Hi Andrew,
from my point of view it looks like the IP packet you send it bigger than 1500 bytes. Are you able to check, whether the IP packet is not bigger than 1500 bytes? What tool do you use for packet generation?

Ethernet has frame size limitation . Maximal frame size is 1518 bytes (1522 bytes if you use 802.1Q VLAN tagging). If IP packet including header is bigger than 1500 bytes, it is divided and encapsulated into more Ethernet frames. I ask about this, because it is strange you have updated both buffers with different status.
Are data in both buffers the same or different?
Could you please try to use interrupt instead of RXF polling and debug your code in the interrupt? Are still both buffers updated in single interrupt?
Regards,
Martin