test traffic with iperf3 ， windows 10 occur blue screen error

Question

hello all，
when I was developing the network card driver for windows 10, when I used iperf3 to test traffic,
it ran for about 5 hours, and a blue screen appeared. There was a problem when calling the NdisMAllocateNetBufferSGList api.
stack：

---

**

Bugcheck Analysis

**

---

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000028, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff80736d120f6, address which referenced memory
Debugging Details:

------------------

KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 0
BUILD_VERSION_STRING: 19041.1.amd64fre.vb_release.191206-1406
DUMP_TYPE: 0
BUGCHECK_P1: 28
BUGCHECK_P2: 2
BUGCHECK_P3: 0
BUGCHECK_P4: fffff80736d120f6
READ_ADDRESS: 0000000000000028
CURRENT_IRQL: 2
FAULTING_IP:
ndis!NdisMAllocateNetBufferSGList+3d4f6
fffff80736d120f6 8b4728 mov eax,dword ptr [rdi+28h] CPU_COUNT: 14 CPU_MHZ: af8 CPU_VENDOR: GenuineIntel CPU_FAMILY: 6 CPU_MODEL: a5 CPU_STEPPING: 5 CPU_MICROCODE: 6,a5,5,0 (F,M,S,R) SIG: E2'00000000 (cache) E2'00000000 (init) DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT BUGCHECK_STR: AV PROCESS_NAME: iperf3.exe ANALYSIS_SESSION_HOST: IVES-LAB-1 ANALYSIS_SESSION_TIME: 09-28-2022 09:54:37.0073 ANALYSIS_VERSION: 10.0.18362.1 amd64fre TRAP_FRAME: ffffe489a783dff0 -- (.trap 0xffffe489a783dff0) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=0000000000000100 rbx=0000000000000000 rcx=0000000000000000 rdx=ffffc28685343a40 rsi=0000000000000000 rdi=0000000000000000 rip=fffff80736d120f6 rsp=ffffe489a783e180 rbp=ffffc2868ab1f1a0 r8=ffffc2868ab48460 r9=0000000000000001 r10=fffff8072ee0d410 r11=0000000000000000 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl zr na po nc ndis!NdisMAllocateNetBufferSGList+0x3d4f6: fffff80736d120f6 8b4728 mov eax,dword ptr [rdi+28h] ds:0000000000000028=???????? Resetting default scope LAST_CONTROL_TRANSFER: from fffff80732f13032 to fffff80732dffc70 STACK_TEXT: ffffe489a783d6f8 fffff80732f13032 : ffffe489a783d860 fffff80732d7d480 0000000000000000 0000000000000000 : nt!DbgBreakPointWithStatus ffffe489a783d700 fffff80732f12616 : 0000000000000003 ffffe489a783d860 fffff80732e0ccc0 00000000000000d1 : nt!KiBugCheckDebugBreak+0x12 ffffe489a783d760 fffff80732df7ed7 : 30548e40b5dd19a9 edcc3646b1a4802e ffffc28685343a40 cd556e244e94b4ba : nt!KeBugCheck2+0x946 ffffe489a783de70 fffff80732e09d69 : 000000000000000a 0000000000000028 0000000000000002 0000000000000000 : nt!KeBugCheckEx+0x107 ffffe489a783deb0 fffff80732e06069 : ffffc2868ab23020 edcc3646b1a4802e 58842cea00000000 00001f80009402ba : nt!KiBugCheckDispatch+0x69 ffffe489a783dff0 fffff80736d120f6 : ffffc2868df3f520 ffffc2868ab1f050 0000000000000040 ffffc2868df3f610 : nt!KiPageFault+0x469 ffffe489a783e180 fffff8072ee0ba85 : ffffc2868ab23020 ffffc2868ab235a8 ffffc2868ab48460 ffffc2868ab1f1a0 : ndis!NdisMAllocateNetBufferSGList+0x3d4f6 ffffe489a783e240 fffff8072ee0a986 : ffffc2868ab23020 ffffc2868ab235a8 ffffc286904cf270 0000000000000000 : nbln1045!MiniportSendNetBufferList+0x3d5 [C:\Users\ives.yu\Desktop\2\nbln1045\nbln1045\mp_nic.c @ 446] ffffe489a783e2b0 fffff8072ee09f8e : ffffc2868ab23020 ffffc286904cf270 ffffe48900000001 0000000000000000 : nbln1045!SelectQueueSendBufferLists+0x6e6 [C:\Users\ives.yu\Desktop\2\nbln1045\nbln1045\mp_main.c @ 1420] ffffe489a783e320 fffff80736cd50af : ffffc2868ab23020 ffffc286904cf270 0000000000000000 0000000000000001 : nbln1045!MPSendNetBufferLists+0x8e [C:\Users\ives.yu\Desktop\2\nbln1045\nbln1045\mp_main.c @ 1489] ffffe489a783e360 fffff80736cd4f9e : fffff80736991000 ffffc286904cf270 ffffc28600000000 fffff80736cd4f90 : ndis!ndisMSendNBLToMiniportInternal+0xff ffffe489a783e430 fffff80736cd58e9 : ffffc286904cf201 ffffc286904cf270 ffffc28689b14b90 fffff80736f243c4 : ndis!ndisMSendNBLToMiniport+0xe ffffe489a783e470 fffff80736d0e291 : 0000000000000000 ffffe489a783e539 ffffc2868ab1f1a0 0000000000000003 : ndis!ndisCallSendHandler+0x59 ffffe489a783e4c0 fffff80736cd25dd : 0000000000000000 ffffc2868ab1f1a0 ffffc2869208d6a0 fffff807371d1200 : ndis!ndisInvokeNextSendHandler+0x191 ffffe489a783e590 fffff80736f641fd : ffffc28689b25010 ffffc286904cf270 0000000000000000 fffff80700000000 : ndis!NdisSendNetBufferLists+0x17d ffffe489a783e690 fffff80736f63f27 : ffffc28692987810 0000000000000000 0000000000000800 ffffc2868fdfc600 : tcpip!FlpSendPacketsHelper+0x2bd ffffe489a783e740 fffff80736f1f636 : 0000000000000000 fffff807370d9230 ffffc286850158e8 0000000000000000 : tcpip!FlSendPackets+0x57 ffffe489a783e770 fffff80736f1eaf3 : 00005114b8ed0004 0000000000000000 fffff807370d9230 ffffc28600000000 : tcpip!IppFragmentPackets+0x2a6 ffffe489a783e850 fffff80736f1e778 : ffffc286850158e8 0000000000000001 0000000000000000 000000000000d5a9 : tcpip!IppDispatchSendPacketHelper+0xbf ffffe489a783e920 fffff80736f1d3c8 : ffffc286850159c8 0000000000000007 0000000000000000 ffffc286850158e8 : tcpip!IppPacketizeDatagrams+0x2e8 ffffe489a783ea50 fffff80736f1beb9 : 0000000000000000 0000000000000000 fffff807370d9230 ffffc286902f2280 : tcpip!IppSendDatagramsCommon+0x498 ffffe489a783ebd0 fffff80736ef0fe5 : ffffc286876ee040 ffffe48900000014 0000000000000000 ffffc286902f2280 : tcpip!IpNlpFastSendDatagram+0x349 ffffe489a783ec90 fffff80736eef314 : ffffe489a783f280 ffffe489a783f310 ffffe489a783f120 0000000000000000 : tcpip!TcpTcbSend+0x1755 ffffe489a783f020 fffff80736eeef7e : 0000000000000000 0000000000000000 ffffe489a783f280 fffff80736eeef50 : tcpip!TcpEnqueueTcbSend+0x374 ffffe489a783f160 fffff80732c27328 : ffffc28685235b01 0000000000000000 0000000000000000 0000000000000001 : tcpip!TcpTlConnectionSendCalloutRoutine+0x2e ffffe489a783f1a0 fffff80732c2729d : fffff80736eeef50 ffffe489a783f280 ffffc28694f64208 fffffbfdfeff7c28 : nt!KeExpandKernelStackAndCalloutInternal+0x78 ffffe489a783f210 fffff80736f55d30 : 0000000000000000 0000000000000000 ffffc28694f44000 0000000000000000 : nt!KeExpandKernelStackAndCalloutEx+0x1d ffffe489a783f250 fffff8074ab9e0d0 : ffffc28694f64208 ffffc28685235be0 0000000000020000 ffffc28694f64208 : tcpip!TcpTlConnectionSend+0x80 ffffe489a783f2c0 fffff8074ab9defa : ffffc28685235be0 ffffe489a783fa80 ffffc286908fc970 ffffc28694f64000 : afd!AfdTLStartBufferedVcSend+0xa0 ffffe489a783f370 fffff8074ab84010 : ffffc28694f64208 000000000000026c ffffc28600020000 ffffe489a783f858 : afd!AfdFastConnectionSend+0x2a2 ffffe489a783f440 fffff8073300e5b8 : 0000000000000000 0000000000000000 ffffe489a783fa80 ffffc2869410be20 : afd!AfdFastIoDeviceControl+0xf90 ffffe489a783f7e0 fffff8073300de76 : 0000000000000001 000000000000022c 0000000000000000 0000000000000000 : nt!IopXxxControlFile+0x728 ffffe489a783f920 fffff80732e097b5 : 0000000000000000 0000000000000000 0000000000000288 fffff807330c18f0 : nt!NtDeviceIoControlFile+0x56 ffffe489a783f990 00007ffc8790ce24 : 00007ffc847593bf 00000000c00000a3 00000000ffffc4a0 00000001004167d8 : nt!KiSystemServiceCopyEnd+0x25 00000000ffffc468 00007ffc847593bf : 00000000c00000a3 00000000ffffc4a0 00000001004167d8 00000000ffffc598 : ntdll!NtDeviceIoControlFile+0x14 00000000ffffc470 00007ffc8476d2c1 : 00000000000002c8 0000000000000001 00000000ffffc86c 00000000ffffc86c : mswsock!WSPSend+0x1ff 00000000ffffc550 00007ffc86d5e8c4 : 0000000000020000 0000000000000008 00000006007780b0 000000018012603b : mswsock!WSPSendTo+0xd661 00000000ffffc720 00000001800a99db : 0000000000020000 00000000ffffc870 00000001801edb40 0000000000000001 : ws2_32!WSASendTo+0x114 00000000ffffc7b0 0000000000020000 : 00000000ffffc870 00000001801edb40 0000000000000001 0000000000000000 : cygwin1!feinitialise+0x3352b 00000000ffffc7b8 00000000ffffc870 : 00000001801edb40 0000000000000001 0000000000000000 0000000000000000 : 0x20000 00000000ffffc7c0 00000001801edb40 : 0000000000000001 0000000000000000 0000000000000000 000006ff00000000 : 0xffffc870 00000000ffffc7c8 0000000000000001 : 0000000000000000 0000000000000000 000006ff00000000 0000000000000000 : cygwin1!alloca+0x3550 00000000ffffc7d0 0000000000000000 : 0000000000000000 000006ff00000000 0000000000000000 0000000000000000 : 0x1 THREAD_SHA1_HASH_MOD_FUNC: 56fc1980fcf4667ff32fa4b6417c1092c19f8ca3 THREAD_SHA1_HASH_MOD_FUNC_OFFSET: d53e689a2c5dd7fc6aeb330700449152b037c018 THREAD_SHA1_HASH_MOD: 5d80f5aa125e2e58732189cb87453ddf009833dd FOLLOWUP_IP: nbln1045!MiniportSendNetBufferList+3d5 [C:\Users\ives.yu\Desktop\2\nbln1045\nbln1045\mp_nic.c @ 446] fffff8072ee0ba85 89442430 mov dword ptr [rsp+30h],eax
FAULT_INSTR_CODE: 30244489
FAULTING_SOURCE_LINE: C:\Users\ives.yu\Desktop\2\nbln1045\nbln1045\mp_nic.c
FAULTING_SOURCE_FILE: C:\Users\ives.yu\Desktop\2\nbln1045\nbln1045\mp_nic.c
FAULTING_SOURCE_LINE_NUMBER: 446
FAULTING_SOURCE_CODE:
442: MP_SET_FLAG(pMpTcb, fMP_TCB_WAIT_FOR_MAPPING);
443:
444: MP_RELEASE_SPIN_LOCK(&SendQueue->SendLock, TRUE);
445:

446: SendStatus = NdisMAllocateNetBufferSGList(
447: Adapter->NdisMiniportDmaHandle,
448: NetBufferToSend,
449: pMpTcb,
450: NDIS_SG_LIST_WRITE_TO_DEVICE,
451: NULL,
SYMBOL_STACK_INDEX: 7
SYMBOL_NAME: nbln1045!MiniportSendNetBufferList+3d5
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nbln1045
IMAGE_NAME: nbln1045.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 6332e24e
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 3d5
FAILURE_BUCKET_ID: AV_nbln1045!MiniportSendNetBufferList
BUCKET_ID: AV_nbln1045!MiniportSendNetBufferList
PRIMARY_PROBLEM_CLASS: AV_nbln1045!MiniportSendNetBufferList
TARGET_TIME: 2047-10-01T18:28:59.000Z
OSBUILD: 19041
OSSERVICEPACK: 0
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2034-09-24 19:23:52
BUILDDATESTAMP_STR: 191206-1406
BUILDLAB_STR: vb_release
BUILDOSVER_STR: 10.0.19041.1.amd64fre.vb_release.191206-1406
ANALYSIS_SESSION_ELAPSED_TIME: 9429
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:av_nbln1045!miniportsendnetbufferlist
FAILURE_ID_HASH: {ca024185-1da5-cc39-817a-3c9482fdb021}
Followup: MachineOwner