The patch is for 2.6.21; probably if should apply cleanly to other
versions.
Copy the tg3.h from the kernel sources to this directory and create
tg3dma.c file by applying the patch to the kernel tg3.c file.

Then
insmod tg3dma.ko tg3devname=eth0 (or other dev name)
ifconfig eth0 promisc
echo -n 0x001abcde >/proc/tg3physaddr
cat /proc/tg3physmem > dumpfile
hexedit dumpfile
cat dumpfile > /proc/tg3physmem
rmmod tg3dma
ifconfig eth0 -promisc

Unfortunately, in case of writing, some cards tend to add 4 bytes of status
after the written buffer, which may damage the overwritten region. Either
position the buffer so that nothing important is after 1514 bytes from the
/proc/tg3physmem (e.g. function alignment), or read the damaged area first 
and then fix with xenwritemem later.
