->srvAddr))[1] = 0;
((UCHAR *)(&pExt->srvAddr))[2] = 0;
((UCHAR *)(&pExt->srvAddr))[3] = 8;

pExt->srvPort = htons(5888);
devDebugPrint(DRIVER_NAME\"*******end\\n\");
省去一部分。。。。
}

NTSTATUS
TuInitTransAddr(
IN PTA_IP_ADDRESS pTransAddr,
IN unsigned long  ipAddr, // Network Byte Order
IN unsigned short port // Network Byte Order
)
{
RtlZeroMemory( pTransAddr, sizeof(TA_IP_ADDRESS));

pTransAddr->TAAddressCount = 1; // only 1 address
pTransAddr->Address[0].AddressLength = TDI_ADDRESS_LENGTH_IP; // sizeof(TDI_ADDRESS_IP) = 14
pTransAddr->Address[0].AddressType = TDI_ADDRESS_TYPE_IP; // (USHORT)2
pTransAddr->Address[0].Address[0].in_addr = ipAddr;
pTransAddr->Address[0].Address[0].sin_port = port;

return STATUS_SUCCESS;
}


NTSTATUS
TuOpenTransAddr(
PWSTR strTransDevName, // device name
PTA_IP_ADDRESS pTransAddr, // pointer to initialized TA_IP_ADDRESS
PTU_ADDRESS pTuAddr // pointer to zeroed TU_ADDRESS
)
{
NTSTATUS status;

PFILE_FULL_EA_INFORMATION pTransAddrEa;
unsigned long transAddrEaLen;

UNICODE_STRING transDevName;
OBJECT_ATTRIBUTES objAttr;
IO_STATUS_BLOCK ioStatBlk;

// init reference count.
pTuAddr->refCount = 1;

// 1st, build extended attribute ...
status = _TuBuildEaBuffer(
TDI_TRANSPORT_ADDRESS_LENGTH, // EaName Length, sizeof(TdiTransportAddress) - 1
TdiTransportAddress,           // EaName, \"TransportAddress\"
sizeof( TA_IP_ADDRESS), // EaValue Length
pTransAddr, // EaValue
&pTransAddrEa,
&transAddrEaLen
);
if ( !NT_SUCCESS(status)) {
KdPrint((\"TuOpenTransAddrUdp(): TuBuildEaBuffer error!\\n\"));
return status;
}

//
// 2nd, initialize file object attribute, and i think that
// \"strTransDevName\" is the so-called \'transport-to-NIC\' bind.
//
RtlInitUnicodeString(&transDevName, strTransDevName);
InitializeObjectAttributes(
&objAttr, // OBJECT_ATTRIBUTES instance
&transDevName, // Transport Device Name
OBJ_CASE_INSENSITIVE,   // Attributes
NULL,                   // RootDirectory
NULL                     // SecurityDescriptor
     );

// 3rd, create file ...
status = ZwCreateFile(
&pTuAddr->hAddr, // file handle
GENERIC_READ |GENERIC_WRITE | SYNCHRONIZE, // desired access
&objAttr, // object attribute
&ioStatBlk, // io status block
0, // allocation size
FILE_ATTRIBUTE_NORMAL, // normal attribute
0, // execlusive access
FILE_OPEN_IF, // if file exists, open it. else fail
0, // create options
(PVOID)pTransAddrEa, // extra buffer
transAddrEaLen // extra buffer length
);
if ( !NT_SUCCESS(status)) {
KdPrint((\"TuOpenTransAddrUdp(): ZwCreateFile error\"));
return status;
}

// free ea buffer ...
ExFreePool(pTransAddrEa);

//
// now, we have own the file handle to the opened transport address, then we
// can use the handle to own the pointer the file object of the transport
// address with ObReferenceObjectByHandle.
//
status = ObReferenceObjectByHandle(
pTuAddr->hAddr, // object handle
FILE_ANY_ACCESS, // desired access
NULL, // object type, can be null in kernel driver
KernelMode, // access mode, be KernelMode
(PVOID)(&(pTuAddr->pFileObj)), // pointer to the object
NULL // handle information
);
if ( !NT_SUCCESS(status)) {
KdPrint((\"TuOpenTransAddrUdp(): ObReferenceObjectByHandle error!\"));
return status;
}

//
// given a file object, return a pointer to the corresponding device object.
// from here, i can use TdiBuildXxx to build IRP and send it to transport
// driver with IoCallDriver.
//
pTuAddr->pDevObj = IoGetRelatedDeviceObject( pTuAddr->pFileObj);

return STATUS_SUCCESS;
}