One thing confuses me: We have ~6 V amplitude at both input terminals. In datasheet is written max.ratings -0.5...5.0V at these inputs.
Yes, this is because whoever designed this circuit took shortcuts leading to a poor design. They relied on the 49k resistors to limit current from the +/-10V MAX232 outputs into the 5V CMOS MAX485 driver chip inputs. The internal ESD protection diodes try to clamp the weaker signal, but by doing this they've potentially compromised signal integrity.
It is interesting that they used a schottky diode on the driver enable signal and not the driver input. I was going to suggest you may have missed that on your reverse engineered schematic, but you can see the difference this makes in your last captures. Both signals exceed the 5V Vcc upper bound of the MAX485 chip, but the DI signal also possibly exceeds the lower bound by going below -0.5V.
I would make two suggestions to try narrow the problem down, but they may take a little effort:
1. Remove the 49k resistors, and insert a TTL or CMOS inverter from the signal on the other side of the MAX232 into the MAX485 inputs. This should give uncompromised waveforms, and help you determine if this part of the circuit (lazy level shifting) is causing your problems.
2. Monitor both the DI signal into the MAX485, and the RO signal on the matching driver in the slave. Do this in the same capture and compare them to see if the data is being corrupted. You may also need to do the reverse for the response comparing the slave DI pin to the master RO pin. Trigger off the respective DE pin. You said the cable between the master and slave is only 1m, so I'm guessing this shouldn't be hard - but be aware the scope grounds will directly connect the master & slave grounds.
If the master and slave use different UART master clocks & dividers then their baud rates could be right near the edge of tolerance (e.g. opposite ends of tolerance) and thus any compromised start bits could cause loss of communications. Somewhat unlikely at a slow baud rate like 9600, but who knows what you may find when other short cuts have clearly been taken. Much more likely there is bit corruption at the leading or trailing edges of the data packets due to poor inter-packet timing control. You have already shown that the timing control of the DE pin on the master is inconsistent.
Also what you haven't shown is how the MAX485 RO pin is handled. If it also goes through the MAX232 (for inverting) is may also be compromising the receive data waveforms as seen by the UARTs.