创建TCP连接的问题

  如何用TDI创建一个TCP的连接？
只有UDP的例子，谁能给我说一下思路，最好能有例子

自己找到一个例子，
5个步骤
1Create a Local Address Object
2Create a TDI Endpoint with Context
3Associate an Endpoint with a Local Address
4Connect to a Remote Server (Send the TCP Handshake)
5Send Data to a Remote Server
试着写了一下，DDK可以编译过去了，不过一调用就重启机器，郁闷

在最后Send data to a Remote Server时IoCallDriver总是返回错，Status是0xC0000184
代码如下，谁知道哪个地方有问题？
NTSTATUS    TDISendData(PDEVICE_OBJECT DeviceObject,PIRP Irp)
{
    PIRP                pIrp;
    PMDL                pMdl;
    ULONG                SendBfrLength;
    PVOID                pSendBuffer;
    KEVENT                Event;
    NTSTATUS            Status;
    IO_STATUS_BLOCK        IoStatus;
    PDEVICE_EXTENSION    deviceExtension;

    deviceExtension = ( PDEVICE_EXTENSION )DeviceObject->DeviceExtension;

    KeInitializeEvent(&Event, NotificationEvent, FALSE);
    
    pIrp = TdiBuildInternalDeviceControlIrp(TDI_SEND,
                deviceExtension->TDILowerDeviceObject,
                deviceExtension->lpTransAddrFileObject1,
                &Event,        
                &IoStatus          );

    if(NULL==pIrp) {
        DbgPrint("Could not get an IRP for TDI_SEND");
        return(STATUS_INSUFFICIENT_RESOURCES);
    }

    // This code is necessary if buffer is in the paged pool.
    // Must run at <= DISPATCH_LEVEL.
    pSendBuffer = MmGetMdlVirtualAddress ( Irp->MdlAddress );
    SendBfrLength = MmGetMdlByteCount( Irp->MdlAddress );
    
    ASSERT( KeGetCurrentIrql() <= DISPATCH_LEVEL );
    pMdl = IoAllocateMdl(pSendBuffer, SendBfrLength, FALSE, FALSE, pIrp);
    if(NULL==pMdl) {
        DbgPrint("Could not get an MDL for TDI_SEND");
        return(STATUS_INSUFFICIENT_RESOURCES);
    }

   // Must run at < DISPATCH_LEVEL for pageable memory.
    ASSERT( KeGetCurrentIrql() < DISPATCH_LEVEL );

    __try
   {
    MmProbeAndLockPages(
        pMdl,      // (Try to) fix buffer.
        KernelMode,
        IoModifyAccess );
    }

   __except(EXCEPTION_EXECUTE_HANDLER)
   {
    DbgPrint("Exception calling MmProbeAndLockPages");
    return STATUS_UNSUCCESSFUL;
    }

    TdiBuildSend(
        pIrp,
        deviceExtension->TDILowerDeviceObject,     // TDI driver's device object
        deviceExtension->lpTransAddrFileObject1,    // connection (endpoint) file object
        NULL,           // I/O completion routine
        NULL,           // context for I/O completion routine
        pMdl,           // MDL address
        0,              // Flags. 0 => send as normal TSDU.
        SendBfrLength   // length of buffer mapped by MDL
        );

    ASSERT( KeGetCurrentIrql() <= DISPATCH_LEVEL );

    // Send the command to the underlying TDI driver.
    Status = IoCallDriver(deviceExtension->TDILowerDeviceObject,  pIrp);
    // Wait on the IRP, if required.
    if (Status == STATUS_PENDING) {
        DbgPrint("Waiting on IRP (send)...");
        KeWaitForSingleObject(&Event,Executive,KernelMode,FALSE,0);
    }

    if ( (Status != STATUS_SUCCESS) && (Status != STATUS_PENDING)) {  
        DbgPrint("IoCallDriver failed (send), status 0x%08X", Status);
        return STATUS_UNSUCCESSFUL;
    }

    return Status;
}

问题解决了，先IoAllocateMdl，再TdiBuildInternalDeviceControlIrp