Unlike 8b/10b and 64b/67b, 64b/66b relies entirely on the scrambler for ensuring DC balance. This raises the question: can a malicious data stream force the line to leave DC balance? Or would it need access to information that is not exposed by the NIC?
Yes, absolutely. The scrambler produces 64 bits of output from 64 bits of input, which means there 1:1 mapping of inputs and outputs, and thus there is an input which produces all 1's as output. The preamble will force a single "0" every frame, but still, the DC balance will be way off.
As for the state, the scrambler is self-synchronous based on in-band data, and requires 64 frames to synchronize. Which means if you send 64 sequential frames (512 bytes of data), you will know the exact scrambler state. This is trivial to achieve -- just send a single long ethernet packet.
According to IEEE-802.3:
Section 49.2.6 Scrambler: To aid block synchronization in the receiver for EEE capability when Clause 74 FEC is in use, when scrambler_bypass is TRUE the PCS shall pass the unscrambled data from the scrambler input rather than the scrambled data from the scrambler output. The scrambler shall continue to advance normally.
So, you can bypass the scrambler. If you do that, you certainly can affect DC balance.
Section 50.3.3 Scrambling: The use of the scrambler is intended to provide for DC balance (i.e. an equal number of 1’s and 0’s on average) and for sufficient transition density within the bit stream transmitted on the medium.
So, if you use the scrambler, you have to (somehow?) manipulate the transfer function: G(x) = 1 + x^39 + x^58 to manipulate DC balance.
Maybe you knew the latter based on your question, but, maybe you didn't know you could bypass the scrambler(?)... albeit, do you have access to the setting? Mostly, just trying to share IEEE-802.3 relevant information that you might not have otherwise.
found this too:
scr_bypass_enable: A Boolean variable used to indicate to the transmit LPI state diagram that the scrambler bypass option is required. The PHY shall set scr_bypass_enable = TRUE if Clause 74 FEC is in use. The PHY shall set scr_bypass_enable = FALSE if this FEC is not in use.