环境：从用户态通过DeviceIoControl传入一个Event变量，驱动层在满足条件的时候，调用KeSetEvent出发该事件。

代码：
KIRQL oldirql;
       
ASSERT(KeGetCurrentIrql()<= DISPATCH_LEVEL);
KeRaiseIrql(DISPATCH_LEVEL,&oldirql);
  
if( KeyBoardWatchFlag == ENABLE_KEYBOARD_WATCH )
{

    KeSetEvent( gpevtKeyPressNotify, IO_NO_INCREMENT, FALSE );
}       
KeLowerIrql(oldirql);

问题报告：
STACK_TEXT:  
f7a427b0 8053f0c7 00000003 f7a42b0c 00000000 nt!RtlpBreakWithStatusInstruction
f7a427fc 8053fb9e 00000003 00000012 804eeddb nt!KiBugCheckDebugBreak+0x19
f7a42bdc 804e9a9c 0000000a 00000012 0000001c nt!KeBugCheck2+0x574
f7a42bdc 804eeddb 0000000a 00000012 0000001c nt!KiTrap0E+0x238
f7a42c7c f7981180 84541108 00000000 00000000 nt!KeSetEvent+0x32
f7a42c98 f7980ead 804e340f 00000001 00000000 MyDriver!SendKeyPressNotify+0x60 [d:\¹¤×÷Îĵµ\רҵ°æ°²×°³ÌÐò\MyDriver\kbwatchimpl.c @ 197]
f7a42cb8 804ea8ef 845fd8d8 858a1780 00000000 MyDriver!IrpFDOReadCompletionRoutine+0x9d [d:\¹¤×÷Îĵµ\רҵ°æ°²×°³ÌÐò\MyDriver\irpfdoread.c @ 88]
f7a42ce8 f791831c 85e1bca0 85e1bd40 00000002 nt!IopfCompleteRequest+0xa2
f7a42d04 f73f0ccd 0000000c 85e1bd4c 858a18ec kbdclass!KeyboardClassServiceCallback+0x182
f7a42d28 f7949ace 00000001 f7a42d44 00000001 kbdhid!KbdHid_InsertCodesIntoQueue+0x8b
f7a42d3c f7949b54 0000009e 00000000 f73f0c42 HIDPARSE!HidP_KbdPutKey+0x30
f7a42d58 f7949e3a 00000004 00000000 857ef050 HIDPARSE!HidP_TranslateUsage+0x7a
f7a42d88 f73f0f16 857ef0ed 0000000e 00000000 HIDPARSE!HidP_TranslateUsageAndPagesToI8042ScanCodes+0x64
f7a42dbc 804ea8ef 00000000 017ef238 85e1bca0 kbdhid!KbdHid_ReadComplete+0x16e
f7a42dec f7798e70 f7a42df4 f7a42df4 85e3f740 nt!IopfCompleteRequest+0xa2
f7a42e08 f7799044 02e3f728 85eb19c0 00000009 HIDCLASS!HidpDistributeInterruptReport+0xae
f7a42e48 804ea8ef 00000000 8581e008 857fa0fc HIDCLASS!HidpInterruptReadComplete+0x17a
f7a42e78 f7391ee5 8581e008 852cfdb8 85e68028 nt!IopfCompleteRequest+0xa2
f7a42ee0 f7392b57 85e53650 00000000 85e687d8 USBPORT!USBPORT_CompleteTransfer+0x373
f7a42f10 f7393754 026e6f44 85e680e0 85e680e0 USBPORT!USBPORT_DoneTransfer+0x137
f7a42f48 f7394f6a 85e68028 804ee6ec 85e68230 USBPORT!USBPORT_FlushDoneTransferList+0x16c
f7a42f74 f73a2fb0 85e68028 804ee6ec 85e68028 USBPORT!USBPORT_DpcWorker+0x224
f7a42fb0 f73a3128 85e68028 00000001 85e3ebe0 USBPORT!USBPORT_IsrDpcWorker+0x37e
f7a42fcc 804e5d12 85e6864c 6b755044 00000000 USBPORT!USBPORT_IsrDpc+0x166
f7a42ff4 804e587d f5be4d44 00000000 00000000 nt!KiRetireDpcList+0x61
f7a42ff8 f5be4d44 00000000 00000000 00000000 nt!KiDispatchInterrupt+0x2b
WARNING: Frame IP not in any known module. Following frames may be wrong.
804e587d 00000000 00000009 0081850f bb830000 0xf5be4d44

STACK_COMMAND:  kb

FOLLOWUP_IP:
MyDriver!SendKeyPressNotify+60 [d:\¹¤×÷Îĵµ\רҵ°æ°²×°³ÌÐò\MyDriver\kbwatchimpl.c @ 197]
f7981180 8a4dff          mov     cl,byte ptr [ebp-1]

FAULTING_SOURCE_CODE:  
   193: #endif
   194:                 KeSetEvent( gpevtKeyPressNotify, IO_NO_INCREMENT, FALSE );
   195:         }
   196:        
>  197:         KeLowerIrql(oldirql);
   198: }?2?k
Microsoft C/C++ MSF 7.00
DS

SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  MyDriver!SendKeyPressNotify+60

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: MyDriver

IMAGE_NAME:  MyDriver.dat

DEBUG_FLR_IMAGE_TIMESTAMP:  4ad2ebea

FAILURE_BUCKET_ID:  0xA_MyDriver!SendKeyPressNotify+60

BUCKET_ID:  0xA_MyDriver!SendKeyPressNotify+60

Followup: MachineOwner

错误码：
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000012, memory referenced
Arg2: 0000001c, IRQL
Arg3: 00000000, bitfield :
        bit 0 : value 0 = read operation, 1 = write operation
        bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 804eeddb, address which referenced memory

望大牛们指点.....

[课程]FART 脱壳王！加量不加价！FART作者讲授！