The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
I have an NDIS filter that registers a ReceiveNetBufferListsHandler so it can inspect packets. It does not clone, modify, pend or inject packets. As such, my understanding of the documentation is that it would not have a use case where a ReturnNetBufferListsHandler would be needed. As far as I know, you only need a ReturnNBL handler if you have added your own NBLs in the receive path and thus need to pull them back out.
However, when I enable verifier with the NDIS option the driver quickly trips a bugcheck for a violation of the NdisFilterTimedDataReceive rule.
Unfortunately, !ruleinfo has been broken for at least 3 years so I am not able to fully dig into the crash.
But simply adding a ReturnNetBufferListsHandler which does nothing other than call NdisFReturnNetBufferLists on the unchanged NBL that is passed in gets rid of the bugcheck.
Am I missing something here or is verifier just getting tripped up and falsely bugchecking in my scenario?
|Upcoming OSR Seminars
|OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
|13-17 May 2024
|1-5 Apr 2024
|Internals & Software Drivers
|11-15 Mar 2024
|Writing WDF Drivers
|20-24 May 2024