Hi,
When I was a little boy, I played with VxD. I remember that I coulndn't access to non present pages from certain parts in Ring-0. Example, when processing interrupt requests.
I guess that your problem might be in accesing those pages from a DEBUG_QUERY event, that as you well have read, it can cause page faults. (dunno about W32_DEVICEIOCONTROL)
It could be a similar mechanism like KMD with PassiveLevel, DispatchLevel....though VxD architecture is quite different from the NT one.
Could you first lock the pages with function like "PageLock", "LinPageLock" and friends?
Hope I'm right, hope it helps
