遇到ATTEMPTED_SWITCH_FROM_DPC系统崩溃原因，求帮助

弄了好长时间的USB虚拟网卡驱动，在网驱好心人的帮助下，今天终于可以发包了。
再次谢谢他们。

但好景不常，驱动在运行过程中出现ATTEMPTED_SWITCH_FROM_DPC错误，纳闷不知为什么。
驱动程序中没有用到定时器，也没用DPC例程。。。。。

下面是Crash的原因，但看不懂，希望帮我一下。
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

ATTEMPTED_SWITCH_FROM_DPC (b8)
A wait operation, attach process, or yield was attempted from a DPC routine.
This is an illegal operation and the stack track will lead to the offending
code and original DPC routine.
Arguments:
Arg1: 00000000, Original thread which is the cause of the failure
Arg2: 00000000, New thread
Arg3: 00000000, Stack address of the original thread
Arg4: 00000000

Debugging Details:

MODULE_NAME: USB_NET

FAULTING_MODULE: 804d8000 nt

DEBUG_FLR_IMAGE_TIMESTAMP:  48f88d04

DEFAULT_BUCKET_ID:  WRONG_SYMBOLS

BUGCHECK_STR:  0xB8

LAST_CONTROL_TRANSFER:  from 80534146 to 804e4592

STACK_TEXT:  
WARNING: Stack unwind information not available. Following frames may be wrong.
fbc32864 80534146 00000003 811ba020 812aa518 nt!DbgBreakPointWithStatus+0x4
fbc32c44 80534709 000000b8 00000000 00000000 nt!KeDeregisterBugCheckReasonCallback+0x6c7
fbc32c64 804dca7a 000000b8 ffffffff 00000202 nt!KeBugCheck+0x14
fbc32cbc fbaf84ce 00000000 00000000 00000000 nt!KiDispatchInterrupt+0x206
fbc32ce0 fbaf49b3 00000000 ffb505e0 00000000 USB_NET!USB_NETMySend+0xa8 [c:\usb_net\driver\usb_net.c @ 1134]
fbc32d14 fb647f86 ffb505e0 fbc32d48 00000001 USB_NET!USB_NETSendPackets+0x116 [c:\usb_net\driver\send.c @ 253]
fbc32d3c fb4fb528 811477e0 ffb2ef30 ffb2eef8 NDIS!ndisMSendX+0x1bd
fbc32d78 fb645985 ffb377c0 ffb2ef30 00000000 psched!MpSend+0x706
fbc32da0 fa08c4e2 ffb2ce38 ffb2ef30 00000000 NDIS!ndisMSendX+0x1d6
fbc32dbc fa08ca66 ffb35878 ffb2ef30 8113d04e tcpip!ARPRcv+0x502f
fbc32e1c fa09511f 0eb35878 dea1fea9 00000001 tcpip!ARPRcv+0x55b3
fbc32e78 fbb2b3ff ffb358f8 02b35878 fbc32fa4 tcpip!ARPRcv+0xdc6c
fbc32e88 804dd4fd ffb35908 ffb358f8 6ecb00fc TDI!CTEpTimerHandler+0xf
fbc32fa4 804dd378 806ef732 00000000 ffdff000 nt!KeSetTimer+0x113
fbc32fd0 804dcbd4 8055a680 00000000 00004385 nt!KeWaitForMutexObject+0x1d8
fbc32ff4 804dc89e f9f44cdc 00000000 00000000 nt!KiDispatchInterrupt+0x360
00000000 00000000 00000000 00000000 00000000 nt!KiDispatchInterrupt+0x2a


STACK_COMMAND:  kb

FOLLOWUP_IP:
USB_NET!USB_NETMySend+a8 [c:\usb_net\driver\usb_net.c @ 1134]
fbaf84ce 8b15c896affb    mov     edx,dword ptr [USB_NET!USB_NET_SEND+0x8 (fbaf96c8)]

FAULTING_SOURCE_CODE:  
  1130:                 KernelMode,
  1131:                 FALSE,
  1132:                 NULL
  1133:                 );
> 1134:         IoFreeMdl(USB_NET_SEND.pSendMdl);
  1135:         RemoveHeadList(&adapter->SendQueue);
  1136:         NdisMSendComplete(adapter->AdapterHandle,packet,NDIS_STATUS_SUCCESS);//¡Á¡ä¨¬?3¨¦1|
  1137:         IoReuseIrp(USB_NET_SEND.pSendIrp,STATUS_SUCCESS);
  1138:         KeResetEvent(USB_NET_SEND.pEvent);
  1139:     }


SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  USB_NET!USB_NETMySend+a8

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  USB_NET.sys

BUCKET_ID:  WRONG_SYMBOLS

Followup: MachineOwner
---------

下面的代码是被miniportSendPackets调用的，且使用了等待事件。望指教
VOID   USB_NETMySend(IN PVOID  SystemSpecific1,
    IN PVOID  FunctionContext,
    IN PVOID  SystemSpecific2,
    IN PVOID  SystemSpecific3
    )
{
    
    
    PUSB_NET_ADAPTER adapter=(PUSB_NET_ADAPTER)FunctionContext;
    PNDIS_PACKET packet;
    USB_NETDebugPrint(DBG_IO, DBG_TRACE, __FUNCTION__"Enter");
    USB_NETDebugPrint(DBG_IO, DBG_NONE, __FUNCTION__"++");
    //NdisAcquireSpinLock(&adapter->SendLock);
    while(!IsListEmpty(&adapter->SendQueue))
    {
        packet=(PNDIS_PACKET)((PCHAR)adapter->SendQueue.Flink - sizeof(NDIS_PACKET_PRIVATE));//取得包的地址
        adapter->SendMyAttr.pSendMdl = BuildSendMdl(packet,adapter->SendMyAttr.pSendBuffer);
        adapter->SendMyAttr.pSendIrp->MdlAddress=adapter->SendMyAttr.pSendMdl;
        USB_NETPipe2Io(adapter,adapter->SendMyAttr.pSendIrp,&(adapter->InterfaceInformation->Pipes[1]));
        
        KeWaitForSingleObject(
                adapter->SendMyAttr.pEvent,
                Executive,
                KernelMode,
                FALSE,
                NULL
                );
        IoFreeMdl(adapter->SendMyAttr.pSendMdl);
        RemoveHeadList(&adapter->SendQueue);
        NdisMSendComplete(adapter->AdapterHandle,packet,NDIS_STATUS_SUCCESS);//状态成功
        IoReuseIrp(adapter->SendMyAttr.pSendIrp,STATUS_SUCCESS);
        KeResetEvent(adapter->SendMyAttr.pEvent);
    }
    //NdisReleaseSpinLock(&adapter->SendLock);
    
    USB_NETDebugPrint(DBG_IO, DBG_TRACE, __FUNCTION__"Exit");
}

一下子不能确定问题在哪儿，
但请首先检查BuildSendMdl之后和IoFreeMdl之前pSendMdl是否为Null，
没有任何异常处理还是挺危险的，：）

已经解决了，是在IRQL2级调用长时等待函数了