Finally got around to putting a LA on the machine to chase the network issue, and the problem became obvious. Turns out, if it walks like a duck (data corruption), talks like a duck (data corruption): it's probably a duck (data corruption).
View attachment 98693
The SONIC (+BIOS) and 060 are fighting over the bus. Specifically, the 060 took the bus when it shouldn't have; the SONIC continues to try to run cycles as it's the rightful owner of the bus at the same time as the CPU, and everything goes awry. Fall down, go boom.
Wouldn't you know it, there's an errata that sounds a heck of a lot like this. As the SONIC takes a moment before running the first bus cycle, as far as my buggy early 060 is concerned it never sent one at all.
View attachment 98695
The solution is straightforward: the third workaround, don't issue BG to the 060 until we see BB go high first indicating the SONIC is off the bus. My adapter picks up three more bodges.
View attachment 98696
And just like that, no more crashing. I haven't tried Appletalk over IP yet but I expect it's working too.
Takeaway: if using the "simple" 060 adapters, you must use a late mask full 060 ("rev 6" 0E41J) or a LC chip for the onboard networking to work. Otherwise, the onboard networking can't be used. A nubus card could be used instead, though it's about half as fast as the onboard.
This has some relevance to other Macs which might potentially host an 060: no bus mastering PDS or Nubus cards can be used with early mask chips. In particular, the LC475/605 would need to be wary of the later LC PDS ethernet cards which use a bus mastering SONIC.