[NDIS] inject raw 802.11 packet success, but packet is modified

Hi,

I’m trying to inject raw 802.11 packet with NDIS monitoring filter driver, the injection seems to be ok, MicrosoftNetworkMonitor can capture the packet, but the content is modified.
here’s the code:

// for testing, send a packet with 60 bytes: 0x00, 0x01, 0x02, 0x03 …
// I expect the packet to be exactly the same as this
case IOCTL_INJECT_PACKET:
{
UCHAR x[60];
for(int i=0;i x[i] = i;
}
inject_packet(x, sizeof(x));
}
break;

// the inject function.
BOOLEAN inject_packet(UCHAR* buf, INT size) {

UCHAR* frame = (UCHAR*)NdisAllocateMemoryWithTagPriority(G.nic_sta.filterHandle, size,
FILTER_ALLOC_TAG, LowPoolPriority);

PMDL pMdl = NdisAllocateMdl(G.nic_sta.filterHandle, frame, size);
if(pMdl == NULL) {
DEBUGP(DL_AJ, (“alloc mdl error\n”));
return FALSE;
}
NdisMoveMemory(frame, buf, size);

PNET_BUFFER_LIST pNetBufferList = NdisAllocateNetBufferAndNetBufferList(
G.nic_sta.pool,
0, //Request
0, // back fill size
pMdl,
0, // Data offset
size);
if(pNetBufferList == NULL) {
DEBUGP(DL_AJ, (“alloc NBL error\n”));
return FALSE;
}

pNetBufferList->SourceHandle = G.nic_sta.filterHandle;
NdisFSendNetBufferLists(G.nic_sta.filterHandle,
pNetBufferList,
NDIS_DEFAULT_PORT_NUMBER,
NDIS_SEND_FLAGS_DISPATCH_LEVEL);

NdisFreeMemory(frame, size, 0);

return TRUE;
}

it’s captured by MicrosoftNetworkMonitor:
http://i1021.photobucket.com/albums/af333/aj3423/modified_packet.png
only the bytes in red are correct, they are bssid, source, destination, other bytes are all modified…
The frame length is 104, strip away the 32byte Metadata, it’s still 72 bytes, not 60 as expected.

Why is this?

the environment:
OS: Win7-32bit.
Adapter: Intel(R) Centrino(R) Advanced-N 6205, it is connected and associated to AP.

Thanks in advance.