Here is the code leading up to the WdfIoTargetSend call, sorry I forgot to post it earlier:
WDFIOTARGET mTarget;
WDFMEMORY memory;
PSCSI_REQUEST_BLOCK pSrb;
PVOID senseInfoBuffer = NULL;
WDF_REQUEST_SEND_OPTIONS options;
NTSTATUS status;
PDEVICE_CONTEXT devCont;
WDF_MEMORY_DESCRIPTOR memDescriptor;
devCont = WdfFltrGetDeviceContext(WdfIoQueueGetDevice(Queue));
ASSERT(IS_DEVICE_CONTEXT(devCont));
WdfFltrTrace((“Original srb function - 0x%x\n”, pFilterSrb->Function));
WdfFltrTrace((“Original srb Cdb length - 0x%x\n”, pFilterSrb->CdbLength));
mTarget = WdfDeviceGetIoTarget(WdfIoQueueGetDevice(Queue));
status = WdfMemoryCreate(WDF_NO_OBJECT_ATTRIBUTES, NonPagedPool, 0, sizeof(SCSI_REQUEST_BLOCK), &memory, (PVOID*)&pSrb);
if(NT_SUCCESS(status))
{
WDF_MEMORY_DESCRIPTOR_INIT_HANDLE(&memDescriptor, memory, NULL);
//Format the SRB
RtlZeroMemory(pSrb, SCSI_REQUEST_BLOCK_SIZE);
pSrb->Length = SCSI_REQUEST_BLOCK_SIZE;
pSrb->Function = SRB_FUNCTION_EXECUTE_SCSI;
pSrb->CdbLength = 0xa;
pSrb->SenseInfoBufferLength = 18;
// Sense buffer is in aligned nonpaged pool.
senseInfoBuffer = ExAllocatePoolWithTag(NonPagedPoolCacheAligned, 18, ‘MOOB’);
if(senseInfoBuffer != NULL)
{
pSrb->SenseInfoBuffer = senseInfoBuffer;
pSrb->TimeOutValue = pFilterSrb->TimeOutValue;
pSrb->DataBuffer = NULL;
pSrb->OriginalRequest = deviceControlIrp;
pSrb->QueueAction = SRB_SIMPLE_TAG_REQUEST;
pSrb->DataTransferLength = 0;
pSrb->SrbFlags = pFilterSrb->SrbFlags;
pSrb->ScsiStatus = 0;
pSrb->SrbStatus = 0;
pSrb->NextSrb = NULL;
RtlZeroMemory(pSrb->Cdb, sizeof(UCHAR)*16);
pSrb->Cdb[0] = (UCHAR)0xC1; //Our custom scsi command
pSrb->Cdb[7] = (UCHAR)0xAB; //pFilterSrb->Cdb[7];
pSrb->Cdb[8] = (UCHAR)0xCD; //pFilterSrb->Cdb[8];
status = WdfIoTargetSendInternalIoctlOthersSynchronously(mTarget, NULL, IOCTL_SCSI_EXECUTE_NONE, &memDescriptor, NULL, NULL, NULL, NULL);
if(NT_SUCCESS(status))
{
WdfFltrTrace((“Send passed\n”));
}
… (clean up code follows)