From - Tue Oct 28 14:03:28 1997
Path: news.mitre.org!blanket.mitre.org!news.tufts.edu!cam-news-feed5.bbnplanet.com!cam-news-hub1.bbnplanet.com!news.bbnplanet.com!news.idt.net!news-peer-east.sprintlink.net!news-peer.sprintlink.net!news-pull.sprintlink.net!news-in-east.sprintlink.net!news.sprintlink.net!Sprint!206.53.103.4!southwind.net!symbios.com!news
From: Russell Johnson <too.many@spam.com>
Newsgroups: comp.os.ms-windows.programmer.nt.kernel-mode
Subject: Re: NdisMIndicateReceivePacket
Date: Tue, 28 Oct 1997 09:02:45 -0700
Organization: Symbios Logic
Lines: 54
Message-ID: <34560CA5.3F9E@spam.com>
References: <01bce0c1$bc738ad0$d0b262c7@dcxsys02> <3452C97D.192C@ftp.com> <632m9s$76e@news.microsoft.com>
NNTP-Posting-Host: rjohnsonpc.co.symbios.com
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
X-Mailer: Mozilla 3.0 (WinNT; I)

kyleb wrote:
> 
> indicate packet works fine.
> the first buffer in the packet must contain at least the lookahead size that
> was set by the protocols.
> 

NdisMIndicateReceivePacket() does not work with > 1 buffer in NT 4.0 or
NT 4.0 SP1.  I traced into the code and it only reports the first buffer
with a total length of the entire packet to each protocol.  The code
does something like the following:

#define HEADER_LENGTH 14

NdisMIndicateReceivePacket( ... PtrPacket ... )
{
    if (protocol is NDIS 3)
    {
        UINT  length;
        UINT  bufferLength;
        PVOID ptrBufferData;
        PNDIS_BUFFER  ptrBuffer;
        PNDIS_BUFFER  ptrFirstBuffer;

        length = 0;
        NdisQueryPacket( PtrPacket, NULL, NULL, &ptrFirstBuffer, NULL );
        ptrBuffer = ptrFirstBuffer;
        while (ptrBuffer != NULL)
        {
            NdisQueryBuffer( ptrBuffer, &ptrBufferData, &bufferLength );
            length += bufferLength;
            NdisGetNextBuffer( ptrBuffer, &ptrBuffer );
        }
        NdisQueryBuffer( ptrFirstBuffer,&ptrBufferData,&bufferLength );
        ProtocolReceive( ProtocolBindingContext, 
                         MacReceiveContext,
                         ptrBufferData, HEADER_LENGTH,
                         ptrBufferData + HEADER_LENGTH, 
                         length - HEADER_LENGTH,
                         length );
    }
    else // protocol is NDIS 4
    {
        ProtocolReceivePacket( ... PtrPacket ... );
    }
}

Notice that the ProtocolReceive() routine is hard-coded to use only one
buffer.  So NDIS for NT 4.0 and 4.0 with SP1 both have a bug where they
report the proper length of the entire packet but they only report the
first buffer to the protocols.  I reported this as a bug to Microsoft
sometime in February '97 and they said it would be fixed in SP 3
(implying that the same bug exists in SP 2).  I haven't tested SP 3 yet
however...