LPC Spec, ch. 6.4.3 "DMA Request De-assertion": "...To indicate the last byte of transfer, the peripheral uses a SYNC value of ‘0000b’ (Ready), or ‘1010b’ (Error). These encodings tell the host that this is the last piece of data transferred on a DMA read (host to peripheral), or the byte that follows is the last piece of data transferred on a DMA write (peripheral to host). When the host sees one of these two encodings, it ends the DMA transfer after this byte and deasserts the DMA request to the 8237 controller. Therefore, if the host indicated a 16 bit transfer, the peripheral can end the transfer after one byte by indicating a SYNC value of ‘0000b’ or ‘1010b’."
RTL-as-a-host does not end a DMA WORD(SIZE=4'b0011) cycle after the peripheral replies with Ready(4'b0000) after the first byte. The host drives and the next byte+TAR, waiting for response, thus hanging the bus.