This is the phy polling that happens in uboot. This burst lasted for about 1.8 seconds.

when you zoom in, you see the phy polling rate is at about 9.5kHz.

These are the phy polling pulses sent by the linux kernel. Every 2 seconds.

Here is a zoom on one of the polls. Reading 4 phy registers on each polling event.

This is a zoom of the first transfer

And more Zoom. Notice the overshoot on the second half. The first half is CPU->PHY the second half is PHY->CPU. Signals are measured at the PHY pins. The overshoot is most likely reflections from the CPU end of the signal. The phy datasheet says the inputs are 5V tolerant, but the driver portion has a max voltage of 3.6V. Could the overshoot caused by the reflection be causing trouble? This is with termination resistors installed.

So.. given that uboot causes some 18k register reads during its short lifetime. And the board seems to lockup somewhere on the order of every 50 boots. We need some 900k register reads for a lockup event. During the linux kernel stage where four registers are polled every 2 seconds, this would mean that the newtork should lockup under linux on average every 5.2 days. This is all assuming that reading/writing to the phy registers is causing the lockup.