I found a video by Laura Chappell (the "guru" at Wireshark University) in which she demonstrated faulty padding in an ethernet frame. The padding was either zeros or lifted from RAM so, in the latter case, it could contain passwords etc. (I think the actual padding applied depended upon the NIC or driver). The video showed ARP traffic having been collected and padding was applied, unlike in my system at present. It's a pity that I don't have access to another PC, otherwise I'd set it up to capture some traffic that I could compare.