net: keep network packets out of the console (fixes shell garbage on netboot)

The link port is both the console-input fallback and the network. At the shell
prompt the host's multicast (mDNS/LLMNR/IGMP) was fed to the serial and KGetc
read those packet bytes as console input -> garbage in the shell, OSK unusable.

Two-part fix:
- KGetc now skips SLIP frames (0xC0-delimited) on the serial console path, so
  inbound packets never surface as console input. Plain injected bytes (the
  headless tunbridge command path) still pass through. New wConInSkip flag.
- netboot/tunbridge only forward IP packets destined to 10.0.0.2 (drop the
  multicast noise at the bridge).

Verified: GB sits at a clean "/#" prompt while all packets (noise included) are
forwarded; being-pinged (3/3) and wget still work. On the emulator, the OSK is
SELECT=space, START=enter, A=z, B=x, d-pad=WASD/arrows.

4 files changed, 28 insertions, 0 deletions

diff --git a/src/kdata.asm b/src/kdata.asm
index 6c520dd..6333f38 100644
--- a/src/kdata.asm
+++ b/src/kdata.asm
@@ -56,6 +56,7 @@ wFsPath::    DS 40      ; kernel-side copy of a path argument
 wFsSlashPtr::DS 2       ; last '/' seen while splitting a path
 wListDir::   DS 1       ; directory sys_list enumerates
 wKChar::     DS 1       ; scratch for KPutc
+wConInSkip:: DS 1       ; console input: mid-SLIP-frame? (skip net packets)
 wKillParent::DS 1       ; scratch for sys_kill
 wPsBuf::     DS 2       ; scratch for sys_ps
 wPnStart::   DS 2       ; scratch for sys_progname
diff --git a/src/syscall.asm b/src/syscall.asm
index 5b40ef0..04e9661 100644
--- a/src/syscall.asm
+++ b/src/syscall.asm
@@ -137,6 +137,29 @@ KGetc::
     bit 7, a
     jr nz, .yield
     ld a, [rSB]                 ; A = serial byte
+    ; The link port is also the network. Skip SLIP frames (0xC0-delimited) so
+    ; inbound packets never surface as console input; plain bytes (an injected
+    ; command in headless use) still pass through.
+    ld b, a
+    ld a, [wConInSkip]
+    or a
+    jr nz, .inframe
+    ld a, b
+    cp SLIP_END
+    jr z, .frameopen
+    ld a, b                     ; ordinary byte -> console input
+    jr .done
+.frameopen
+    ld a, 1
+    ld [wConInSkip], a
+    jr .poll
+.inframe
+    ld a, b
+    cp SLIP_END
+    jr nz, .poll                ; still inside a frame -> discard
+    xor a
+    ld [wConInSkip], a          ; frame end -> resume
+    jr .poll
 .done
     and a                       ; CF = 0 (not EOF)
     ret
diff --git a/tools/netboot b/tools/netboot
index ccc7116..3d27cf8 100755
--- a/tools/netboot
+++ b/tools/netboot
@@ -114,6 +114,8 @@ def main():
             try: pkt = os.read(tun, 2048)
             except Exception: return
             if not pkt: return
+            if len(pkt) < 20 or pkt[16:20] != b"\x0a\x00\x00\x02":
+                continue                            # only unicast to 10.0.0.2 (drop mcast noise)
             try: conn.sendall(slip_encode(pkt))
             except Exception: return
     threading.Thread(target=sock_to_tun, daemon=True).start()
diff --git a/tools/tunbridge.py b/tools/tunbridge.py
index b462c1b..f5e391c 100644
--- a/tools/tunbridge.py
+++ b/tools/tunbridge.py
@@ -68,6 +68,8 @@ def main():
         while True:
             pkt = os.read(tun, 2048)
             if not pkt: return
+            if len(pkt) < 20 or pkt[16:20] != b"\x0a\x00\x00\x02":
+                continue                   # only unicast to 10.0.0.2 (drop mcast noise)
             try: p.stdin.write(slip_encode(pkt)); p.stdin.flush()
             except Exception: return