定时器回调例程出错，寻求帮助（20分）

驱动程序中需要定时查询USB设备状态，在定时器回调例程中写一些代码，启动定时器后即当机，将BulkReadData中内容去掉则正常，不知BulkReadData函数有何问题，请求帮助！
VOID EzUsbDevice::TimedCallback(PVOID arg1, PVOID arg2)
{
// whatever your callback does goes here
nSize = BulkReadData(3,&pDataBuffer[0],1);
}

////////////////////////////////
ULONG EzUsbDevice::BulkReadData(int pipeNum, PVOID pBuffer, ULONG dataLen)
{
t << \"Entering BulkReadWrite\\n\";
ULONG RetValue = 0;

NTSTATUS status = STATUS_SUCCESS;
//PBULK_TRANSFER_CONTROL p = reinterpret_cast<PBULK_TRANSFER_CONTROL>(pBuffer);
ULONG nBufferLength = dataLen;

KUsbPipe* pipe = FindPipe(pipeNum);

if(NULL == pipe)
{
t << \"Error: Invalid pipe parameter\\n\";
return STATUS_INVALID_PARAMETER;
}

if( nBufferLength > pipe->MaximumTransferSize() )
{
t << \"Error: Invalid transfer size parameter\\n\";
return STATUS_INVALID_PARAMETER;
}

//KMemory M( I.Mdl() );

PURB pUrb = pipe->BuildBulkTransfer(
pBuffer,//M,
nBufferLength,
static_cast<BOOLEAN>( USB_ENDPOINT_DIRECTION_IN(pipe->EndpointAddress()) ),
NULL,
TRUE
);

//status = pipe->SubmitUrb(pUrb);
status = pipe->SubmitUrb(pUrb,NULL,NULL,20);//chen

if( STATUS_SUCCESS == status )
{
RetValue = pUrb->UrbBulkOrInterruptTransfer.TransferBufferLength;
}
else
{
RetValue = 0;
}

delete pUrb;

return RetValue;
}

用softice跟，看是到哪句就死了。