Is the PHY address of DP83867CRRGZ defined by any conditions than configuration pins, RX_D0 and RX_D2 pin?
For example, if those pins are open, then address is 0000. Is it correct? If read back register value is 1111, then something wrong in external circuit?