A few years ago, I was playing around with an even older variant of this Broadcom chip. It turns out you can configure the PCIe PHY into root complex mode and hook the NIC up to other PCIe devices. You just need to supply the 100MHz REFCLK for both devices. And connect the TX pair to the RX pair of each device (crossover).

Registers 0x7d10 (sequence number) and 0x7d38 (TLP data) allow you to send custom PCIe TLPs, which let you do the configuration space writes required to get the other card to talk to it. https://citeseerx.ist.psu.edu/document?repid=rep1&type=pdf&d... (see page 383)

It's quite suprising to see one NIC blinking the LEDs of another, by writing to its registers over the point-to-point PCIe link (I used twisted-pair wire-wrap wire to connect them together).

Here's the code to do it, you run it on the MIPS processor: https://pastebin.com/ZJdaUpRZ

This is enough to load custom firmware on a GPU, and get the two talking together, with network access, by the way!

Also the Intel i210 NIC can do this as well, it has an ARC Tangent-A4 processor in the management engine. Same for the i225, but I believe that one has secure boot to prevent unauthorized firmware from running.