I tried resetting the decoder - the behavior doesn't changes. Worthwhile experiment nonetheless.
I'm thinking that this is just as fast as the motor goes. I've got a number of other models that seem to reach their top speed well before speed step 28 too. Maybe an artifact of the motor running on PWM rather than pure DC (I'm guessing - I'm terrible at electrical engineering)?
I guess it is possible, although you should see (or even hear) some change in the motor's speed between step 11 and 28.
The average voltage produced by PWM circuit and seen by the motor at step 11 will be quit different than at step 28 (assuming the decoder is at the factory setting which is set for a linear speed curve).
Assuming that the motor drive at maximum can supply 11V to the motor (at maximum speed the PMW voltage is very close to straight DC). But at speed step 11 the average voltage derived from the PWM motor driver will be around 5V. There is a big difference between 5V and 11V which should reflect speed change of the motor. A DC motor like we use in our models will change its rpms depending on the voltage powering it. You can even overdrive a motor by supplying it with high enough of a voltage which will spin it as high enough rpms to self destruct.
I really have no explanation as to why the motor would not change rpms for such a wide range of speed steps (assuming the decoder is functioning correctly). Maybe if the mechanism's friction was increasing proportionally to the motor's rpms, so the moad on the motor increased with rpms just at the exact rate to keep the motor's rpms constant? But why only starting about half way through the model's operating voltage range? You mentioned that in DC this loco seems to behave correctly. This is a mystery to me.
As for different speed forward and backward, that could be explained by a problem with the mechanism, or even by the motor's brushes timing being off (maybe a damaged brush).