Debugging "panic: pktdemux: corrupted pkt" error

I was able to figgure out what causes this problem. The wrong payload was already wrong by the time Rx SG-DMA updated the status word in descriptor memory.

It is the TSE MAC that does not generate an EOP in some scenarios - which exactly I am still investigating. With EOP missing the internal FSM of the SG-DMA does not reset length counter, so eventually a length corresponding to multiple summed-up packets is written in descriptor's status word. In the attachment you can see the invalid AvST packet and the internal SGDMA counter.