Request Buffer is different in WDF and WDM ?

I am developing a driver with WDF ,and found a strange issue

WDF :
specify the driver buffer method = BUFFER_IO.

In default queue ,dispatch a read callback function : EvtIoRead.

EvtIoRead(IN WDFQUEUE Queue,IN WDFREQUEST Request,IN size_t Length)
{
WdfRequestGetParameters(Request,&params);
ntStatus = WdfRequestRetrieveOutputBuffer(Request,Length,&iobuffer,&ulLength);
}
Notice that the Length = 1,and in the params ,the read length = 1 too, that
means that application want to read 1 byte data.
But when I call the WdfRequestRetrieveOutputBuffer , It return ntStatus = STATUS_BUFFER_TOO_SMALL and iobuffer = 0,ulLength = 0.
How could that happened ? some body read 1 byte data with a NULL output buffer?

Microsoft provide a driver doing the same thing . and I wrote a upper filter to intercept the IRP :
[22] Read Length : 0x1, Read Buffer 0x8988DCB8
[22] Passing IPR IRP_MJ_READ IRP: 0x88EE3328

and that is a buffer !

Is WDF and WDM different ? and How can i debug the issue like this ?

Thanks for any advance !

So weird!!
I use the code below . It shows the Request Buffer is ok!

pIrp = WdfRequestWdmGetIrp(Request);
irpStack = IoGetCurrentIrpStackLocation(pIrp);
ReadBuffer= (PUCHAR)pIrp->AssociatedIrp.SystemBuffer;// ReadBuffer != NULL.
bLength = irpStack->Parameters.Read.Length; // bLength =1.

it is a BUG of WdfRequestRetrieveOutputBuffer ?

The error tracing is quite informative for this DDI. What does !wdflogdump or the WDK traceview utility show? It will report where that status code came from.

-----Original Message-----

So weird!!
I use the code below . It shows the Request Buffer is ok!

pIrp = WdfRequestWdmGetIrp(Request);
irpStack = IoGetCurrentIrpStackLocation(pIrp);
ReadBuffer= (PUCHAR)pIrp->AssociatedIrp.SystemBuffer;// ReadBuffer != NULL.
bLength = irpStack->Parameters.Read.Length; // bLength =1.

it is a BUG of WdfRequestRetrieveOutputBuffer ?