//===============================================================
NTSTATUS MyClientEventReceive(PVOID TdiEventContext,
    CONNECTION_CONTEXT  ConnectionContext,
    ULONG  ReceiveFlags, ULONG BytesIndicated,
    ULONG  BytesAvailable, ULONG  *BytesTaken,
    PVOID  Tsdu, PIRP* IoRequestPacket)
{

    .
    .
    .

    OriginalClientEventReceive(TdiEventContext, ConnectionContext,ReceiveFlags, BytesIndicated,
        BytesAvailable, BytesTaken, Tsdu, IoRequestPacket);

    .
    .
    .
}

NTSTATUS ClientEventConnect(PVOID EventContext,LONG AddressLength,PVOID Address,
                LONG UserDataLength,PVOID UserData,LONG OptionsLength,PVOID Options, 
                PVOID   *ConnectionContext,PIRP*AcceptIrp)
{
    //...
    Status= OriginalConnectHandler(EventContext,AddressLength,Address,UserDataLength,UserData,
                                   OptionsLength,Options,ConnectionContext,AcceptIrp);

   IoCopyCurrentIrpStackLocationToNext(*AcceptIrp);
   IoSetCompletionRoutine(*AcceptIrp, CompletionConnect, 0, TRUE, TRUE, TRUE);
   IoSetNextIrpStackLocation(*AcceptIrp);

   //...
   return Status;
}

//==========================================================================================
//completion routine
NTSTATUS CompletionConnect( IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp, IN PVOID Context )
{
    if (Irp->PendingReturned)
        IoMarkIrpPending(Irp);  

    return STATUS_MORE_PROCESSING_REQUIRED;
}

   Irp->IoStatus.Status= STATUS_SUCCESS;
   IoCompleteRequest(Irp, IO_NO_INCREMENT); //здесь Irp == *AcceptIrp в ClientEventConnect

O>NTSTATUS ClientEventConnect(PVOID EventContext,LONG AddressLength,PVOID Address,
O>                LONG UserDataLength,PVOID UserData,LONG OptionsLength,PVOID Options, 
O>                PVOID   *ConnectionContext,PIRP*AcceptIrp)
O>{
O>    //...
O>    Status= OriginalConnectHandler(EventContext,AddressLength,Address,UserDataLength,UserData,
O>                                   OptionsLength,Options,ConnectionContext,AcceptIrp);

O>   IoCopyCurrentIrpStackLocationToNext(*AcceptIrp);
O>   IoSetCompletionRoutine(*AcceptIrp, CompletionConnect, 0, TRUE, TRUE, TRUE);
O>   IoSetNextIrpStackLocation(*AcceptIrp);

O>   //...
O>   return Status;
O>}

O>//==========================================================================================
O>//completion routine
O>NTSTATUS CompletionConnect( IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp, IN PVOID Context )
O>{
O>    if (Irp->PendingReturned)
O>        IoMarkIrpPending(Irp);  

O>    return STATUS_MORE_PROCESSING_REQUIRED;
O>}
O>

   Irp->>IoStatus.Status= STATUS_SUCCESS;
O>   IoCompleteRequest(Irp, IO_NO_INCREMENT); //здесь Irp == *AcceptIrp в ClientEventConnect
O>

   Irp->>IoStatus.Status= STATUS_INSUFFICIENT_RESOURCES; //как вариант STATUS_UNSUCCESSFUL
   IoCompleteRequest(Irp, IO_NO_INCREMENT);

   Irp->>>IoStatus.Status= STATUS_INSUFFICIENT_RESOURCES; //как вариант STATUS_UNSUCCESSFUL
TC>   IoCompleteRequest(Irp, IO_NO_INCREMENT); 
TC>

PIRP Irp;
PDEVICE_OBJECT pDev= IoGetRelatedDeviceObject(pConnectionInfo->Handle);  //pConnectionInfo - моя структура
if ( pDev ) {
   Irp = TdiBuildInternalDeviceControlIrp(TDI_DISCONNECT, pDev, pConnectionInfo->Handle, NULL, NULL);
   if (Irp) {       
       TdiBuildDisconnect(Irp, pDev, pConnectionInfo->Handle, NULL, NULL, NULL, TDI_DISCONNECT_RELEASE, NULL, NULL);
       IoCallDriver(pDev, Irp);                        
   }
}

//=============================================================================
// TDI_EVENT_RECEIVE
// 
NTSTATUS HookEventReceive(
    IN PVOID    TdiEventContext,
    IN CONNECTION_CONTEXT    ConnectionContext,
    IN ULONG    ReceiveFlags,
    IN ULONG    BytesIndicated,
    IN ULONG    BytesAvailable,
    OUT ULONG    *BytesTaken,
    IN PVOID    Tsdu,
    OUT PIRP    *IoRequestPacket    
    )
{

  //...

      //call original handler
    ntStatus = EventReceive(EventReceiveContext,
        ConnectionContext,
        ReceiveFlags,
        BytesIndicated,
        BytesAvailable,
        BytesTaken,
        Tsdu,
        IoRequestPacket);

    if( ntStatus == STATUS_MORE_PROCESSING_REQUIRED    && IoRequestPacket && *IoRequestPacket ) {
        PIO_STACK_LOCATION        IrpSp = NULL;
        PSF_DEVICE_EXTENSION    pDeviceExtension = pConnInfo->DeviceExtension;
        //
        // Handle TDI_RECEIVE request passdown
        // -----------------------------------
        // The caller has provided a TDI_RECEIVE request at IoRequestPacket
        // to obtain the remaining Tdsu data.
        //
        //    We want to filter processing of the request using our own completion handler. 
        //    The key steps are:
        //
        //   1.) Copy the current IRP stack location to next.
        //   2.) Set our completion routine.
        //   3.) Emulate the effect of IoCallDriver in advancing the
        //       IRP stack location.
        //
        
        // Get the current I/O stack location.
        IrpSp = IoGetCurrentIrpStackLocation( (*IoRequestPacket) );
        IoCopyCurrentIrpStackLocationToNext( (*IoRequestPacket) );

        // set completion routine            
        IoSetCompletionRoutine(
            (*IoRequestPacket),
            HookEventReceiveCompletion,
            pDeviceExtension,    //ВАЖНО: вот здесь я сохраняю в качестве контекста указатель на pDeviceExtension
            TRUE,
            TRUE,
            TRUE
            );

        IoSetNextIrpStackLocation(*IoRequestPacket);            
    }


    //error or restrict
    if (STATUS_DATA_NOT_ACCEPTED == ntStatus) {
        if (BytesTaken) { *BytesTaken = 0; }
    }

  return ntStatus;
}


//=============================================================================
// HookEventReceive IoCompletion
//
//note:
//     
NTSTATUS HookEventReceiveCompletion( PDEVICE_OBJECT DeviceObject, PIRP Irp, void *Context )
{        
    PSF_DEVICE_EXTENSION        pDeviceExtension = NULL;
    
    if ( !DeviceObject || !Irp || !Context ) { return STATUS_SUCCESS; }
    
    pDeviceExtension    = (PSF_DEVICE_EXTENSION)(Context);
        
    // propagate the IRP pending flag
    if (Irp->PendingReturned) {
        IoMarkIrpPending(Irp);
    }
    
    //pDeviceExtension->pFilterDeviceObject - это мое фильтрующее устройство приатаченное к \Device\Tcp
    if (pDeviceExtension->pFilterDeviceObject != DeviceObject) {
        //вот сюда очень часто попадаю!!!
        DBG_PRINT(DBG_MSG_ERROR, "invalid device object pointer!");
        return STATUS_SUCCESS;
    }    
    
    //...    
    
    //always return STATUS_SUCCESS - для того чтобы другие драйвера, подписавшие IoCompletion для данного Irp, тоже получили управление
    return STATUS_SUCCESS;    
}

вариант 1: сразу же сваливать из HookEventReceiveCompletion (как я делаю это сейчас)
вариант 2: обрабатывать далее данный Irp (в принципе вполне реально, информации из Irp мне вполне достаточно, но меня смущает не мой DeviceObject)