Vadim,
Did you ever investigate your solution #3 further?
Why is this problem with double indications happening anyway?
Where in the driver hierarchy, is the WinPkFlt LWF driver positioned in relation to the current Wireshark’s NPCAP driver ?
Is the WinPkFlt LWF driver always BELOW* the Wireshark’s NPCAP driver …or is their relationship affected by their order of installation ?
Is there a diagram of WinPkFlt LWF and NPCAP driver and these pesky NDIS loopbacks anywhere to elucidate all of this ?
* BELOW = closer to the NDIS miniport (adapter driver).