arp: take the sender MAC from where a received frame keeps it

IPBUF is laid out for frames we send, with the 12 byte TX descriptor in
front of the Ethernet header. A received frame starts with the Ethernet
header at uip_buf[0] and carries the RTL and VLAN tags after the
addresses, so IPBUF->ethhdr.src read the port mask and both VLAN fields
as a MAC. Every IP packet from the local network then replaced the
sender's ARP entry with that, and our replies went to an address nobody
has. The IP source address sits at the same offset in both layouts,
which is why the rest looked right.

Use BUF, the receive view uip_arp_arpin() already works from.

uip/uip_arp.c

@@ -252,7 +252,7 @@ uip_arp_ipin(void) __banked
      (uip_hostaddr[1] & uip_netmask[1])) {
     return;
   }
-  uip_arp_update(IPBUF->srcipaddr, &(IPBUF->ethhdr.src));
+  uip_arp_update(IPBUF->srcipaddr, &(BUF->ethhdr.src));
   
   return;
 }