I think I might know what is happening, but I could be wrong.
It appears by the pointer changes, the ethernet shield may be using those pointers to build the packet. The size change is about right. My test code checks both the TX_WR and the TX_RD registers before writing. If they are not equal, it waits until they are. That way the inchworm won't get overextended. 
Just passed the 470 download mark. So far, so good.