dwt: NVRAM dump over rdebug (settings block) and LANCE address ROM read; both match the model

dwt/notes/REAL_UNIT.md

@@ -251,3 +251,34 @@ The first attempt hung the Terminal Manager; this one completed. The hang is
 not deterministic. The mailbox watcher's reconnect storm during boot is one
 possible co-factor (it spawns a debug process per accepted connection), but the
 diagnostic reset is the other; a single success does not settle which.
+
+### NVRAM and LANCE address ROM, read over rdebug
+
+`dwt/nvram_dump.py` reads 4 KiB at bit `0x6000000` and extracts the 0x800
+settings bytes (low byte of each 16-bit word). Evidence:
+`real-unit-nvram-settings.bin`, `real-unit-nvram-raw.bin`.
+
+Printable settings runs:
+
+```
+0x26f 100.103.0.10      0x28f 172.20.51.0
+0x3cf 1.1.1.1           0x3ef 8.8.8.8
+0x40f retro.k-space.ee
+0x50f 100.103.0.1
+0x597 ROM               0x5e7 ROM
+0x5eb 103.255.254:69
+0x637 100.103.100.103   0x657 255.255.0.0
+0x677 Messages          0x6ca / 0x6ea VTE 1
+```
+
+Both font-path fields persist: the selected `ROM` and the old TFTP
+`103.255.254:69`.
+
+The LANCE address ROM at bit `0x6800000` reads (low bytes of the words):
+
+```
+08 00 2b 16 4b 5a c1 86
+```
+
+byte-identical to the MAME model. The `Ethernet Address ROM Test` passing is
+consistent with this.