Buffer overflow on processing IOCTL_NDIS_QUERY_SELECTED_STATS NDIS request.
vulners.com/securityvulns/securityvulns:doc:15330