title: pacer.sys cause BSOD
body: <p>I have created a NDIS5 intermediate filter driver named fxwrap.sys,however when i uninstall it. windows causes BSOD.It also seems ndis!ndisOidRequestComplete reads null address from dump file.I want to know whether this problem is caused by fxwrap or other things.</p>
  
  <p>env:windows 7 ultimate 7601</p>
  
  <hr>
  
  <p>Here is fxwrap!PtRequestComplete function source code:</p>
  
  <pre><code>VOID PtRequestComplete(NDIS_HANDLE   ProtocolBindingContext,
                          PNDIS_REQUEST NdisRequest,
                          NDIS_STATUS   Status)
  {
      PADAPT      pAdapt  = (PADAPT)ProtocolBindingContext;
      NDIS_OID    Oid     = pAdapt-&gt;Request.DATA.SET_INFORMATION.Oid ;
  
      NdisAcquireSpinLock(&amp;pAdapt-&gt;AdaptDataLock);
      {
          pAdapt-&gt;OutstandingRequests = FALSE;
      }
      NdisReleaseSpinLock(&amp;pAdapt-&gt;AdaptDataLock);
  
      switch(NdisRequest-&gt;RequestType)
      {
      case NdisRequestQueryInformation:
          {
              if(Oid == OID_TCP_TASK_OFFLOAD)
              {
                  Status = NDIS_STATUS_FAILURE;
              }
  
              ASSERT(Oid != OID_PNP_QUERY_POWER);
  
              if(Oid == OID_PNP_CAPABILITIES &amp;&amp; Status == NDIS_STATUS_SUCCESS)
              {
                  MPQueryPNPCapbilities(pAdapt, &amp;Status);
              }
  
              *pAdapt-&gt;BytesReadOrWritten = NdisRequest-&gt;DATA.QUERY_INFORMATION.BytesWritten;
              *pAdapt-&gt;BytesNeeded        = NdisRequest-&gt;DATA.QUERY_INFORMATION.BytesNeeded;
  
              NdisMQueryInformationComplete(pAdapt-&gt;MiniportHandle, Status);
          } break;
      case NdisRequestSetInformation:
          {
              ASSERT( Oid != OID_PNP_SET_POWER);
  
              *pAdapt-&gt;BytesReadOrWritten = NdisRequest-&gt;DATA.SET_INFORMATION.BytesRead;
              *pAdapt-&gt;BytesNeeded        = NdisRequest-&gt;DATA.SET_INFORMATION.BytesNeeded;
              NdisMSetInformationComplete(pAdapt-&gt;MiniportHandle, Status);
          }break;
      default:
          ASSERT(0);
          break;
      }
  }
  </code></pre>
  
  <hr>
  
  <p>following is dump info:</p>
  
  <blockquote>
    <p>DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1) An attempt was made to access a
    pageable (or completely invalid) address at an interrupt request level
    (IRQL) that is too high.  This is usually caused by drivers using
    improper addresses. If kernel debugger is available get stack
    backtrace. Arguments: Arg1: 00000000, memory referenced Arg2:
    00000002, IRQL Arg3: 00000000, value 0 = read operation, 1 = write
    operation Arg4: 8a81bd11, address which referenced memory</p>
    
    <h2>Debugging Details:</h2>
    
    <p>READ_ADDRESS: GetPointerFromAddress: unable to read from 84788848
    Unable to read MiSystemVaType memory at 84767e20  00000000 </p>
    
    <p>CURRENT_IRQL:  2</p>
    
    <p>FAULTING_IP:  ndis!ndisOidRequestComplete+8a 8a81bd11 803b05<br>
    cmp     byte ptr [ebx],5</p>
    
    <p>CUSTOMER_CRASH_COUNT:  1</p>
    
    <p>DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT</p>
    
    <p>BUGCHECK_STR:  0xD1</p>
    
    <p>PROCESS_NAME:  System</p>
    
    <p>TRAP_FRAME:  8dd07aa0 -- (.trap 0xffffffff8dd07aa0) ErrCode = 00000000
    eax=00000200 ebx=00000000 ecx=00000001 edx=00000000 esi=8dd07b4c
    edi=a277f5a4 eip=8a81bd11 esp=8dd07b14 ebp=8dd07b34 iopl=0         nv
    up ei pl zr na pe nc cs=0008  ss=0010  ds=0023  es=0023  fs=0030 
    gs=0000             efl=00010246</p>
    
    <p>ndis!ndisOidRequestComplete+0x8a:</p>
    
    <p><strong>8a81bd11 803b05          cmp     byte ptr [ebx],5           ds:0023:00000000=??</strong></p>
    
    <p>Resetting default scope</p>
    
    <p>LAST_CONTROL_TRANSFER:  from 8a81bd11 to 846605fb</p>
    
    <p>STACK_TEXT:</p>
    
    <p>8dd07aa0 8a81bd11 badb0d00 00000000 8dd07ac0 nt!KiTrap0E+0x2cf</p>
    
    <p>8dd07b34 8a81c8b9 8dd07b4c 8c840008 870c1618
    ndis!ndisOidRequestComplete+0x8a</p>
    
    <p>8dd07b68 952b411b 8963b0f0 a277f5a4 00000000
    ndis!NdisFOidRequestComplete+0x6a</p>
    
    <p>8dd07b88 8a81c19d 870c1618 8c840008 00000000
    pacer!PcFilterRequestComplete+0x5b</p>
    
    <p>8dd07bbc 8a843572 02d07bd4 00000000 89ac60e0
    ndis!ndisOidRequestComplete+0x516</p>
    
    <p>8dd07bf4 8a843805 00ac60e0 8c840008 00000000
    ndis!ndisMOidRequestCompleteInternal+0xd0</p>
    
    <p>8dd07c18 8a87a765 02ac60e0 00000000 8c840008
    ndis!ndisCompleteLegacyRequest+0xdb</p>
    
    <p>8dd07c38 95a831c5 89ac60e0 00000000 89ad20e0
    ndis!NdisMSetInformationComplete+0x81</p>
    
    <p>8dd07c54 8a87506f 8a1d48e8 8a1d4908 00000000
    fxwrap!PtRequestComplete+0x61</p>
    
    <p>8dd07c70 8a81c05b 876f54c0 8966f0f0 00000000
    ndis!ndisCompleteOidRequestToRequest+0x4a</p>
    
    <p>8dd07ca4 8a8704b2 00d07cbc 89ad20e0 8a85a000
    ndis!ndisOidRequestComplete+0x3d4</p>
    
    <p>8dd07ce8 8a823221 00ad20e0 8966f190 86a58638
    ndis!ndisMDoOidRequest+0x528</p>
    
    <p>8dd07d00 8469ca6b 8966f188 00000000 86a58638
    ndis!ndisDoOidRequests+0x4d</p>
    
    <p>8dd07d50 84827fda 00000000 92ed9892 00000000 nt!ExpWorkerThread+0x10d</p>
    
    <p>8dd07d90 846d01f9 8469c95e 00000000 00000000
    nt!PspSystemThreadStartup+0x9e</p>
    
    <p>00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19</p>
    
    <p>STACK_COMMAND:  kb</p>
    
    <p>FOLLOWUP_IP:  pacer!PcFilterRequestComplete+5b 952b411b 56<br>
    push    esi</p>
    
    <p>SYMBOL_STACK_INDEX:  3</p>
    
    <p>SYMBOL_NAME:  pacer!PcFilterRequestComplete+5b</p>
    
    <p>FOLLOWUP_NAME:  MachineOwner</p>
    
    <p>MODULE_NAME: pacer</p>
    
    <p>IMAGE_NAME:  pacer.sys</p>
    
    <p>DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc916</p>
    
    <p>FAILURE_BUCKET_ID:  0xD1_pacer!PcFilterRequestComplete+5b</p>
    
    <p>BUCKET_ID:  0xD1_pacer!PcFilterRequestComplete+5b</p>
    
    <p>Followup: MachineOwner</p>
  </blockquote>
  
  <p>thanks for any input.</p>