在packet中构造arp包发送失败的问题

如下：我在packet协议驱动程序中的packetwrite例程中自己构造arp包并试图发送出去，
但是执行到NdisSend()函数的时候就系统重启，并提示DRIVER_IRQL_NOT_LESS_OR_EQUAL,
请大家帮我找一找失败的原因。谢谢。


NTSTATUS
PacketWrite(
    IN PDEVICE_OBJECT DeviceObject,
    IN PIRP Irp
    )


{
    POPEN_INSTANCE      open;
    PNDIS_PACKET        pPacket;
    NDIS_STATUS         Status;


PNDIS_PACKET MyPacket;
PNDIS_BUFFER pNdis_ARP;
UINT         uBufferSize;
PUCHAR       pMemory;  


    DebugPrint((\"SendAdapter\\n\"));


    open = DeviceObject->DeviceExtension;

    IoIncrement(open);

    //
    // Check to see whether you are still bound to the adapter
    //
    
    if(!open->Bound)
    {
        Irp->IoStatus.Status = STATUS_UNSUCCESSFUL;
        IoCompleteRequest (Irp, IO_NO_INCREMENT);
        IoDecrement(open);
        return STATUS_UNSUCCESSFUL;
    }





    NdisAllocatePacket(
        &Status,
        &MyPacket,
        open->PacketPool
        );

    if (Status != NDIS_STATUS_SUCCESS) {

        //
        //  No free packets
        //
        Irp->IoStatus.Status = STATUS_INSUFFICIENT_RESOURCES;
        IoCompleteRequest (Irp, IO_NO_INCREMENT);
        IoDecrement(open);
        return STATUS_INSUFFICIENT_RESOURCES;
    }



uBufferSize = 60;
Status=NdisAllocateMemory(&pMemory,uBufferSize,0,HighestAcceptableMax);



if(Status != NDIS_STATUS_SUCCESS)
{
NdisFreePacket(pPacket);
         Irp->IoStatus.Status = STATUS_INSUFFICIENT_RESOURCES;
         IoCompleteRequest (Irp, IO_NO_INCREMENT);
         IoDecrement(open);
         return STATUS_INSUFFICIENT_RESOURCES;
}

pMemory[0] = (UCHAR)0xff;
pMemory[1] = (UCHAR)0xff;
pMemory[2] = (UCHAR)0xff;
pMemory[3] = (UCHAR)0xff;
pMemory[4] = (UCHAR)0xff;
pMemory[5] = (UCHAR)0xff;

//mac帧头源mac地址
pMemory[6] = (UCHAR)0x00;
pMemory[7] = (UCHAR)0x00;
pMemory[8] = (UCHAR)0x00;
pMemory[9] = (UCHAR)0x50;
pMemory[10] = (UCHAR)0xBB;
pMemory[11] = (UCHAR)0xBD;

//协议类型
pMemory[12] = (UCHAR)0x08;
pMemory[13] = (UCHAR)0x06;

//arp分组格式
//硬件类型

pMemory[14] = (UCHAR)0x00;
pMemory[15] = (UCHAR)0x01;

//协议类型
pMemory[16] = (UCHAR)0x08;
pMemory[17] = (UCHAR)0x00;

//硬件地址长度
pMemory[18] = (UCHAR)0x06;
//协议地址长度
pMemory[19] = (UCHAR)0x04;

//arp类型
pMemory[20] = (UCHAR)0x00;
pMemory[21] = (UCHAR)0x01;

//发送端MAC地址
pMemory[22] = (UCHAR)0x00;
pMemory[23] = (UCHAR)0x00;
pMemory[24] = (UCHAR)0x00;
pMemory[25] = (UCHAR)0x50;
pMemory[26] = (UCHAR)0xBB;
pMemory[27] = (UCHAR)0xBD;

//发送端IP
pMemory[28] = (UCHAR)0xC8;
pMemory[29] = (UCHAR)0xC8;
pMemory[30] = (UCHAR)0xC8;
pMemory[31] = (UCHAR)0x80;

//接收端MAC地址
pMemory[32] = (UCHAR)0x00;
pMemory[33] = (UCHAR)0x00;
pMemory[34] = (UCHAR)0x00;
pMemory[35] = (UCHAR)0x00;
pMemory[36] = (UCHAR)0x00;
pMemory[37] = (UCHAR)0x00;

//接收端IP地址
pMemory[38] = (UCHAR)0xC8;
pMemory[39] = (UCHAR)0xC8;
pMemory[40] = (UCHAR)0xC8;
pMemory[41] = (UCHAR)0x18;


pMemory[42] = (UCHAR)0x00;
pMemory[43] = (UCHAR)0x00;
pMemory[44] = (UCHAR)0x00;
pMemory[45] = (UCHAR)0x00;
pMemory[46] = (UCHAR)0x00;
pMemory[47] = (UCHAR)0x00;
pMemory[48] = (UCHAR)0x00;
pMemory[49] = (UCHAR)0x00;
pMemory[50] = (UCHAR)0x00;
pMemory[51] = (UCHAR)0x00;
pMemory[52] = (UCHAR)0x00;
pMemory[53] = (UCHAR)0x00;
pMemory[54] = (UCHAR)0x00;
pMemory[55] = (UCHAR)0x00;
pMemory[56] = (UCHAR)0x00;
pMemory[57] = (UCHAR)0x00;
pMemory[58] = (UCHAR)0x00;
pMemory[59] = (UCHAR)0x00;


NdisAllocateBuffer(
&Status,
&pNdis_ARP,
open->PacketPool,
pMemory,
60);





if(Status != NDIS_STATUS_SUCCESS)
{
NdisFreePacket(MyPacket);
NdisFreeMemory(pMemory,uBufferSize,0);
return Status;
}
NdisChainBufferAtFront(MyPacket,pNdis_ARP);
MyPacket->Private.Head->Next = NULL;
MyPacket->Private.Tail = NULL;


NDIS_SET_PACKET_HEADER_SIZE(MyPacket,14);



     //IoMarkIrpPending(Irp);


   /*执行到NdisSend时就重启*/
    NdisSend(
        &Status,
        open->AdapterHandle,
        MyPacket);


    if (Status != NDIS_STATUS_PENDING) {
        //
        //  The send didn\'t pend so call the completion handler now
        //
DebugPrint((\"  Send Success.\"));
      
    }
DebugPrint((\"    send fail.\"));

    return STATUS_SUCCESS;
}

ndissend返回pendding时,要在PtSendComplete里面释放内存

if (Status != NDIS_STATUS_PENDING)
{
     NdisFreeBuffer(pPacketBuffer);
     NdisFreeMemory(pPacketContent, BUFFER_SIZE, 0);
     NdisDprFreePacket(MyPacket);
     return NDIS_STATUS_SUCCESS;
}

返回pendding时
ptsendcomplete:
VOID
PtSendComplete(
IN NDIS_HANDLE ProtocolBindingContext,
IN PNDIS_PACKET Packet,
IN NDIS_STATUS Status
)
{
.....
NdisUnchainBufferAtFront(Packet,&pNdisBuffer);
NdisQueryBufferSafe(pNdisBuffer,(PVOID *) &pPacketContent,&BufferLen,32);
NdisFreeBuffer(pNdisBuffer);
NdisFreeMemory(pPacketContent,BUFFER_SIZE,0);
NdisDprFreePacket(Packet);
......
}

现在的问题是一执行
NdisSend(
&Status,
open->AdapterHandle,
MyPacket);
这个函数，机器就蓝屏，显示错误信息：
DRIVER_IRQL_NOT_LESS_OR_EQUAL.
是不是构造包的过程和构造出来的包有问题，请指点。

open->AdapterHandle里是什么呀，能确定他是帮定的NI吗？

肯定是，ddk中packet例子也是这样发送包的。只不过它发送的包是应用程序write下去的，而我是自己构造包并发送。
是不是构造包的过程不对呢？请指教。

建议检查一下open->AdapterHandle，跟踪一把看看，怀疑是这个问题

可以发送了，是SendComplete函数里处理不当造成的。
谢谢。