Okay, now my 7248-133 is working again:
---
>> NetBSD/prep BOOT, Revision 1.5
>> (tsutsui@mirage, Tue Apr  6 22:42:26 JST 2004)

Boot: -a
Loading in() (howto 0x1)
2644540+212104 [168112+157302]=0x309190
start=0x100000

Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006
    The NetBSD Foundation, Inc.  All rights reserved.
Copyright (c) 1982, 1986, 1989, 1991, 1993
    The Regents of the University of California.  All rights reserved.

NetBSD 3.99.20 (STARION) #41: Sat Jun 10 03:54:06 JST 2006
	tsutsui@mirage:/usr/src/sys/arch/prep/compile/STARION
Model: IBM PPS Model 7248 (E)
total memory = 144 MB
avail memory = 134 MB
mainbus0 (root)
cpu0 at mainbus0: 604 (Revision 3.4), ID 0 (primary)
cpu0: HID0 c084<ICE,DCE,SGE,BHT>
cpu0: 133.33 MHz
pci0 at mainbus0 bus 0: indirect configuration space access
pci0: i/o space, memory space enabled
pchb0 at pci0 dev 0 function 0
pchb0: Motorola MPC105 "Eagle" Host Bridge (rev. 0x24)
pchb0: L2 cache: 512K, write-through mode
pcib0 at pci0 dev 11 function 0: IBM ISA Bridge w/PnP (rev. 0x02)
pcib0: PIRQ[0-3] not used
pcn0 at pci0 dev 12 function 0: AMD PCnet-PCI Ethernet
pcn0: Am79c970A PCnet-PCI II rev 6, Ethernet address 08:00:5a:f8:9c:a0
pcn0: interrupting at irq 15
pcn0: 10base5, 10base5-FDX, 10baseT, 10baseT-FDX, auto, auto-FDX
vga0 at pci0 dev 14 function 0: S3 86C864-1 ("Vision864") (rev. 0x00)
wsdisplay0 at vga0 kbdmux 1
wsmux1: connecting to wsdisplay0
siop0 at pci0 dev 16 function 0: Symbios Logic 53c810 (fast scsi)
siop0: interrupting at irq 15
scsibus0 at siop0: 8 targets, 8 luns per target
isa0 at pcib0
lpt0 at isa0 port 0x3bc-0x3bf irq 7
com0 at isa0 port 0x3f8-0x3ff irq 4: ns16550a, working fifo
com0: console
com1 at isa0 port 0x2f8-0x2ff irq 3: ns16550a, working fifo
pckbc0 at isa0 port 0x60-0x64
pckbd0 at pckbc0 (kbd slot)
pckbc0: using irq 1 for kbd slot
wskbd0 at pckbd0 mux 1
wskbd0: connecting to wsdisplay0
attimer0 at isa0 port 0x40-0x43: AT Timer
we0 at isa0 port 0x280-0x29f iomem 0xd0000-0xd3fff irq 9
we0: SMC8216/SMC8216C Ethernet (16-bit)
we0: Ethernet address 00:00:c0:4b:a7:99
joy0 at isa0 port 0x201
joy0: joystick not connected
pcppi0 at isa0 port 0x61
midi0 at pcppi0: PC speaker
spkr0 at pcppi0
isabeep0 at pcppi0
isapnp0 at isa0 port 0x279: ISA Plug 'n Play device support
mcclock0 at isa0 port 0x70-0x71: mc146818 compatible time-of-day clock
pcppi0: attached to attimer0
isapnp0: read port 0x203
isapnp0: <Crystal CS4232 Sound Chip, CSC0000, , > port 0x534/4,0x388/4,0x220/16 irq 5 drq 1,0 not configured
joy1 at isapnp0 port 0x10/8
joy1: Crystal CS4232 Sound Chip 
joy1: joystick not connected
isapnp0: <Crystal CS4232 Sound Chip, CSC0002, , 4232> port 0x18/8 not configured
isapnp0: <Crystal CS4232 Sound Chip, CSC0003, , > port 0x330/2 irq 5 not configured
isapnp0: <Crystal CS4232 Sound Chip, CSC0004, , CD-ROM> port 0x18/4 not configured
pnpbus0 at mainbus0
wdc0 at pnpbus0: port 0x1f0-0x1f7 0x3f6, irq 13, DMA 6
atabus0 at wdc0 channel 0
wdc1 at pnpbus0: port 0x170-0x177 0x376, irq 13, DMA 7
atabus1 at wdc1 channel 0
nvram0 at pnpbus0: port 0x74-0x75 0x76
nvram0: Read 3118 bytes from nvram of size 4096
biomask a000 netmask a200 ttymask a282
scsibus0: waiting 2 seconds for devices to settle...
sd0 at scsibus0 target 0 lun 0: <nEC, D3845, 0314> disk fixed
sd0: 1032 MB, 2097 cyl, 16 head, 63 sec, 512 bytes/sect x 2113776 sectors
sd0: sync (100.00ns offset 8), 8-bit (10.000MB/s) transfers
cd0 at scsibus0 target 3 lun 0: <IBM, CDRM00203\000\000\000\000\000!K, BZ26> cdrom removable
cd0: sync (200.00ns offset 8), 8-bit (5.000MB/s) transfers
st0 at scsibus0 target 5 lun 0: <ARCHIVE, IBM4326NP/RP  !D, 5770> tape removable
st0: drive empty
st0: async, 8-bit transfers
boot device: pcn0
root device (default pcn0): sd0
dump device (default sd0b): 
file system (default generic): 
root on sd0a dumps on sd0b
root file system type: ffs
init path (default /sbin/init): 
init: trying /sbin/init
---

But we0 has the similar problem with yours:
---
we0: length does not match next packet pointer
we0: len 0000 nlen 2600 start 0c first 0d curr 0e next 00 stop 40
we0: NIC memory corrupt - invalid packet length 9728
---

root@garbled.net wrote:
> # ifconfig we1 192.168.10.99
> # we1: NIC memory corrupt - invalid packet length 9728
> we1: NIC memory corrupt - invalid packet length 9728

ep0 at isapnp0 works fine, so ISA mem space is not mapped properly?
---
Izumi Tsutsui