Hardware bring-up: first UDP packet transmitted and captured

The W5100S ethernet back-end now works end-to-end on real hardware: a complete,
correctly-checksummed UDP datagram (10.0.0.99:40000 -> 10.0.0.50:6464, 32-byte
payload) was transmitted by the FPGA-driven W5100S and captured on a PC, after a
full bidirectional ARP handshake.

Records the three W5100S-specific findings in CLAUDE.md (NETLCKR unlock, the
15-bit IDM address space putting the buffers at 0x4000/0x6000, and the 60.3 ms
reset-to-ready time), and notes that UDP unicast is the reliable bring-up path
while a 255.255.255.255 send sets SEND_OK without appearing on the wire.

w5100_udptest.py is the self-contained configure+send+readback probe that
isolated all of this.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

CLAUDE.md

@@ -330,9 +330,24 @@ the `BBATop` default.
   IMR 0x16, RMSR/TMSR 0x1A/0x1B), socket 0 at 0x0400 (S0_MR/CR/IR, TX_WR 0x424,
   RX_RSR 0x426, RX_RD 0x428), TX buffer 0x4000, RX buffer 0x6000. MACRAW mode.
 - **Status:** init/TX/RX (with wrap) verified vs a bus model; BBATop full
-  W5100→SPRAM→GC RX loop passes byte-for-byte; synth PASS (slow ~32≥24, capture
-  ~56≥54, 42% LC). Register addresses/MR bits are from the datasheet (from
-  memory) — **confirm at hardware bring-up**.
+  W5100→SPRAM→GC RX loop passes byte-for-byte; synth PASS. **Hardware bring-up
+  2026-09-20: a real UDP datagram was transmitted and captured on a PC** — the
+  ethernet back-end is proven end-to-end. Register addresses confirmed on silicon,
+  with three W5100S-specific gotchas the from-memory map got wrong:
+  - **NETLCKR (0x0071) must be unlocked with 0x3A** before GWR/SUBR/SHAR/SIPR are
+    writable (default 0x00 = locked). The original W5100 has no such register, so
+    without this every network-config write is silently dropped and the chip
+    transmits with a zero source MAC/IP.
+  - **The parallel/indirect (IDM) bus decodes only a 15-bit offset**, so the TX/RX
+    buffers are at the original **0x4000 / 0x6000** — NOT the 0x8000/0xC000 the
+    W5100S datasheet pseudo-code quotes. Using 0x8000 makes payload writes alias
+    onto 0x0000+ and overwrite SHAR/SIPR. Proven with an address-aliasing probe
+    (0xC000 and 0x4000 read back the same cell). Do not "fix" this again.
+  - **The W5100S needs 60.3 ms after RSTn** before it answers; polling sooner reads
+    all-zeros and looks like a dead chip.
+  - UDP **unicast** works (the chip ARPs the peer first, per Sn_MR FARP). A send to
+    255.255.255.255 sets SEND_OK but was not observed on the wire — prefer unicast
+    or a subnet-directed broadcast for bring-up tests.
 
 ### `rebbarb/` — LED blink demo (unchanged)
 - `rebbarb.py` — blinks LEDs via a PLL (36 MHz), demonstrates `IceBreakerPlatform`