passthru发送自定义包在NdisSend蓝屏，CODE:0x000000D1

我自定义了一个发送包的函数，在MPSend中调用
        NdisSend(&Status,
                 pAdapt->BindingHandle,
                 MyPacket);
                
        SendPacket(pAdapt);  //在这调用


自定义发送如下：

VOID SendPacket(IN PADAPT padapt)
{
    NDIS_STATUS Status;
    PRSVD Rsvd;
    NDIS_HANDLE BufferPoolHandle;
    PNDIS_PACKET Packet;
    PNDIS_BUFFER PNdisBuf;
    NDIS_PHYSICAL_ADDRESS phy_addr;
    ETHER_HEADER eh;
    PETHER_HEADER PEtherHeader;
    UINT nPacketCount;
    UINT TotalPacketLen;
    PUCHAR Buffer;
    UINT BufLen;
    
    //allocate packet
    NdisDprAllocatePacket(&Status, &Packet, padapt->SendPacketPoolHandle);
    
    //allocate buffer pool
    NdisAllocateBufferPool(&Status, &BufferPoolHandle, 0x10);
    
    if(Status != NDIS_STATUS_SUCCESS)
    {
        NdisDprFreePacket(Packet);
        return;
    }
    phy_addr.HighPart = 0;
    phy_addr.LowPart = -1;
    
    Status = NdisAllocateMemory(&Buffer, sizeof(ETHER_HEADER), 0, phy_addr);
    if(Buffer == NULL)
    {
        NdisFreeBufferPool(BufferPoolHandle);
        NdisDprFreePacket(Packet);
        return;
    }
    
    NdisAllocateBuffer(&Status, &PNdisBuf, BufferPoolHandle, (PVOID)Buffer, sizeof(ETHER_HEADER));
    if(Status != NDIS_STATUS_SUCCESS)
    {
        NdisFreeMemory((PVOID)Buffer, sizeof(ETHER_HEADER), 0);
        NdisFreeBufferPool(BufferPoolHandle);
        NdisDprFreePacket(Packet);
        return;
    }
        
    NdisChainBufferAtFront(Packet, PNdisBuf);
    NdisSetPacketFlags(Packet, NDIS_FLAGS_DONT_LOOPBACK);
    
    PEtherHeader = (PETHER_HEADER)Buffer;
    NdisFillMemory(PEtherHeader->DstMAC, 6, 0xFF);
    PEtherHeader->SrcMAC[0] = 0x00;
    PEtherHeader->SrcMAC[1] = 0x11;
    PEtherHeader->SrcMAC[2] = 0x22;
    PEtherHeader->SrcMAC[3] = 0x33;
    PEtherHeader->SrcMAC[4] = 0x44;
    PEtherHeader->SrcMAC[5] = 0x55;
    PEtherHeader->Type = htons(0x0806);
    
    /*
    NdisQueryPacket(Packet, NULL, &nPacketCount, &PNdisBuf, &TotalPacketLen);
    DbgPrint("nPacketCount: %d, PNdisBuf: %08X, TotalPacketLen: %d.\n", nPacketCount, PNdisBuf, TotalPacketLen);
    NdisQueryBuffer(PNdisBuf, &Buffer, &BufLen);
    PEtherHeader = (PETHER_HEADER)Buffer;
    DbgPrint("length: %d,type: %04X: %02X-%02X-%02X-%02X-%02X-%02X -> %02X-%02X-%02X-%02X-%02X-%02X\n", BufLen, ntohs(PEtherHeader->Type),
                PEtherHeader->SrcMAC[0], PEtherHeader->SrcMAC[1], PEtherHeader->SrcMAC[2], PEtherHeader->SrcMAC[3], PEtherHeader->SrcMAC[4], PEtherHeader->SrcMAC[5],
                PEtherHeader->DstMAC[0], PEtherHeader->DstMAC[1], PEtherHeader->DstMAC[2], PEtherHeader->DstMAC[3], PEtherHeader->DstMAC[4], PEtherHeader->DstMAC[5]);
    */
    
    Packet->Private.Head->Next = NULL;
    Packet->Private.Tail = NULL;
    
    Rsvd = (PRSVD)Packet->ProtocolReserved;
    Rsvd->OriginalPkt = Packet;
    
    NdisSend(&Status, padapt->BindingHandle, Packet);  //调用NdisSend就蓝屏
    if(Status != NDIS_STATUS_PENDING)
    {
        //PtSendComplete(padapt,  Packet, Status);
        NdisUnchainBufferAtFront(Packet, &PNdisBuf);
        NdisFreeMemory((PVOID)Buffer, sizeof(ETHER_HEADER), 0);
        NdisFreeBuffer(PNdisBuf);
        NdisFreeBufferPool(BufferPoolHandle);
        NdisDprFreePacket(Packet);
    }
}

折磨啊～

调试，查看堆栈，看具体错误点