Right now. all traffic before the first K28.5 in a waveform isn't decodeable, other than TLP/DLLP start/end markers which aren't scrambled.

If we can find something we know to be an logical idle (stream of Dx.x after an END symbol) we know the plaintext is all 0x00s, so we can easily calculate the scrambler key stream. This should allow us to realign the scrambler in both the forward and reverse direction.