这样写那里错了？

[wbml]

NTSTATUS
DriverEntry(IN PDRIVER_OBJECT pDriObj,IN PUNICODE_STRING pRegPath)
{
...
//Attach Device
status = IoAttachDevice(g_DevObj,&DevName,&g_OldDevObj);
...
}

NTSTATUS TdiCreateAddrComplate(IN PDEVICE_OBJECT pDevObj,IN PIRP Irp,IN PVOID Context){
PIO_STACK_LOCATION Irps = IoGetCurrentIrpStackLocation(Irp);
PIRP QueryIrp = (PIRP)Context;
TDI_ADDRESS_INFO *pTai = (TDI_ADDRESS_INFO *)ExAllocatePool(NonPagedPool,sizeof (TDI_ADDRESS_INFO_MAX));
NTSTATUS status;

if(pTai != NULL){
PMDL pMdl = IoAllocateMdl(pTai,sizeof(TDI_ADDRESS_INFO_MAX),FALSE,FALSE,NULL);
if (pMdl != NULL) {
MmBuildMdlForNonPagedPool(pMdl);
if (QueryIrp != NULL) {
TdiBuildQueryInformation(QueryIrp,g_OldDevObj,Irps->FileObject,NULL,NULL,TDI_QUERY_ADDRESS_INFO,pMdl);
status = IoCallDriver(g_OldDevObj,QueryIrp);//调用会蓝屏
}


return status;
}

NTSTATUS TdiCreate(IN PDEVICE_OBJECT pDevObj,IN PIRP Irp){
PIO_STACK_LOCATION Irps = IoGetCurrentIrpStackLocation(Irp);
FILE_FULL_EA_INFORMATION *pEA = (FILE_FULL_EA_INFORMATION *)Irp->AssociatedIrp.SystemBuffer;
PIRP QueryIrp;
NTSTATUS status;

if(pEA->EaNameLength == TDI_TRANSPORT_ADDRESS_LENGTH \
&& memcmp(pEA->EaName,TdiTransportAddress,TDI_TRANSPORT_ADDRESS_LENGTH) == 0){
QueryIrp = TdiBuildInternalDeviceControlIrp(TDI_QUERY_ADDRESS_INFO,g_OldDevObj,Irps->FileObject,NULL,NULL);
IoSkipCurrentIrpStackLocation(Irp);
IoSetCompletionRoutine(Irp,TdiCreateAddrComplate,QueryIrp,TRUE,TRUE,TRUE);
status = IoCallDriver(g_OldDevObj,,Irp);
}
else{
if(g_OldDevObj != NULL){
IoSkipCurrentIrpStackLocation(Irp);
status = IoCallDriver(g_OldDevObj,Irp);
}
else{
status = Irp->IoStatus.Status = STATUS_INVALID_PARAMETER;
IoCompleteRequest (Irp, IO_NO_INCREMENT);
}
}

return status;
}

[yinjinzhong]

没有看出来什么地方写错了！呵呵！