Windows Filtering Platform: Access to the the packet's payload

Question

I'm traversing through a NET_BUFFER's MDL chain to get the associated data. The two macros that are used to indicate where the used data space begins (NET_BUFFER_DATA_OFFSET() & NET_BUFFER_CURRENT_MDL_OFFSET()) got me a little confused, as I've always observed them returning the same value, and both seem equally usable.

Which one should be used? What's the difference between them?

Answer 1

Ok, got it.
Obviously if current mdl doesn't point to the first mdl, then NET_BUFFER_DATA_OFFSET() will indicate the size of all mdl's until the current one, plus the current's own offset, while NET_BUFFER_CURRENT_MDL_OFFSET() will indicate only the offset within the current mdl, which is all you really need if you use NET_BUFFER_CURRENT_MDL() macro.
An optimization thingy.