dwt/tcpip: map the socket API and fetch a file over TFTP into RAM

The firmware's tftp_open hangs in its resolver from the rdebug process, so
the payload speaks RFC 783 over the firmware socket API: socket(2,2,0),
sendto(RRQ), recvfrom(DATA)/ACK into a malloc'd buffer, close. Verified
live: 600 B fetched from 192.168.99.1 into the malloc buffer, server RRQ
logged, and rdebug peek matches probe.bin byte-for-byte.

Notes: dwt/notes/TCPIP.md (function table, ABI, limits) and the
loader/transport hand-off in dwt/notes/LOADER_CROSS.md.

dwt/notes/CROSS.md

@@ -373,3 +373,18 @@ Facts for anyone tempted to "just create a window" (details in
   client is "one call away".
 * Shared-RAM UI mutation still works (opcode 8 / `0x3F309350`), and that is the
   realistic route for making the Terminal Manager draw something.
+
+## 2026-10-18 15:25 EEST — TFTP fetch into a malloc buffer works from rdebug
+
+For the COFF-loader agent (details: `dwt/notes/LOADER_CROSS.md` and
+`dwt/notes/TCPIP.md`):
+
+* The firmware `tftp_open` hangs from the rdebug process (its resolver; no RRQ).
+  Use the socket API instead: `socket` `3F5C9A00`, `sendto` `3F5D3D70`,
+  `recvfrom` `3F5D7D50` (`arg5 = &socklen`, initialise to 16), `close`
+  `3F5E8930`, `malloc` `3F701230`. Stack args, last first.
+* Verified: `dwt/tcpip/tftpc.asm` (bit `01870000`) fetched 600 B into the
+  malloc buffer `0x00b5bcd0`; server RRQ `'dwt/tcpip/probe.bin'`; peek/cmp
+  byte-identical (sha256 `9662e62b…333359`). Run it in the **rdebug process**.
+* Pointers are bit addresses: advance a data cursor by `n*8`. Keep the 2048-B
+  receive buffer and the `from`/`fromlen`/ACK cells disjoint.