TDI feature or bug?

I faced with somewhat strange TCP driver behaviour.
Suppose I have a buffer in the user space. I create an MDL,
lock it, map it to system address space and pass it to
the TCP driver, say, to TdiSend.
The TCP driver occasionaly crashes the OS to BSOD due to
accessing that buffer using user space address.
However, if I set Mdl->StartVa = Mdl->MappedSystemVa
before passing an MDL to TCP, everything works just fine.
Can anyone give me some clue about what’s going on here?
Is this a feauture of the TCP driver?
Thanks in advance.

You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)