You must not use KeWaitFor… at IRQL >= DISPATH_LEVEL if timeout is not equal zero. The problem is sometime NotifyEvent occures at DISPATCH_LEVEL and you should handle it immidiatly. So the one way is to copy net packe, hold them and return from NotifyEvent. On PASSIVE_LEVEL you can wait your application and then renew packet.
