pacer.sys cause BSOD - driver

Question

I have created a NDIS5 intermediate filter driver named fxwrap.sys,however when i uninstall it. windows causes BSOD.It also seems ndis!ndisOidRequestComplete reads null address from dump file.I want to know whether this problem is caused by fxwrap or other things.
env:windows 7 ultimate 7601
Here is fxwrap!PtRequestComplete function source code:
VOID PtRequestComplete(NDIS_HANDLE ProtocolBindingContext,
PNDIS_REQUEST NdisRequest,
NDIS_STATUS Status)
{
PADAPT pAdapt = (PADAPT)ProtocolBindingContext;
NDIS_OID Oid = pAdapt->Request.DATA.SET_INFORMATION.Oid ;
NdisAcquireSpinLock(&pAdapt->AdaptDataLock);
{
pAdapt->OutstandingRequests = FALSE;
}
NdisReleaseSpinLock(&pAdapt->AdaptDataLock);
switch(NdisRequest->RequestType)
{
case NdisRequestQueryInformation:
{
if(Oid == OID_TCP_TASK_OFFLOAD)
{
Status = NDIS_STATUS_FAILURE;
}
ASSERT(Oid != OID_PNP_QUERY_POWER);
if(Oid == OID_PNP_CAPABILITIES && Status == NDIS_STATUS_SUCCESS)
{
MPQueryPNPCapbilities(pAdapt, &Status);
}
*pAdapt->BytesReadOrWritten = NdisRequest->DATA.QUERY_INFORMATION.BytesWritten;
*pAdapt->BytesNeeded = NdisRequest->DATA.QUERY_INFORMATION.BytesNeeded;
NdisMQueryInformationComplete(pAdapt->MiniportHandle, Status);
} break;
case NdisRequestSetInformation:
{
ASSERT( Oid != OID_PNP_SET_POWER);
*pAdapt->BytesReadOrWritten = NdisRequest->DATA.SET_INFORMATION.BytesRead;
*pAdapt->BytesNeeded = NdisRequest->DATA.SET_INFORMATION.BytesNeeded;
NdisMSetInformationComplete(pAdapt->MiniportHandle, Status);
}break;
default:
ASSERT(0);
break;
}
}
following is dump info:
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1) An attempt was made to access a
pageable (or completely invalid) address at an interrupt request level
(IRQL) that is too high. This is usually caused by drivers using
improper addresses. If kernel debugger is available get stack
backtrace. Arguments: Arg1: 00000000, memory referenced Arg2:
00000002, IRQL Arg3: 00000000, value 0 = read operation, 1 = write
operation Arg4: 8a81bd11, address which referenced memory
Debugging Details:
READ_ADDRESS: GetPointerFromAddress: unable to read from 84788848
Unable to read MiSystemVaType memory at 84767e20 00000000
CURRENT_IRQL: 2
FAULTING_IP: ndis!ndisOidRequestComplete+8a 8a81bd11 803b05
cmp byte ptr [ebx],5
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xD1
PROCESS_NAME: System
TRAP_FRAME: 8dd07aa0 -- (.trap 0xffffffff8dd07aa0) ErrCode = 00000000
eax=00000200 ebx=00000000 ecx=00000001 edx=00000000 esi=8dd07b4c
edi=a277f5a4 eip=8a81bd11 esp=8dd07b14 ebp=8dd07b34 iopl=0 nv
up ei pl zr na pe nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030
gs=0000 efl=00010246
ndis!ndisOidRequestComplete+0x8a:
8a81bd11 803b05 cmp byte ptr [ebx],5 ds:0023:00000000=??
Resetting default scope
LAST_CONTROL_TRANSFER: from 8a81bd11 to 846605fb
STACK_TEXT:
8dd07aa0 8a81bd11 badb0d00 00000000 8dd07ac0 nt!KiTrap0E+0x2cf
8dd07b34 8a81c8b9 8dd07b4c 8c840008 870c1618
ndis!ndisOidRequestComplete+0x8a
8dd07b68 952b411b 8963b0f0 a277f5a4 00000000
ndis!NdisFOidRequestComplete+0x6a
8dd07b88 8a81c19d 870c1618 8c840008 00000000
pacer!PcFilterRequestComplete+0x5b
8dd07bbc 8a843572 02d07bd4 00000000 89ac60e0
ndis!ndisOidRequestComplete+0x516
8dd07bf4 8a843805 00ac60e0 8c840008 00000000
ndis!ndisMOidRequestCompleteInternal+0xd0
8dd07c18 8a87a765 02ac60e0 00000000 8c840008
ndis!ndisCompleteLegacyRequest+0xdb
8dd07c38 95a831c5 89ac60e0 00000000 89ad20e0
ndis!NdisMSetInformationComplete+0x81
8dd07c54 8a87506f 8a1d48e8 8a1d4908 00000000
fxwrap!PtRequestComplete+0x61
8dd07c70 8a81c05b 876f54c0 8966f0f0 00000000
ndis!ndisCompleteOidRequestToRequest+0x4a
8dd07ca4 8a8704b2 00d07cbc 89ad20e0 8a85a000
ndis!ndisOidRequestComplete+0x3d4
8dd07ce8 8a823221 00ad20e0 8966f190 86a58638
ndis!ndisMDoOidRequest+0x528
8dd07d00 8469ca6b 8966f188 00000000 86a58638
ndis!ndisDoOidRequests+0x4d
8dd07d50 84827fda 00000000 92ed9892 00000000 nt!ExpWorkerThread+0x10d
8dd07d90 846d01f9 8469c95e 00000000 00000000
nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19
STACK_COMMAND: kb
FOLLOWUP_IP: pacer!PcFilterRequestComplete+5b 952b411b 56
push esi
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: pacer!PcFilterRequestComplete+5b
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: pacer
IMAGE_NAME: pacer.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc916
FAILURE_BUCKET_ID: 0xD1_pacer!PcFilterRequestComplete+5b
BUCKET_ID: 0xD1_pacer!PcFilterRequestComplete+5b
Followup: MachineOwner
thanks for any input.

Answer 1

You write that it happens during uninstall. Is it uninstall or driver disable as well? I'll assume it's driver disable, don't see any reason why this should happen on uninstall exclusively. The failure happens in your set OID completion routine. More information is needed in order to analyze, specifically the view of pAdapt and MiniportHandle structs. However, most probable cause is lack of synchronization - for example, in this case it might happen if your driver has already deallocated the pAdapt context and the completion was invoked after that (again, this is just an assumption, need more data to give more certain answer).