diff --git a/harness/mame/NETWORK_REPORT.md b/harness/mame/NETWORK_REPORT.md
index bd80a6c..e71c0ff 100644
--- a/harness/mame/NETWORK_REPORT.md
+++ b/harness/mame/NETWORK_REPORT.md
@@ -4436,3 +4436,46 @@ transmissions.
 * Practical consequence: a payload can now speak any Ethernet protocol it wants
   (ARP, IP, a custom one) without the OS's stack, which is the foundation for a
   wire-based loader or a faster frame path than the OS's ~20 datagrams/s.
+
+## 67. Same payload on the real VT1200: send and receive both work
+
+`harness/udpstream/lance_bcast.coff` was loaded on the unit with
+`dwt/loader/hostload.py`, while the host sent `0x88B5` broadcasts at it from its
+own NIC. The panel reads (some glyphs were missing at the time, see 67.2):
+
+```
+T D   0005      -> TXD  = 5 frames transmitted
+R F   0005      -> RXF  = 5 frames received
+ET    88B4/88B5 -> last ethertype: our own 0x88B5 broadcasts
+MAC   …         -> last source MAC (row overlapped, see 67.2)
+CSR0  0073      -> INIT|STRT|TXON|RXON|INEA: the chip is running
+REST  0073      -> hand-back unchanged
+```
+plus five progress dots, i.e. the payload ran to the end.
+
+### 67.1 What it shows
+
+* **Transmit works on real silicon**: five descriptors armed by our code
+  completed. (`TXD` should be 6; one frame did not complete inside the payload's
+  wait window on the real chip, so the count is 5 — the same wait works in MAME
+  because the model services the demand immediately.)
+* **Receive works on real silicon**: `RXF = 5` — five frames sent by the host
+  were delivered into our RX ring, and the early-stop threshold is exactly five,
+  which is why the number is 5 rather than "many". The recorded ethertype is
+  `0x88B5`, i.e. the frames the host was sending.
+* `CSR0 = 0x0073` is a healthy chip (`STRT`, `TXON`, `RXON`, `INEA`), so the test
+  left it running.
+
+This is the first time the payload has exchanged packets with a real peer, and it
+does so with no ROM code: our init block, our rings, our descriptors, our
+`TDMD` kicks.
+
+### 67.2 Two display bugs found by reading the real panel
+
+| symptom | cause |
+|---|---|
+| `T D` / `R F` instead of `TXD` / `RXF` | the glyph table had no **`X`** — `gi()` mapped it to an empty slot, so the letter simply did not draw |
+| MAC row a smear of overlapping text | the three 4-digit MAC groups were drawn at x=312/384/456, but each group is 192 px wide, so they were painted on top of each other |
+
+Both are fixed: `X` added, and the MAC is now one word per row (`MAC0`/`MAC1`/
+`MAC2`) with `REST` moved to y 878.
diff --git a/harness/udpstream/build/lance_bcast.coff b/harness/udpstream/build/lance_bcast.coff
index 6fc934a..c9df1b5 100644
Binary files a/harness/udpstream/build/lance_bcast.coff and b/harness/udpstream/build/lance_bcast.coff differ
diff --git a/harness/udpstream/lance_bcast.c b/harness/udpstream/lance_bcast.c
index 129fd8e..c4b7196 100644
--- a/harness/udpstream/lance_bcast.c
+++ b/harness/udpstream/lance_bcast.c
@@ -135,6 +135,7 @@ unsigned int reg;
 static unsigned char glyph[36][7];
 static unsigned char lab_csr0[5], lab_csr1[5], lab_tmd1[5], lab_rmd1[5];
 static unsigned char lab_mcnt[5], lab_rest[5], lab_ok[3], lab_yes[4], lab_no[3];
+static unsigned char lab_mac1[5], lab_mac2[5];
 
 static unsigned int gi(ch)
 unsigned int ch;
@@ -177,6 +178,7 @@ static void build_font()
     fset(gi('R'), 0x1E,0x11,0x11,0x1E,0x14,0x12,0x11);
     fset(gi('S'), 0x0F,0x10,0x10,0x0E,0x01,0x01,0x1E);
     fset(gi('T'), 0x1F,0x04,0x04,0x04,0x04,0x04,0x04);
+    fset(gi('X'), 0x11,0x11,0x0A,0x04,0x0A,0x11,0x11);
     fset(gi('Y'), 0x11,0x11,0x0A,0x04,0x04,0x04,0x04);
 }
 
@@ -244,6 +246,8 @@ int main()
     put4(lab_rmd1, 'M', 'A', 'C', ' ');
     put4(lab_mcnt, 'C', 'S', 'R', '0');
     put4(lab_rest, 'R', 'E', 'S', 'T');
+    put4(lab_mac1, 'M', 'A', 'C', '1');
+    put4(lab_mac2, 'M', 'A', 'C', '2');
     dot(0);
 
     /* black panel */
@@ -368,9 +372,10 @@ int main()
     draw_text(104, 654, lab_csr0); hex4(312, 654, txd);      /* TXD */
     draw_text(104, 686, lab_csr1); hex4(312, 686, rxf);      /* RXF */
     draw_text(104, 718, lab_tmd1); hex4(312, 718, lastet);   /* ET  */
-    draw_text(104, 750, lab_rmd1);
-    hex4(312, 750, m0); hex4(384, 750, m1); hex4(456, 750, m2);   /* MAC */
-    draw_text(104, 782, lab_mcnt); hex4(312, 782, csr_r(0));      /* CSR0 */
+    draw_text(104, 750, lab_rmd1); hex4(312, 750, m0);            /* MAC word 0 */
+    draw_text(104, 782, lab_mac1); hex4(312, 782, m1);            /* MAC word 1 */
+    draw_text(104, 814, lab_mac2); hex4(312, 814, m2);            /* MAC word 2 */
+    draw_text(104, 846, lab_mcnt); hex4(312, 846, csr_r(0));      /* CSR0 */
 
     /* give the chip back to the OS */
     {
@@ -400,7 +405,7 @@ int main()
                 }
             }
         }
-        draw_text(104, 814, lab_rest); hex4(312, 814, csr0res);
+        draw_text(104, 878, lab_rest); hex4(312, 878, csr0res);
     }
     /* stay here: the panel and the marker cells stay valid for inspection
      * (a returned payload lets the OS reuse this memory) */