NetworkingDriverKit - How can I access packet data?

I've been creating a virtual ethernet interface. I've opened asynchronous communication with a controlling application and every time there are new packets, the controlling app is notified and then asks for the packet data. The packet data is stored in a simple struct, with uint8_t[1600] for the bytes, and uint32_t for the length. The dext is able to populate this struct with dummy data every time a packet is available, with the dummy data visible on the controlling application. However, I'm struggling to fill it with the real packet data.

The IOUserNetworkPacket provides metadata about a packet. It contains a packets timestamp, size, etc, but it doesn't seem to contain the packet's data. There are the GetDataOffset() and GetMemorySegmentOffset() methods which seem to return byte offsets for where the packet data is located in their memory buffer. My instinct tells me to add this offset to the pointer of wherever the packet data is stored. The problem is I have no idea where the packets are actually stored.

I know they are managed by the IOUserNetworkPacketBufferPool, but I don't think that's where their memory is. There is the CopyMemoryDescriptor() method which gives an IOMemoryDescriptor of its contents. I tried using the descriptor to create an IOMemoryMap, using it to call GetAddress(). The pointers to all the mentioned objects lead to junk data.

I must be approaching this entirely wrong. If anyone knows how to access the packet data, or has any ideas, I would appreciate any help. Thanks.

Code snippet within IOUserClient::ExternalMethod:

case GetPacket:
{
    IOUserNetworkPacket *packet =
            ivars->m_provider->getPacket();
    
    GetPacket_Output output;
    output.packet_size = packet->getDataLength();
    
    IOUserNetworkPacketBufferPool *pool;
    packet->GetPacketBufferPool(&pool);
                
    IOMemoryDescriptor *memory = nullptr;
    pool->CopyMemoryDescriptor(&memory);
    
    IOMemoryMap *map = nullptr;
    memory->CreateMapping(0, 0, 0, 0, 0, &map);
    
    uint64_t address = map->GetAddress()
            + packet->getMemorySegmentOffset();
    memcpy(output.packet_data,
            (void*)address, packet->getDataLength());
    
    in_arguments->structureOutput = OSData::withBytes(
            &output, sizeof(GetPacket_Output));
    
    // free stuff

} break;

Solution

The problem was caused by an IOUserNetworkPacketBufferPool bug. My bufferSize was set to 1600 except this value was ignored and replaced with 2048. The IOUserNetworkPackets acted as though the bufferSize was 1600 and so they gave an invalid offset.

Creating the buffer pool and mapping it:

kern_return_t
IMPL(FooDriver, Start)
{
    // ...
    IOUserNetworkPacketBufferPool::Create(this, "FooBuffer",
        32, 32, 2048, &ivars->packet_buffer));

    packet_buffer->CopyMemoryDescriptor(ivars->packet_buffer_md);

    ivars->packet_md->Map(0, 0, 0, IOVMPageSize,
        &ivars->packet_buffer_addr, &ivars->packet_buffer_length));
   // ...
}

Getting the packet data:

void FooDriver::getPacketData(
        IOUserNetworkPacket  *packet,
        uint8_t              *packet_data,
        uint32_t             *packet_size
) {
    uint8_t  packet_head;
    uint64_t packet_offset;
    
    packet->GetHeadroom(&packet_head);
    packet->GetMemorySegmentOffset(&packet_offset);
    
    uint8_t *buffer = (uint8_t*)(ivars->packet_buffer_addr
        + packet_offset + packet_head);
    *packet_size = packet->getDataLength();

    memcpy(packet_data, buffer, *packet_size);
}