How can I troubleshoot an active short circuit?

It won't always work, but sometimes you can track down a short with a thermal camera... of course you have to have a thermal camera to do that.

Just power the board up and watch very closely through the thermal camera to see if one area of the board gets really hot, it could help you narrow down the area at least.

While I wish you best of luck with your thermal camera endeavour, I would actually expect that the camera will show you the IC affected by the short (the Ethernet PHY?), not the short itself. You'd have to be pretty lucky for the actual faulty spot to have higher resistance than the internals of an IC.

If you find nothing with the camera, I would then check continuity to GND / 3.3V rail on any of the IC pins which are not actually connected to GND / 3.3V. Do it with a diode tested, since a forward-biased junction is close enough to a short.

If that comes out negative, I would power the PCB with the IC removed and check the voltage on all pins (ideally, a power-up waveform but it may be tedious for a large number of pins). Any voltage outside of 0..VCC range could potentially cause the IC to latch up, a condition which typically looks like a short.

Finally, I would check if all pads corresponding to the output pins can be actively driven. This can be done by connecting a scope and a signal generator together outputting a 0-3.3V square wave (so that you see the square wave on the scope), then connecting the probe to the pads. A disappearing square wave would mean that something else is trying to drive pad that the IC will want to drive as well. This can be justified for open-drain and bidir pins, but not for pure outputs.

Or you can use the "Louis Rossmann Thermal Camera without a thermal camera" technique - cover the board with IPA, run power through the short - the thing that's shorted heats up, and the alcohol will evaporate very fast. It makes it really obvious what's shorted. See demo here: https://youtu.be/gRV0cmIj5Ks?t=236 - yeah, it's kind of a bad example, because he finds the short with the thermal camera in this case, but he usually uses the alcohol method, and it works great.