From: keyhaede on
Hi all

I give more information about the issues.

ndis!ndisPnPRemoveDevice function assemblies
Below I prove the miniport has already released all NET BUFFER LIST comes
from windows.

--------------------------------------------------------------------------

89d68a66 f7402000000200 test dword ptr [eax+20h],20000h
89d68a6d 7418 je ndis!ndisPnPRemoveDevice+0x1ac (89d68a87)
89d68a6f 80781d02 cmp byte ptr [eax+1Dh],2
89d68a73 7212 jb ndis!ndisPnPRemoveDevice+0x1ac (89d68a87)
89d68a75 68d869cb89 push offset ndis!HighestAcceptableMax+0xd8
(89cb69d8)
89d68a7a 6a4c push 4Ch
89d68a7c ff7014 push dword ptr [eax+14h]
89d68a7f ff7010 push dword ptr [eax+10h]
89d68a82 e86c38f3ff call ndis!WPP_SF_ (89c9c2f3)
89d68a87 8b3d6863cb89 mov edi,dword ptr [ndis!_imp__ExFreePoolWithTag
(89cb6368)]
89d68a8d 53 push ebx
89d68a8e ffb5f4feffff push dword ptr [ebp-10Ch]
89d68a94 ffd7 call edi
89d68a96 eb06 jmp ndis!ndisPnPRemoveDevice+0x1c3 (89d68a9e)
89d68a98 8b3d6863cb89 mov edi,dword ptr [ndis!_imp__ExFreePoolWithTag
(89cb6368)]
89d68a9e 56 push esi
89d68a9f e8ede0ffff call ndis!ndisCloseMiniportBindings (89d66b91)
<<========================== release packets

If any pakcet pending in miniport, it will block here.


89d68aa4 56 push esi
89d68aa5 e8094ff4ff call ndis!ndisDetachFiltersOnMiniport (89cad9b3)
<<========================== detach nataive 80211 filter failed

But my case is block in here. Cannot detach the nwifi filter.
So I am curious what resource or event , I have not returned to windows.



89d68aaa 8b86000a0000 mov eax,dword ptr [esi+0A00h]
89d68ab0 80780c06 cmp byte ptr [eax+0Ch],6
89d68ab4 720b jb ndis!ndisPnPRemoveDevice+0x1e6 (89d68ac1)
89d68ab6 6880000000 push 80h
89d68abb 56 push esi
89d68abc e856def2ff call ndis!ndisPauseMiniport (89c96917)