Both directions proven on hardware: 60-byte ARP out, DHCP frame in

TX: the TWD fix lands a full 60-byte ARP on the wire, byte-for-byte correct
(previously truncated at 16).  TI sets.

RX: a real 342-byte DHCP broadcast from the PC was received in MACRAW mode,
assembled into the SPRAM ring and DMA-read back over EXI.  The descriptor
length 0x015A cross-checks exactly against the frame's own IP total-length
field plus the ethernet header, so the assembler's length is confirmed, not
merely plausible.

Also replaces the full-path probe's 'is 08 and 06 somewhere in the buffer'
guess with a real descriptor decode -- it called a DHCP frame an ARP reply.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

hardware/re-bba-rb/exi_fullpath_rpi.py

@@ -122,8 +122,15 @@ if got:
     print(f"   SPRAM @0x100: {hx(data[:16])}")
     print(f"                 {hx(data[16:32])}")
     print(f"                 {hx(data[32:48])}")
-    if 0x08 in data and 0x06 in data:
-        print("   -> looks like an ARP frame came back. RX PATH WORKS.")
+    # Decode the ring descriptor instead of guessing from stray bytes: the
+    # first 4 bytes are the descriptor, whose length INCLUDES itself.
+    dlen = (data[2] << 8) | data[3]
+    etype = (data[16] << 8) | data[17]
+    print(f"   descriptor length 0x{dlen:04X} = {dlen} -> {dlen-4} frame bytes")
+    print(f"   dst {':'.join('%02x'%b for b in data[4:10])}"
+          f"  src {':'.join('%02x'%b for b in data[10:16])}  ethertype 0x{etype:04X}")
+    if 4 < dlen <= 1518:
+        print("   -> RX PATH WORKS: a real frame was assembled into the SPRAM ring.")
 else:
     print(f"   no RX after 3s (RWP still {hx(read(0x16,2))}, IR {read(0x09,1)[0]:02x})")
     print("   TX may still have worked - check the capture.")