well, the crash was caused by the erroneous use of 32 bit accesses on the trc0 register.
i've tried removing this from a version I have based on the reference code from pjrc, and it still seems
to move packets, so my problem is almost certainly in bdt management.
it would be interesting to...