高手帮忙！NdisSend重启

前面的都分配好了，一到这里就重启了？
NDIS_STATUS aStat = NDIS_STATUS_SUCCESS;
NTSTATUS NtStatus = STATUS_SUCCESS;
ULONG BytesReturned = 0;

PADAPT MyAdpt; //适配器
pMFrm pFrame; //自定义的帧
PNDIS_PACKET aPacketP; //发送的数据包
PNDIS_PACKET TPacket;
UINT aBufferLen;
PVOID aBufferP;
PNDIS_BUFFER anNdisBufferP;

PWCHAR pNameBuffer; //要调用的适配器名称
SHORT NameBufferLength;

PUCHAR TBuffer;
UINT PacketLen;

DBGPRINT(("==>IMSendBuffer \n"));

__try
{

if (inputBufferLength<40)
{
DBGPRINT(("Droped:Too Small Packet"));
NtStatus = STATUS_PENDING;
return NtStatus;
}


pNameBuffer = L"\\DEVICE\\{2F5BA0E2-F01B-4DE7-AE96-2DC192724324}";
NameBufferLength = 92;

//通过名称找到指定的Adapter
MyAdpt = IMLookupAdapterByName((PUCHAR)pNameBuffer,NameBufferLength,FALSE);

if(MyAdpt == NULL)
{
DBGPRINT(("Can not find adapter!\n"));
return NtStatus;
}
else
DBGPRINT(("Myadpt LV name:%ws\n",MyAdpt->LowerDeviceName.Buffer));

//Locked
KeAcquireSpinLock(&GlobalArraySpinLock, &gIrqL);
//NdisAcquireSpinLock( &GlobalLock );

if ( MyPacketPool == NULL)
{
DBGPRINT(("MyPacketPool is null!\n"));
goto Done;
}
NdisAllocatePacket( &aStat,
&aPacketP,
MyPacketPool
);
DBGPRINT(("IMSend:NdisAllocatePacket Complete"));
if(NDIS_STATUS_SUCCESS == aStat)
{
if (MyBufferPool == NULL)
{
DBGPRINT(("MyBufferPool is null!\n"));
//return NtStatus;
}
//分配内存
NdisAllocateMemory( &aBufferP,
inputBufferLength,
0,
HighestAcceptableMax );
//复制地址
memcpy( aBufferP, (PVOID)InputBuffer, inputBufferLength);
__try
{
NdisAllocateBuffer(&aStat,
&anNdisBufferP,
MyBufferPool,//gOIns->mBufferPoolH,
aBufferP,
inputBufferLength
);
}
__except(EXCEPTION_EXECUTE_HANDLER)
{
DBGPRINT(("NdisAllocateBuffer occured Unknown error!\n"));
}
if(NDIS_STATUS_SUCCESS == aStat)
{
DBGPRINT(("IMSend:NdisAllocateBuffer Complete"));
NdisChainBufferAtFront(aPacketP, anNdisBufferP); //将内存地址与包关联

aStat = NdisAllocateMemory(&TBuffer, BUFFER_SIZE, 0, HighestAcceptableMax);
IMCopyPacket2Buffer(aPacketP,TBuffer,&PacketLen);

pFrame = (pMFrm)TBuffer;
DBGPRINT(("Data:%s\n",(char*)(pFrame->DataBuffer)));

if (MyAdpt->BindingHandle == NULL)
{
DBGPRINT(("MyAdpt->BindingHandle is null!\n"));
goto Done;
}
__try
{
NdisSend(&aStat,MyAdpt->BindingHandle,aPacketP); //发送数据包 到这里重启！

}
__except(EXCEPTION_EXECUTE_HANDLER)
{
DbgPrint("NdisSend error\n");
}
if (aStat != NDIS_STATUS_PENDING)
{

DBGPRINT(("IMSend:NdisSend Complete"));
}
}
//Release Buffer
if(anNdisBufferP)
{

if(aBufferP)
{
NdisFreeMemory( aBufferP,
inputBufferLength,
0 );
}
NdisFreeBuffer(anNdisBufferP);
}
}
DBGPRINT(("<==IMSendBuffer\n"));
goto Done;
}
__except(EXCEPTION_EXECUTE_HANDLER)
{
DbgPrint("Exception occured, Unknown error\n");
}
Done:
//UnLocked
KeReleaseSpinLock(&GlobalArraySpinLock, gIrqL);
return NtStatus;

IMCopyPacket2Buffer 在哪儿定义的？
你怎么判断在你说的那句出错的，迸softice了？还是没有输出了？

如果把那句注释掉就会通过了

IMCopyPacket2Buffer 具体怎么实现得？

这个函数没啥用，就是取得包的内容
void IMCopyPacket2Buffer(IN PNDIS_PACKET pPacket,IN OUT PUCHAR pBuff,IN OUT PUINT pLength)
{
    PNDIS_BUFFER BuffDT;
    PUCHAR BuffVA;
    UINT BuffLen;

    *pLength=0;
    BuffLen=0;

    NdisQueryPacket(pPacket,NULL,NULL,&BuffDT,NULL);

    while(BuffDT!=(PNDIS_BUFFER)NULL)
    {
        NdisQueryBuffer(BuffDT,&BuffVA,&BuffLen);
        NdisMoveMemory(pBuff,BuffVA,BuffLen);
        pBuff=pBuff+BuffLen;
        *pLength+=BuffLen;
        NdisGetNextBuffer(BuffDT,&BuffDT);
    }
    return;
}

我刚改好了 类似这样的程序
应该是 complete 函数没处理好
需要在 那个函数中释放 分配的资源 并且通知上层 释放改包

而你包是在 中间层分配的 你通知上层 释放 这样就蓝屏了