Please help me to check these codes

I am confused. It is almost nightmare for me. What is wrong?
I have tried it whole night, but not any progress.
Would gurus here like to help me to check these codes?
I paste some codes from my programm to illustrate the problem I encountered.
The function HookTCPIP is to change the dispatch address in NDIS_OPEN_BLOCK
such as SendHandler, SendCompleteHandler. This function do work.
If I do nothing in NewTCPIPSend just but call the OldSendHandler, every thing is OK.

As the problem I encountered which was described at last mail(want to acheive NAT),
I try to repackage the packet in my NewTCPIPSend. But after I have repackage the packet
and call the OldSendhandler with my new packet, …
crashed.///cry…

Please help me. A saidly boy is crying all night.:)))
best regards
yours brucie.

////////////////////////////////////////////////////////////////
typedef struct ProtocolHandler
{
PNDIS_OPEN_BLOCK openblock; //pointer to NDIS_OPEN_BLOCK
SEND_COMPLETE_HANDLER OldSendComplete;
SEND_HANDLER OldSend;
LIST_ENTRY m_qlink;
}PROTOCOL_HANDLER, *PPROTOCOL_HANDLER;

//some codes to hook tcpip NDIS_OPEN_BLOCK
//here Globals.NdisProtocolHandle is the fake protocol handle I registered in my driver
NTSTATUS
HookTCPIP()
{
PMYNDIS_PROTOCOL_BLOCK protocol = NULL;
PNDIS_OPEN_BLOCK openblock = NULL;
int result;
BOOLEAN Find = FALSE;
ANSI_STRING ProtocolName;
char tcpipname=“TCPIP”;
NDIS_PHYSICAL_ADDRESS HighAddress = NDIS_PHYSICAL_ADDRESS_CONST( -1, -1 );
PPROTOCOL_HANDLER templist = NULL;

protocol = *(PMYNDIS_PROTOCOL_BLOCK*)((UCHAR *)&Globals.NdisProtocolHandle);
//finding the TCPIP PROTOCOL_BLOCK

if (!Find) return STATUS_UNSUCCESSFUL;
Globals.hookedtcpip = protocol;
openblock = *(PNDIS_OPEN_BLOCK*)protocol;
if(openblock == NULL) return STATUS_UNSUCCESSFUL;
while (openblock != NULL)
{
NdisAllocateMemory(&templist, sizeof(PROTOCOL_HANDLER), 0, HighAddress);
templist->openblock = openblock;
templist->OldSend = openblock->SendHandler;
openblock->SendHandler = NewTCPIPSend;

InsertTailList(&Globals.hookedlist,
&templist->m_qlink
);
openblock = openblock->ProtocolNextOpen;
}

}
////////////////////////////////////////////////////////////////////////
codes for NewTCPIPSend
NTSTATUS
NewTCPIPSend(
IN NDIS_HANDLE MacBindingHandle,
IN PNDIS_PACKET Packet
)
{
NDIS_STATUS status;
PPROTOCOL_HANDLER templist = NULL;
PLIST_ENTRY pLinkage;
PNDIS_PACKET pTCPH_IPacket;
PNDIS_BUFFER pMSTCPBuffer, pTCPH_IBuffer;
UINT nBufferCount, nDataSize;
PVOID SysBuffer;
PRSVD pkContext;
PVOID MediaSpecificInfo = NULL;
ULONG MediaSpecificInfoSize = 0;

pLinkage = Globals.hookedlist.Flink;
while( pLinkage != &Globals.hookedlist)
{
templist = CONTAINING_RECORD(
pLinkage,
PROTOCOL_HANDLER,
m_qlink
);
if(templist->MacBindingHandle == MacBindingHandle) break;
pLinkage = pLinkage->Flink;
}
NdisQueryPacket(
Packet,
(PUINT )NULL,
&nBufferCount,
&pMSTCPBuffer,
&nDataSize
);
NdisAllocatePacket(
&status,
&pTCPH_IPacket,
Globals.MySendPacketPool
);
if (!NT_SUCCESS(status)) return STATUS_UNSUCCESSFUL;
IMAllocatePoolNoStructTag(SysBuffer, nDataSize, Buffer);
NdisAllocateBuffer(
&status,
&pTCPH_IBuffer,
Globals.MySendBufferPool,
SysBuffer,
nDataSize
);
NdisChainBufferAtFront(
pTCPH_IPacket,
pTCPH_IBuffer
);
NdisCopyFromPacketToPacket(pTCPH_IPacket,
0,
nDataSize,
Packet,
0,
&nBufferCount);

pkContext = PROTOLRSVD_FROM_PACKET(pTCPH_IPacket);
pkContext->OriginalPkt = Packet;
NdisSetPacketFlags( pTCPH_IPacket, NdisGetPacketFlags(Packet));
NdisMoveMemory(
NDIS_OOB_DATA_FROM_PACKET(pTCPH_IPacket),
NDIS_OOB_DATA_FROM_PACKET(Packet),
sizeof(NDIS_PACKET_OOB_DATA));

*NDIS_PACKET_EXTENSION_FROM_PACKET(pTCPH_IPacket) =
*NDIS_PACKET_EXTENSION_FROM_PACKET(Packet);

NDIS_GET_PACKET_MEDIA_SPECIFIC_INFO(
Packet,
&MediaSpecificInfo,
&MediaSpecificInfoSize);

if(MediaSpecificInfo || MediaSpecificInfoSize)
{
NDIS_SET_PACKET_MEDIA_SPECIFIC_INFO(
pTCPH_IPacket,
MediaSpecificInfo,
MediaSpecificInfoSize);
}
InsertTailList(&Globals.MySendDataList,
&pkContext->qLink
);
status = templist->OldSend(MacBindingHandle, pTCPH_IPacket);
if (status != NDIS_STATUS_PENDING)
{
NewTCPIPSendComplete(templist->ProtocolBindingContext, pTCPH_IPacket, status);
}
return status;
}

VOID
NewTCPIPSendComplete(
IN NDIS_HANDLE ProtocolBindingContext,
IN PNDIS_PACKET Packet,
IN NDIS_STATUS Status
)
{
NDIS_STATUS status;
PPROTOCOL_HANDLER templist = NULL;
PLIST_ENTRY pLinkage;
PNDIS_PACKET MyPacket;
PNDIS_PACKET OrgPacket;
PRSVD pkContext;

pLinkage = Globals.hookedlist.Flink;
while( pLinkage != &Globals.hookedlist)
{
templist = CONTAINING_RECORD(
pLinkage,
PROTOCOL_HANDLER,
m_qlink
);
if(templist->ProtocolBindingContext == ProtocolBindingContext) break;
pLinkage = pLinkage->Flink;
}
pLinkage = Globals.MySendDataList.Flink;
while(pLinkage != &Globals.MySendDataList)
{
MyPacket = NDISPACKET_FROM_PACKET_CONTEXT(pLinkage);
if (MyPacket == Packet)
{
pkContext = PROTOLRSVD_FROM_PACKET(MyPacket);
OrgPacket = pkContext->OriginalPkt;
templist->OldSendComplete(ProtocolBindingContext, OrgPacket, Status);
IbanFreeSendPacketAndBuffers(MyPacket);
return;
}
pLinkage = pLinkage->Flink;
}
}