Hi Rob I believe the 0x00 may relate to specific test network/test devices (check wrt LoRa Alliance LoRaWAN NetID) - good that TTN is picking up vs dropping the packets/payload.
I think the original LoRaMOTE’s (Semtech/iMST) associated with the SMTC LoRa IoT Dev/Demo Kits may be programmed with this. (I note also running SF12)
If you can decode the payload (Poss through Cayanne?) likely you may get the full LoRaMote payload (GPS Data, Battery level, Barometric pressure/altitude, Temp.). In which case if mote is very remote may help you get some understanding of your gateways coverage via the included GPS signal.
I will be posting my own experience of getting my TTN Gateway up and running this last week in another thread (Central or Status of? TBD) when I have a few moments and fact is that whilst GW came up fine I had no free nodes to test as they were all allocated to other networks & customer or private demoes. By chance I powered up an old LoRaMOTE from my spares box SMTC had given me late 2016 - supposedly dead - and hey presto I caught traffic on my GW - with 0X00. That then prompted me to try another two associated with old SMTC IoT Demo Kit and they were picked up too! Had them running in Thames Valley Tues/Wed night then took them and GW to N.West (along Mersey valley) and had them running there too Friday…so long may TTN support and pass through, please!
Haven’t got my data online right now to check my received payload structure but from memory from your 40 FC 0A 15 00 80 04 00 01… I suspect the Dev Add of the node you are picking up is either 01:00:04:08 or 00:04:80:00 or 04:80:00:15 …perhaps another forum user may recognise and shout up!