noticed the following in the skeleton code from visual DDK.

NTSTATUS nothingDefaultHandler(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
{
Irp->IoStatus.Status = STATUS_NOT_SUPPORTED;
Irp->IoStatus.Information = 0;
IoCompleteRequest(Irp, IO_NO_INCREMENT);
return Irp->IoStatus.Status;
}

by completing the request and then touching the IRP to return the status you risk a bugcheck. The IRP may have been freed already and or the pool memory used may have been reallocated.

Golden Rule. After you complete or Pass down an IRP forget about it ( do not touch ) .

Don’t know if this has been reported or not but I thought I’d drop in and let you know!! Thanks for the wonderful tool BTW!