When reading the transmit status or receive length registers, the core incorrectly drives the data onto the internal data bus for one clock cycle a few clock cycles after it terminates the read acknowledge signal. If another read takes place immediately following a read from one of these registers, the data from these registers will be "ORed" in and corrupt the data being read. This was discovered on the plb_gemac when the SG DMA was reading the Buffer Descriptor address register immediately after reading the receive packet length register. The corruption of the BDA value caused the processor to attempt to access a buffer in an unimplemented address range.
This problem is fixed in the latest 6.2 EDK Service Pack, available at:
The first service pack containing the fix is EDK 6.2 Service Pack 2.
This fix is included in plb_ethernet_V1_01_a.