I have an NDIS filter that registers a ReceiveNetBufferListsHandler so it can inspect packets. It does not clone, modify, pend or inject packets. As such, my understanding of the documentation is that it would not have a use case where a ReturnNetBufferListsHandler would be needed. As far as I know, you only need a ReturnNBL handler if you have added your own NBLs in the receive path and thus need to pull them back out.
However, when I enable verifier with the NDIS option the driver quickly trips a bugcheck for a violation of the NdisFilterTimedDataReceive rule.
Unfortunately, !ruleinfo has been broken for at least 3 years so I am not able to fully dig into the crash.
But simply adding a ReturnNetBufferListsHandler which does nothing other than call NdisFReturnNetBufferLists on the unchanged NBL that is passed in gets rid of the bugcheck.
Am I missing something here or is verifier just getting tripped up and falsely bugchecking in my scenario?