有请大侠们出手

调用iomanager的device queue的程序处理异步I/O,调试时,在问号处出现page fault 0e,为什么??!这个问题困扰了很长时间了,请高手指正:
NTSTATUS DispatchControl(PDEVICE_OBJECT fdo, PIRP Irp)
{ // DispatchControl

PDEVICE_EXTENSION pdx = (PDEVICE_EXTENSION) fdo->DeviceExtension;

NTSTATUS status;
... ... UsbBuildInterruptOrBulkTransferRequest(&urb_1,sizeof(_URB_BULK_OR_INTERRUPT_TRANSFER),
pdx->houtpipe, buff,NULL,m_seglen,0,NULL);

PIRP Irp_1 = IoBuildDeviceIoControlRequest(IOCTL_INTERNAL_USB_SUBMIT_URB,
pdx->LowerDeviceObject, NULL, 0, NULL, 0, TRUE,NULL, NULL);
if (!Irp_1)
{
KdPrint((DRIVERNAME \" - Unable to allocate IRP for sending URB\\n\"));
return STATUS_INSUFFICIENT_RESOURCES;
}

PIO_STACK_LOCATION stack = IoGetNextIrpStackLocation(Irp_1);
stack->Parameters.Others.Argument1 = (PVOID) &urb_1;
IoMarkIrpPending(Irp_1);
IoStartPacket(fdo,Irp_1,NULL,OnCancel);
status=STATUS_PENDING;
return status;
}

VOID StartIo(IN PDEVICE_OBJECT pdo, IN PIRP Irp)
{

KIRQL oldirql;
NTSTATUS status;
IoAcquireCancelSpinLock(&oldirql);
if (Irp != pdo->CurrentIrp || Irp->Cancel)
{
IoReleaseCancelSpinLock(oldirql);
return;
}
else
{
IoSetCancelRoutine(Irp, NULL);
IoReleaseCancelSpinLock(oldirql);
}

PIO_STACK_LOCATION stack = IoGetCurrentIrpStackLocation(Irp);
PDEVICE_EXTENSION pdx = (PDEVICE_EXTENSION) pdo->DeviceExtension;

PVOID ctx;
IoSetCompletionRoutine(Irp, (PIO_COMPLETION_ROUTINE)OnComplete, (PVOID) ctx, TRUE, FALSE,FALSE);
status=IoCallDriver(pdx->LowerDeviceObject, Irp);
return;

}


NTSTATUS OnComplete(PDEVICE_OBJECT pdo, PIRP Irp, PDEVICE_EXTENSION pdx)
{

LONG m_seglen;
URB urb;
URB urb_1;
KEVENT event;
IO_STATUS_BLOCK iostatus;

if (Irp->PendingReturned)
{
IoMarkIrpPending(Irp);
}


Irp->IoStatus.Status=STATUS_SUCCESS;
Irp->IoStatus.Information =pdx->Length;
IoStartNextPacket(pdo,TRUE); ------------------???
IoCompleteRequest(Irp, IO_NO_INCREMENT);
return STATUS_SUCCESS;


}

 :(