How were you able to tell it was signed from the scope?
In a word, experience. I've seen this bug before.
Look closely at the shape of the waveform. It has very distinct upper and lower limits, and it spends most of the time close to one or the other of them. This is exactly what happens during quiet periods, which would correctly have values 0x8000 +/- some small value 'a', but instead end up taking values that are within 'a' of either 0x0000 or 0xffff.