Consider the following network, with correct addressing, masks and the obvious routes.

           B   K
           |.2 |.?   10.0.0.0/24
    ===+===+===+================
       |.1
       R
       |.1        10.0.1.0/24
    ===+===+===+=======+========
           |.2 |.?     |.4
           A   J       X

**Case 1: Local**

_A sends packet to X with correct IP source address but incorrect source MAC address_

Result: frame arrives at X, which updates its ARP table, hands UDP packet upstaris in its stack, which generates a reply.  Reply to A's IP address will get wrapped in the wrong ether address for the poisoned ARP cache.  If the incorrect ethernet address is that of another host J, that host will receive the frame and do whatever it likes with it.  If no host actually has that ether address, J can still snoop the frame, as the switches will be flooding the unknown ether detination. What happens next depends on the upper protocol, whether A notices it hasn't had a reply and starts resending, etc.

**Case 2: Remote**

_B sends packet to X with correct IP source address but incorrect source MAC address_


B sends frame to R, which might conceivably reject it.  More likely it updates its ARP cache for B, and forwards the packet to X.

X receives and formulates reply, which will be directed to R because B is not local.  R receives the packet, see it's for a local network, and wraps in ether with the poisoned ether address from its cache.  Just like the local case, K could be the destination, or able to snoop the frame.