I've uploaded an install tape into the install archive of 2.11 BSD.. I have no idea what patchlevel it is..
I've also rigged a zip file with SIMH SLiRP/PDP-11 and a hacked up de driver to get it networkable. I guess it's not surprising that the PDP-11 & VAX versions of the de driver suffer from the exact same symptoms where all inbound packets are marked as errors. I've simply removed the error checking as SLiRP should be passing good traffic into the host OS.
Oh, before I forget the 'telnet' port is 42323, and it's hard coded into the pdp11.exe . If you want another port, you'll need to build the simulator from source, which can be found on the SIMH page.