For starters, this event exit may run at DISPATCH_LEVEL.
TdiBuildInternalDeviceControlIrp() must be called at PASSIVE_LEVEL.
Second, MmProbeAndLockPages() must be called at PASSIVE_LEVEL if the
concerned pages are pageable, which they would be. I know you didn’t get
that far, but that would have bitten, too.
–
If replying by e-mail, please remove “nospam.” from the address.
James Antognini
Windows DDK MVP