This is not a supported approach, and has multiple caveats, one of which is if this is TCP at any of the transport layers (TRANSPORT, STREAM_PACKET, RECV_ACCEPT,...) then you will hit the stack's internal TCP processing locking mechanisms and potentially deadlock.
If you are sitting at the network layers (IPPACKET) or are acting on non TCP (RAW, UDP, ICMP, etc) at the transport layers , then you can do your injection inline (no worker thread needed). The classify will still return BLOCK, but the clone and inject are called from within the classify itself.
Hope this helps,
Dusty Harper [MSFT]
Microsoft Corporation
------------------------------------------------------------
This posting is provided "AS IS", with NO warranties and confers NO rights
------------------------------------------------------------
