In an NT 4.0 filter driver I am intercepting every IRP_MJ_READ, queueing it
and sending on down to the lower level driver a substitute IRP which I
created “to look very much like the original.” I do this so that if I don’t
like the results I can do things till I get one I like and I can pass on the
completion of the caller’s IRP when and how I wish.
My problem is that when I get a (the first) completion of my substitute IRP
I complete the original IRP with
IoCompleteRequest( originalIrp, IO_NO_INCREMENT);
and then return the status for my substitute IRP as
STATUS_ADDITIONAL_PROCESSING_REQUIRED
after exiting my code the system stops with a page fault in
ntoskrnl!PsReturnPoolQuota
I have removed all ExFreePool calls and added an additional stack location
as debug attempts with no changes. Anyone have any ideas??
Daniel J. Hickey
xxxxx@bluekite.com
www.bluekite.com
Mobile: 714 875-9997
Office: 714 843-6051
Fax: 714 375-2737