The usenet posts documenting the NBP bugs in the ImageWriter are pretty confusing and unclear. That and a rant is interwoven about how the Webster Multigate is "well layered" and that any fix for the ImageWriter card will break it.
groups.google.com
Whatever, the card is a buggy mess. The issue seems to be that some routers send out NBP Lookups using DDP short packets. When this happens, the ImageWriter card sends the NBP replies to the packet sender (the ROUTER, which is VERY WRONG), instead of the client who sent out the original NBP Request. The fix is to have the router always use DDP long headers on NBP Lookups which have the client's source address in the packet header.
See:
https://groups.google.com/g/comp.protocols.appletalk/c/2so0gBHgv6g/m/PhT_40v2OnMJ
Basically, Apple might have taken a shortcut in designing the card's firmware and assumed DDP short NBP Lookups only appeared on routerless networks. On those networks, the source of the request is always the actual client, not a router relaying the request.
Note, unlike RTMP broadcasts, there is ZERO need to send NBP lookups with DDP short headers on LocalTalk. This applies even if its from a machine on the same network segment.
For additional fun, the ImageWriter card generates invalid DDP checksums. Thankfully Apple never enabled checksum verification on Macs out of the box, otherwise they would drop every single packet this thing generates. Its odd that it even generates checksums because Apple's own products usually leave the field unused.