Possible Issue - My suspicion is that when the tail points to the start of the last descriptor (RxDesc + (ETH_RX_DESC_CNT - 1)), it tries to consider that last descriptor's buffer as data owned by the application. I'll have to check exactly how this leads to a crash in my case, it may end up being bad handling somewhere.