I thought NdisRetreatNetBufferDataStart() requires to adjust the net buffer list offset to start with the IP header. I am just wondering why you need to call this function as you are filtering at Network-Layer (FWPM_LAYER_INBOUND_IPPACKET_V4 and FWPM_LAYER_OUTBOUND_IPPACKET_V4) and net buffer list offset should point to start of the IP header by default.