NdisSend，自定义数据包发送失败？

做ndis hook的时候，自定义了一个数据包，包结构应该没有问题，填充NDIS_PACKET结构是这样的，
先初始化：    
    NdisAllocatePacketPool(&nStatus, &m_hMyPacketPool, 0xFFF, 0x10);
    NdisAllocateBufferPool(&nStatus, &m_hMyBufferPool, 0x10);
    NdisAllocateMemoryWithTag(&m_pBuffer, MAX_PACKET_SIZE, 'NAMW');
    NdisAllocateBuffer(&nStatus, &m_pMyBuffer, m_hMyBufferPool, m_pBuffer, MAX_PACKET_SIZE);
    NdisAllocatePacket(&nStatus, &m_pMyPacket, m_hMyPacketPool);
    NdisChainBufferAtFront(m_pMyPacket, m_pMyBuffer);
之后在分配的m_pBuffer中填充了一个数据包，再调用
           ((SEND_HANDLER)m_pSend)(NdisBindingHandle, m_pMyPacket);
来发送，结果蓝屏了。


请问高手们我这样做有什么问题吗？

dump文件分析结果：
--------------------------------------------------------------------------------------
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0a13001b, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: fad4293a, address which referenced memory

Debugging Details:
------------------




READ_ADDRESS:  0a13001b

CURRENT_IRQL:  2

FAULTING_IP:
tcpip!MdpFree+1a
fad4293a 0fb6461b        movzx   eax,byte ptr [esi+1Bh]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  svchost.exe

LAST_CONTROL_TRANSFER:  from fad42808 to fad4293a

STACK_TEXT:  
fa31d6d0 fad42808 811e1578 ffb8c008 8121cf30 tcpip!MdpFree+0x1a
fa31d6ec fc31bc1c 8115f410 811e1578 00000000 tcpip!ARPSendComplete+0xdc
fa31d710 fc7fbecb 8115a8c0 8121cf30 00000000 NDIS!ndisMSendCompleteX+0x8d
WARNING: Stack unwind information not available. Following frames may be wrong.
fa31d72c fc7fdedd 0fef0000 8115a8c0 ffb17000 vmxnet+0xecb
fa31d768 fc7fe701 0fef0000 8121cef8 00000103 vmxnet+0x2edd
fa31d77c fc308f86 ffb1700c fa31d7b0 00000001 vmxnet+0x3701
fa31d7a4 fa47aa94 ffb8c008 8121cf30 00000000 NDIS!ndisMSendX+0x1bd
fa31d7b8 fad42d00 ffb8c008 81162df0 8115f410 Bogus!MySend+0x34 [d:\2010\proxy\mybogusprotocol\hookfunc.h @ 198]
fa31d7e0 fad428ce 8115f410 81162df0 ffb6a0f0 tcpip!ARPSendData+0x198
fa31d80c fad4270a 8115f410 fa31d800 00000001 tcpip!ARPTransmit+0x193
fa31d83c fad424a9 810e8240 021aa8c0 81162df0 tcpip!SendIPPacket+0x18e
fa31d988 fad46b83 fad806b4 811be670 81174020 tcpip!IPTransmit+0x287f
fa31da28 fad4694a 812210b0 811be670 ffa67d80 tcpip!UDPSend+0x41b
fa31da4c fad469b0 0031da70 ffa67f00 81174060 tcpip!TdiSendDatagram+0xd5
fa31da84 fad45308 ffa67d80 ffa67e38 ffa67f00 tcpip!UDPSendDatagram+0x4f
fa31daa0 804e47f7 81117af0 ffa67d80 811677c8 tcpip!TCPDispatchInternalDeviceControl+0xff
fa31dab0 fad007f7 fa31db9c 00000008 fa31db10 nt!IopfCallDriver+0x31
fa31db08 facf7bce 0087f244 facf7bce 811677c8 afd!AfdFastDatagramSend+0x2fd
fa31dc50 8057d012 811a9aa0 00000001 0087f114 afd!AfdFastIoDeviceControl+0x2a7
fa31dd00 8057cfa5 00000118 00000144 00000000 nt!IopXxxControlFile+0x261
fa31dd34 804df7ec 00000118 00000144 00000000 nt!NtDeviceIoControlFile+0x2a
fa31dd34 7c92eb94 00000118 00000144 00000000 nt!KiFastCallEntry+0xf8
0087f204 00000000 00000000 00000000 00000000 0x7c92eb94


STACK_COMMAND:  kb

FOLLOWUP_IP:
vmxnet+ecb
fc7fbecb ??              ???

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  vmxnet+ecb

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: vmxnet

IMAGE_NAME:  vmxnet.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4874830c

FAILURE_BUCKET_ID:  0xD1_vmxnet+ecb

BUCKET_ID:  0xD1_vmxnet+ecb

Followup: MachineOwner
----------------------------------------------------------

怎么没人帮我看看啊，郁闷

你有处理SendComplete吗？如果你没Hook SendComplete，把自己的包发给上层，会让上层出错

谢谢楼上，确实是这样的，不过昨天晚上我自己发现这点了。
谢谢了。

兄弟，求解啊。我的dump和你一样。得怎么搞？

……