1.1 --- a/xennet/xennet_rx.c	Thu Sep 25 20:33:16 2014 +1000
     1.2 +++ b/xennet/xennet_rx.c	Thu Sep 25 20:36:51 2014 +1000
     1.3 @@ -87,7 +87,9 @@ ref_pb(struct xennet_info *xi, shared_bu
     1.4  static __inline VOID
     1.5  put_pb_on_freelist(struct xennet_info *xi, shared_buffer_t *pb)
     1.6  {
     1.7 -  if (InterlockedDecrement(&pb->ref_count) == 0)
     1.8 +  int ref = InterlockedDecrement(&pb->ref_count);
     1.9 +  XN_ASSERT(ref >= 0);
    1.10 +  if (ref == 0)
    1.11    {
    1.12      //NdisAdjustBufferLength(pb->buffer, PAGE_SIZE);
    1.13      //NDIS_BUFFER_LINKAGE(pb->buffer) = NULL;
    1.14 @@ -390,12 +392,17 @@ XenNet_MakePacket(struct xennet_info *xi
    1.15      header_buf = NULL;
    1.16      /* get all the packet into the header */
    1.17      XenNet_BuildHeader(pi, pi->first_mdl_virtual, PAGE_SIZE);
    1.18 +
    1.19 +    /* have to create a partial mdl over the pb MDL as the pb mdl has a Next which breaks things */
    1.20 +    curr_mdl = IoAllocateMdl(pi->first_mdl_virtual, pi->total_length, FALSE, FALSE, NULL);
    1.21 +    XN_ASSERT(curr_mdl);
    1.22 +    IoBuildPartialMdl(pi->first_mdl, curr_mdl, pi->first_mdl_virtual, pi->total_length);
    1.23      #if NTDDI_VERSION < NTDDI_VISTA
    1.24 -    NdisChainBufferAtBack(packet, pi->first_mdl);
    1.25 +    NdisChainBufferAtBack(packet, curr_mdl);
    1.26      PACKET_FIRST_PB(packet) = pi->first_pb;
    1.27      #else
    1.28 -    NET_BUFFER_FIRST_MDL(packet) = pi->first_mdl;
    1.29 -    NET_BUFFER_CURRENT_MDL(packet) = pi->first_mdl;
    1.30 +    NET_BUFFER_FIRST_MDL(packet) = curr_mdl;
    1.31 +    NET_BUFFER_CURRENT_MDL(packet) = curr_mdl;
    1.32      NET_BUFFER_CURRENT_MDL_OFFSET(packet) = 0;
    1.33      NET_BUFFER_DATA_OFFSET(packet) = 0;
    1.34      NET_BUFFER_DATA_LENGTH(packet) = pi->total_length;
    1.35 @@ -429,6 +436,7 @@ XenNet_MakePacket(struct xennet_info *xi
    1.36      XN_ASSERT(pi->header_length <= MAX_ETH_HEADER_LENGTH + MAX_LOOKAHEAD_LENGTH);
    1.37      header_buf->mdl->ByteCount = pi->header_length;
    1.38      mdl_head = mdl_tail = curr_mdl = header_buf->mdl;
    1.39 +    XN_ASSERT(!header_buf->mdl->Next);
    1.40      #if NTDDI_VERSION < NTDDI_VISTA
    1.41      PACKET_FIRST_PB(packet) = header_buf;
    1.42      header_buf->next = pi->curr_pb;