So only Novell can say what arguments the component is passing up!
1: kd> !analyze -v
*******************************************************************************
*                                                                             *
* Bugcheck Analysis                                                           *
*                                                                             *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: f8b6e290, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: f8762f4a, address which referenced memory
Debugging Details:
------------------

WRITE_ADDRESS: f8b6e290 
CURRENT_IRQL: 2
FAULTING_IP: 
TDI!TdiCopyBufferToMdl+174 [d:\xpsprtm\net\tdi\sys\tdi.c @ 1655]
f8762f4a f3a5 rep movsd
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xD1
LAST_CONTROL_TRANSFER: from aad517c6 to f8762f4a
TRAP_FRAME: f88a9c50 -- (.trap fffffffff88a9c50)
ErrCode = 00000002
eax=00000200 ebx=8192f1b8 ecx=00000080 edx=00000200 esi=81c835b2 edi=f8b6e290
eip=f8762f4a esp=f88a9cc4 ebp=f88a9cd4 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
TDI!TdiCopyBufferToMdl+0x174:
f8762f4a f3a5 rep movsd ds:81c835b2=000000fe es:f8b6e290=????????
Resetting default scope
STACK_TEXT: 
f88a9cd4 aad517c6 81c83588 00000000 00000200 TDI!TdiCopyBufferToMdl+0x174 [d:\xpsprtm\net\tdi\sys\tdi.c @ 1655]
f88a9d24 aad49a97 81d2a658 00000000 804eeba2 nwlnkspx!SpxRecvProcessPkts+0xc4 [d:\xpclient\net\nwlink\spx\spxrecv.c @ 2521]
f88a9d44 aad4ed62 8199d858 8192f620 f8b793d0 nwlnkspx!SpxConnRecv+0x6f [d:\xpclient\net\nwlink\spx\spxconn.c @ 1609]
f88a9d68 804eeeb1 8199d4c0 8192f600 80563720 nwlnkspx!SpxDispatchInternal+0xc0 [d:\xpclient\net\nwlink\spx\spxdrvr.c @ 914]
f88a9d78 f7bfcd3a 80537757 f8b79298 00000000 nt!IopfCallDriver+0x31 [d:\nt\base\ntos\io\iomgr\iosubs.c @ 2270]
WARNING: Stack unwind information not available. Following frames may be wrong.
f88a9dac 805ce794 f8b79298 00000000 00000000 nwsipx32+0x4d3a <--- Here we see the 3rd party driver loaded – but as we do not have the source code / symbols we cannot see the arguments passig up 
f88a9ddc 805450ce 80537668 00000000 00000000 nt!PspSystemThreadStartup+0x34 [d:\nt\base\ntos\ps\create.c @ 2244]
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16 [d:\nt\base\ntos\ke\i386\threadbg.asm @ 85]

FOLLOWUP_IP: 
TDI!TdiCopyBufferToMdl+174 [d:\xpsprtm\net\tdi\sys\tdi.c @ 1655]
f8762f4a f3a5 rep movsd
SYMBOL_STACK_INDEX: 0
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: TDI!TdiCopyBufferToMdl+174
MODULE_NAME: TDI
IMAGE_NAME: TDI.SYS
DEBUG_FLR_IMAGE_TIMESTAMP: 41107d33
STACK_COMMAND: .trap fffffffff88a9c50 ; kb
FAILURE_BUCKET_ID: 0xD1_W_TDI!TdiCopyBufferToMdl+174
BUCKET_ID: 0xD1_W_TDI!TdiCopyBufferToMdl+174
Followup: MachineOwner
---------