S28.12: Harden vendored smsc9220 LAN9118 driver for real hardware

[DavidCozens]

Parent epic: #439 (E28: lwIP Raw API support)

Deferred from the PR #476 (S28.09) CodeRabbit review (findings #8, #9, #10). These are real defects in the vendored, unmodified Arm smsc9220 driver under Bdd/Targets/FreeRtosLwip/netif/smsc9220/ (Apache-2.0, kept verbatim with a DisableFormat .clang-format). They are benign on QEMU's MPS2 LAN9118 model (which is why the S28.09 oracle is green) but would bite on real silicon.

Defects

1. (Critical) MAC CSR busy-bit poll — smsc9220_mac_regwrite (≈line 468): the loop condition is register_map->mac_csr_cmd & GET_BIT(register_map->mac_csr_cmd, MAC_CSR_CMD_BUSY_INDEX). GET_BIT returns 0/1, so this ANDs the register with bit 0 instead of testing the BUSY bit — can return before the write completes and race the next MAC/PHY access. Fix: condition on GET_BIT(...) alone.
2. (Major) TX pad DWORD on aligned chunks — smsc9220_send_by_chunks (≈line 336) always writes an initial FIFO word; for already-word-aligned chunks this burns/overflows a DWORD. Fix: only prepend filler when remainder_bytes != 0.
3. (Major) smsc9220_check_id return type — returns int 1 on mismatch, stored into enum smsc9220_error_t, so an ID mismatch is reported as SMSC9220_ERROR_TIMEOUT. Fix: return SMSC9220_ERROR_NONE / SMSC9220_ERROR_INTERNAL.

Decision needed

Since the driver is vendored verbatim, pick one:

• (a) Patch in place and document the deviations from upstream in the driver dir / DEVLOG; or
• (b) Report upstream (FreeRTOS-Plus-TCP MPS2_AN385 netif) and carry as documented known-limitations until a real-hardware port needs them.

Either way the BDD target keeps working on QEMU; this is about real-LAN9118 readiness.

Acceptance

• Chosen path applied; if patched, oracle lane stays green and the upstream divergence is recorded.