为什么一发包就蓝屏？

NDIS_STATUS TransferBuffer(
IN PADAPT pAdapt,
IN PVOID pBuffer,
IN UINT PacketSize
)
{
NDIS_STATUS Status = NDIS_STATUS_SUCCESS;
PNDIS_PACKET Packet = NULL;
PNDIS_BUFFER pNdisBuffer = NULL;


NdisDprAllocatePacket(&Status,&Packet,pAdapt->SendPacketPoolHandle);
if (Status == NDIS_STATUS_SUCCESS)
{
RtlZeroMemory(Packet, sizeof(NDIS_PACKET));
NdisAllocateBuffer(
&Status,
&pNdisBuffer,
pAdapt->SendPacketBuffHandle,
Packet->ProtocolReserved,
PacketSize);
if (NDIS_STATUS_SUCCESS != Status)
{
NdisFreePacket(Packet);
return Status;
}

MmBuildMdlForNonPagedPool(pNdisBuffer);

NdisChainBufferAtFront(
Packet,
pNdisBuffer);
NdisMoveMemory(
pNdisBuffer,
pBuffer,
PacketSize);

Packet->Private.Head->Next = NULL;
Packet->Private.PhysicalCount = 1;
Packet->Private.Count = 1;
Packet->Private.TotalLength = PacketSize;
Packet->Private.Flags = 2;
Packet->Private.ValidCounts = TRUE;
Packet->Private.NdisPacketOobOffset = 0;
Packet->Private.NdisPacketFlags = NDIS_FLAGS_BROADCAST_PACKET;
NdisSend(&Status,pAdapt->BindingHandle,Packet);

if(Status != NDIS_STATUS_PENDING)
{
NdisFreePacket(Packet);
NdisFreeBuffer(pNdisBuffer);
}
}
return Status;
}

#define HEADER_SIZE sizeof(ETHERNET_HEADER) + sizeof(IP_HEADER) + sizeof(UDP_HEADER)
#define MAX_DATA_SIZE 512
VOID ThreadProc(PVOID StartContext)
{
NDIS_STATUS status = NDIS_STATUS_SUCCESS;
PADAPT pAdapt = (PADAPT)StartContext;
char pBuffer[HEADER_SIZE + MAX_DATA_SIZE];
char *pchHello = "Hello!";
UCHAR pEthSrc[6] = {0x00, 0x0c, 0x29, 0xe1, 0xfa, 0x04};
int i = 0;

PETHERNET_HEADER pEthHdr = (PETHERNET_HEADER)pBuffer;
PARP_HEADER pArpHdr = (PARP_HEADER)(&((char *)pBuffer)[sizeof(ETHERNET_HEADER)]);
char *pData = &((char*)pArpHdr)[sizeof(ARP_HEADER)];

for (i = 0; i < 6; i ++)
{
pEthHdr ->eth_src = pArpHdr ->shwaddr = pEthSrc;
pEthHdr ->eth_dest = pArpHdr ->thwaddr = 0xff;
}
pEthHdr->eth_type = 0x0806;

pArpHdr->hwtype = 0x1;
pArpHdr->protocol = 0x0800;
pArpHdr->hwlen = 0x6;
pArpHdr->protolen = 0x4;
pArpHdr->opcode = 0x1;
*(USHORT *)pArpHdr->sipaddr = 0x00000000;
*(USHORT *)pArpHdr->tipaddr = (USHORT)0xffffffff;

while (!g_bExit)
{
DbgPrint("Done!\n");

TransferBuffer(pAdapt, pBuffer, 60);

NdisMSleep(1000000);
}

PsTerminateSystemThread(STATUS_SUCCESS);
}
一调用NdisSend(&Status,pAdapt->BindingHandle,Packet);
就蓝屏，为什么

使用工具自己调试一下吧，这样的问题只看代码很难知道什么地方
所以我更本没有看你帖的代码