Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results


Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging

The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.

Check out The OSR Learning Library at:


ArsenArsen Member Posts: 155
edited May 22 in NTDEV

Why NdisAllocateCloneNetBufferList is not incrementing ChildRefCount member of source NBL and not changing ParentNetBufferList of destination NBL. It remains 0 after NdisAllocateCloneNetBufferList.
What typically must I do after cloning.
Is there any flag, that specifies MDL as shared between two NBLs (original and cloned) .

PNET_BUFFER_LIST cloneNBL = NdisAllocateCloneNetBufferList(pNBL, pFilter->NBLPoolHandle, pFilter->NBPoolHandle, NDIS_CLONE_FLAGS_USE_ORIGINAL_MDLS);
DEBUGP(DL_WARN, "pNBL->ChildRefCount = %d", pNBL->ChildRefCount);  //remains 0
DEBUGP(DL_WARN, "cloneNBL->ParentNetBufferList = %p", cloneNBL->ParentNetBufferList);  //remains NULL
NdisCopyReceiveNetBufferListInfo(cloneNBL, pNBL);
cloneNBL->SourceHandle = pFilter->FilterHandle;  // pNBL->ChildRefCount++;  cloneNBL->ParentNetBufferList = pNBL;
cloneNBL->Scratch = (PVOID)UlongToPtr(ReceiveFlags);
Post edited by Arsen on


  • ArsenArsen Member Posts: 155
    edited May 22

    When I uninstall my driver, its hangs up. When I close the receive and return (doing bypass), its successfully uninstalling. So the problem is in receive path. I think it is because of clone.
    freezing occurs in NdisFDeregisterFilterDriver, when I try to uninstall the driver. Some NBLs may not have been sent or received

    How can I study this problem with windbg.

    Post edited by Arsen on
  • ArsenArsen Member Posts: 155

    Who can say

    VOID FilterReceiveNetBufferLists(NDIS_HANDLE FilterModuleContext,PNET_BUFFER_LIST NetBufferLists,NDIS_PORT_NUMBER PortNumber,ULONG NumberOfNetBufferLists,ULONG ReceiveFlags)
        PMS_FILTER          pFilter = (PMS_FILTER)FilterModuleContext;
        BOOLEAN             DispatchLevel;
        BOOLEAN             bFalse = FALSE;
        ULONG               Ref; UNREFERENCED_PARAMETER(Ref);
        do {
            DispatchLevel = NDIS_TEST_RECEIVE_AT_DISPATCH_LEVEL(ReceiveFlags);
    #if DBG
            ULONG               ReturnFlags;
            FILTER_ACQUIRE_LOCK(&pFilter->Lock, DispatchLevel);
            if (pFilter->State != FilterRunning)
                FILTER_RELEASE_LOCK(&pFilter->Lock, DispatchLevel);
                if (NDIS_TEST_RECEIVE_CAN_PEND(ReceiveFlags))
                    ReturnFlags = 0;
                    if (NDIS_TEST_RECEIVE_AT_DISPATCH_LEVEL(ReceiveFlags))
                    NdisFReturnNetBufferLists(pFilter->FilterHandle, NetBufferLists, ReturnFlags);
            FILTER_RELEASE_LOCK(&pFilter->Lock, DispatchLevel);
            ASSERT(NumberOfNetBufferLists >= 1);

    why the code is enclosed in #if DBG - #endif pair

  • Tim_RobertsTim_Roberts Member - All Emails Posts: 14,563

    When I uninstall my driver, its hangs up ... How can I study this problem with windbg.

    You attach a debugger and press Ctrl-Break to freeze the system when it hangs. Now you should be about to examine each CPU and see which one is handling shutdown.

    Tim Roberts, [email protected]
    Providenza & Boekelheide, Inc.

  • ArsenArsen Member Posts: 155


Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. Sign in or register to get started.

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Internals & Software Drivers 19-23 June 2023 Live, Online
Writing WDF Drivers 10-14 July 2023 Live, Online
Kernel Debugging 16-20 October 2023 Live, Online
Developing Minifilters 13-17 November 2023 Live, Online