The ACK packets are constructed and sent directly by the NDIS filter driver in kernel mode, bypassing the application layer and Winsock stack entirely. All operations—including NBL allocation, payload filling, and transmission—are performed within the kernel to achieve minimal latency and maximum throughput.