FwpsReferenceNetBufferList in WFP callout causes KMODE_EXCEPTION_NOT_HANDLED BSOD in tcpip.sys?

I am trying to use FwpsReferenceNetBufferList in my IPPACKET callout in order to do out of band packet inspection, therefore i reference the NBL to make sure i can use it out of band, and i block, and in a separate thread i reinject it by cloning it and i dereference it in the completion routine of the injection.

The problem is that doing FwpsReferenceNetBufferList on the NBL causes a BSOD in tcpip.sys right after the callout is finished (seems to happen in a thread inside TCPIP.sys and non of my functions are inside the callstack). Am i doing the cloning correctly? I tried not to use deep packet copy in order to be more optimized, so what is the most optimize solution to me “keeping” this NBL until i reinject it?

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 831aaa85, The address that the exception occurred at
Arg3: 91e4b138, Parameter 0 of the exception
Arg4: 91e4ace0, Parameter 1 of the exception

0: kd> k
 # ChildEBP RetAddr  
00 91e4ab7c 8208e8ce nt!KeBugCheckEx
01 91e4ab94 82038ec8 nt!KiFatalFilter+0x11
02 91e4b97c 81f35b35 nt!KeExpandKernelStackAndCalloutInternal+0x103388
03 91e4b99c 83067f2f nt!KeExpandKernelStackAndCalloutEx+0x23
WARNING: Stack unwind information not available. Following frames may be wrong.
04 91e4ba08 830586bb ndis!NdisConvertNdisStatusToNtStatus+0x52d
05 91e4ba78 831f74d4 ndis!NdisSendNetBufferLists+0x2eb
06 91e4bac4 831f4478 tcpip+0x54d4