Yes, I got it working. Turns out I’m an idiot, and didn’t realize I had to set a bit in the last control register to turn on internal routing of the RMII clock for how I had the clock hooked up on the board.
That required disconnecting the SMC lines and bugging them into a free I2C port so I could send the command to set bit 3 in register 198. Apparently this might have been possible in other chips, but the H7’s ETH peripheral seems extremely limited to just the ‘standard’ stuff on its control lines.
I also overrode/deleted pretty much everything in the phy handling to just not do anything and always assume 100MB/full duplex is always up. Works like a charm.