EmuNetDevice::SetPromiscReceiveCallback is not implemented:

void
EmuNetDevice::SetPromiscReceiveCallback (PromiscReceiveCallback cb)
{
  NS_FATAL_ERROR ("EmuNetDevice::SetPromiscReceiveCallback(): Not implemented");
}

The correct implementation is trivial, as ForwardUp already takes care to use m_promiscRxCallback if set.  Change to:

void
EmuNetDevice::SetPromiscReceiveCallback (PromiscReceiveCallback cb)
{
  m_promiscRxCallback = cb;
}